diff --git a/.eslintrc.js b/.eslintrc.js
index 6daccfd9f4363..e94752bc0c093 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -69,12 +69,6 @@ module.exports = {
         'jsx-a11y/no-onchange': 'off',
       },
     },
-    {
-      files: ['src/legacy/core_plugins/data/**/*.{js,ts,tsx}'],
-      rules: {
-        'react-hooks/exhaustive-deps': 'off',
-      },
-    },
     {
       files: ['src/legacy/core_plugins/expressions/**/*.{js,ts,tsx}'],
       rules: {
diff --git a/.i18nrc.json b/.i18nrc.json
index 07878ed3c15fb..78c4be6f4a356 100644
--- a/.i18nrc.json
+++ b/.i18nrc.json
@@ -3,11 +3,9 @@
     "common.ui": "src/legacy/ui",
     "console": "src/plugins/console",
     "core": "src/core",
+    "discover": "src/plugins/discover",
     "dashboard": "src/plugins/dashboard",
-    "data": [
-      "src/legacy/core_plugins/data",
-      "src/plugins/data"
-    ],
+    "data": "src/plugins/data",
     "embeddableApi": "src/plugins/embeddable",
     "embeddableExamples": "examples/embeddable_examples",
     "share": "src/plugins/share",
@@ -38,8 +36,8 @@
     "server": "src/legacy/server",
     "statusPage": "src/legacy/core_plugins/status_page",
     "telemetry": [
-      "src/legacy/core_plugins/telemetry",
-      "src/plugins/telemetry"
+      "src/plugins/telemetry",
+      "src/plugins/telemetry_management_section"
     ],
     "tileMap": "src/legacy/core_plugins/tile_map",
     "timelion": ["src/legacy/core_plugins/timelion", "src/legacy/core_plugins/vis_type_timelion", "src/plugins/timelion"],
diff --git a/Jenkinsfile b/Jenkinsfile
index d43da6e0bee04..79d3c93006cb6 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -40,7 +40,12 @@ kibanaPipeline(timeoutMinutes: 135, checkPrChanges: true) {
           'xpack-ciGroup9': kibanaPipeline.xpackCiGroupProcess(9),
           'xpack-ciGroup10': kibanaPipeline.xpackCiGroupProcess(10),
           'xpack-accessibility': kibanaPipeline.functionalTestProcess('xpack-accessibility', './test/scripts/jenkins_xpack_accessibility.sh'),
-          'xpack-siemCypress': kibanaPipeline.functionalTestProcess('xpack-siemCypress', './test/scripts/jenkins_siem_cypress.sh'),
+          'xpack-siemCypress': { processNumber ->
+            whenChanged(['x-pack/legacy/plugins/siem/', 'x-pack/test/siem_cypress/']) {
+              kibanaPipeline.functionalTestProcess('xpack-siemCypress', './test/scripts/jenkins_siem_cypress.sh')(processNumber)
+            }
+          },
+
           // 'xpack-visualRegression': kibanaPipeline.functionalTestProcess('xpack-visualRegression', './test/scripts/jenkins_xpack_visual_regression.sh'),
         ]),
       ])
diff --git a/docs/api/saved-objects/bulk_create.asciidoc b/docs/api/saved-objects/bulk_create.asciidoc
index ca8cc0f287015..d649684bc30f2 100644
--- a/docs/api/saved-objects/bulk_create.asciidoc
+++ b/docs/api/saved-objects/bulk_create.asciidoc
@@ -11,6 +11,15 @@ experimental[] Create multiple {kib} saved objects.
 
 `POST /api/saved_objects/_bulk_create`
 
+`POST /s/<space_id>/api/saved_objects/_bulk_create`
+
+
+[[saved-objects-api-bulk-create-path-params]]
+==== Path parameters
+
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL the default space is used.
+
 [[saved-objects-api-bulk-create-query-params]]
 ==== Query parameters
 
@@ -38,7 +47,7 @@ experimental[] Create multiple {kib} saved objects.
 [[saved-objects-api-bulk-create-response-body]]
 ==== Response body
 
-`saved_objects`:: 
+`saved_objects`::
   (array) Top-level property the contains objects that represent the response for each of the requested objects. The order of the objects in the response is identical to the order of the objects in the request.
 
 Saved objects that are unable to persist are replaced with an error object.
@@ -46,13 +55,13 @@ Saved objects that are unable to persist are replaced with an error object.
 [[saved-objects-api-bulk-create-codes]]
 ==== Response code
 
-`200`:: 
+`200`::
   Indicates a successful call.
 
 [[saved-objects-api-bulk-create-example]]
 ==== Example
 
-Create an index pattern with the `my-pattern` ID, and a dashboard with the `my-dashboard` ID: 
+Create an index pattern with the `my-pattern` ID, and a dashboard with the `my-dashboard` ID:
 
 [source,js]
 --------------------------------------------------
@@ -67,7 +76,7 @@ POST api/saved_objects/_bulk_create
   },
   {
     "type": "dashboard",
-    "id": "my-dashboard",
+    "id": "be3733a0-9efe-11e7-acb3-3dab96693fab",
     "attributes": {
       "title": "Look at my dashboard"
     }
@@ -91,7 +100,7 @@ The API returns the following:
       }
     },
     {
-      "id": "my-dashboard",
+      "id": "be3733a0-9efe-11e7-acb3-3dab96693fab",
       "type": "dashboard",
       "error": {
         "statusCode": 409,
diff --git a/docs/api/saved-objects/bulk_get.asciidoc b/docs/api/saved-objects/bulk_get.asciidoc
index 4f2cbcb980f82..3ef5823716d79 100644
--- a/docs/api/saved-objects/bulk_get.asciidoc
+++ b/docs/api/saved-objects/bulk_get.asciidoc
@@ -11,6 +11,14 @@ experimental[] Retrieve multiple {kib} saved objects by ID.
 
 `POST /api/saved_objects/_bulk_get`
 
+`POST /s/<space_id>/api/saved_objects/_bulk_get`
+
+[[saved-objects-api-bulk-get-path-params]]
+==== Path parameters
+
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
+
 [[saved-objects-api-bulk-get-request-body]]
 ==== Request Body
 
@@ -18,15 +26,15 @@ experimental[] Retrieve multiple {kib} saved objects by ID.
   (Required, string) Valid options include `visualization`, `dashboard`, `search`, `index-pattern`, `config`, and `timelion-sheet`.
 
 `id`::
-  (Required, string) ID of the retrieved object.
+  (Required, string) ID of the retrieved object. The ID includes the {kib} unique identifier or a custom identifier.
 
 `fields`::
   (Optional, array) The fields returned in the object response.
-  
+
 [[saved-objects-api-bulk-get-response-body]]
 ==== Response body
 
-`saved_objects`:: 
+`saved_objects`::
   (array) Top-level property the contains objects that represent the response for each of the requested objects. The order of the objects in the response is identical to the order of the objects in the request.
 
 Saved objects that are unable to persist are replaced with an error object.
@@ -34,13 +42,13 @@ Saved objects that are unable to persist are replaced with an error object.
 [[saved-objects-api-bulk-get-body-codes]]
 ==== Response code
 
-`200`:: 
-  Indicates a successfully call.
+`200`::
+  Indicates a successful call.
 
 [[saved-objects-api-bulk-get-body-example]]
 ==== Example
 
-Retrieve an index pattern with the `my-pattern` ID, and a dashboard with the `my-dashboard` ID: 
+Retrieve an index pattern with the `my-pattern` ID, and a dashboard with the `my-dashboard` ID:
 
 [source,js]
 --------------------------------------------------
@@ -52,7 +60,7 @@ POST api/saved_objects/_bulk_get
   },
   {
     "type": "dashboard",
-    "id": "my-dashboard"
+    "id": "be3733a0-9efe-11e7-acb3-3dab96693fab"
   }
 ]
 --------------------------------------------------
diff --git a/docs/api/saved-objects/create.asciidoc b/docs/api/saved-objects/create.asciidoc
index fecc3f3732f2a..634c71bb4eefe 100644
--- a/docs/api/saved-objects/create.asciidoc
+++ b/docs/api/saved-objects/create.asciidoc
@@ -13,9 +13,14 @@ experimental[] Create {kib} saved objects.
 
 `POST /api/saved_objects/<type>/<id>`
 
+`POST /s/<space_id>/saved_objects/<type>`
+
 [[saved-objects-api-create-path-params]]
 ==== Path parameters
 
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
+
 `<type>`::
   (Required, string) Valid options include `visualization`, `dashboard`, `search`, `index-pattern`, `config`, and `timelion-sheet`.
 
@@ -44,9 +49,9 @@ any data that you send to the API is properly formed.
 [[saved-objects-api-create-request-codes]]
 ==== Response code
 
-`200`:: 
+`200`::
     Indicates a successful call.
-    
+
 [[saved-objects-api-create-example]]
 ==== Example
 
diff --git a/docs/api/saved-objects/delete.asciidoc b/docs/api/saved-objects/delete.asciidoc
index 4a96cf554f784..c34f9b67dfd22 100644
--- a/docs/api/saved-objects/delete.asciidoc
+++ b/docs/api/saved-objects/delete.asciidoc
@@ -13,9 +13,14 @@ WARNING: Once you delete a saved object, _it cannot be recovered_.
 
 `DELETE /api/saved_objects/<type>/<id>`
 
+`DELETE /s/<space_id>/api/saved_objects/<type>/<id>`
+
 [[saved-objects-api-delete-path-params]]
 ==== Path parameters
 
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
+
 `type`::
   (Required, string) Valid options include `visualization`, `dashboard`, `search`, `index-pattern`, `config`, and `timelion-sheet`.
 
@@ -25,7 +30,7 @@ WARNING: Once you delete a saved object, _it cannot be recovered_.
 [[saved-objects-api-delete-response-codes]]
 ==== Response code
 
-`200`:: 
+`200`::
   Indicates a successful call.
 
 ==== Examples
diff --git a/docs/api/saved-objects/export.asciidoc b/docs/api/saved-objects/export.asciidoc
index ee56e6bad75c8..1b4f50dda2ddb 100644
--- a/docs/api/saved-objects/export.asciidoc
+++ b/docs/api/saved-objects/export.asciidoc
@@ -11,15 +11,23 @@ experimental[] Retrieve sets of saved objects that you want to import into {kib}
 
 `POST /api/saved_objects/_export`
 
+`POST /s/<space_id>/api/saved_objects/_export`
+
+[[saved-objects-api-export-path-params]]
+==== Path parameters
+
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
+
 [[saved-objects-api-export-request-request-body]]
 ==== Request body
 
 `type`::
   (Optional, array|string) The saved object types to include in the export.
-  
+
 `objects`::
   (Optional, array) A list of objects to export.
-  
+
 `includeReferencesDeep`::
   (Optional, boolean) Includes all of the referenced objects in the exported objects.
 
@@ -50,7 +58,7 @@ When `excludeExportDetails=false` (the default) we append an export result detai
 [[export-objects-api-create-request-codes]]
 ==== Response code
 
-`200`:: 
+`200`::
     Indicates a successful call.
 
 [[ssaved-objects-api-create-example]]
diff --git a/docs/api/saved-objects/find.asciidoc b/docs/api/saved-objects/find.asciidoc
index f20ded78e0743..955c50922fde7 100644
--- a/docs/api/saved-objects/find.asciidoc
+++ b/docs/api/saved-objects/find.asciidoc
@@ -11,33 +11,41 @@ experimental[] Retrieve a paginated set of {kib} saved objects by various condit
 
 `GET /api/saved_objects/_find`
 
+`GET /s/<space_id>/api/saved_objects/_find`
+
+[[saved-objects-api-find-path-params]]
+==== Path parameters
+
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
+
 [[saved-objects-api-find-query-params]]
 ==== Query Parameters
 
 `type`::
   (Required, array|string) The saved object types to include in the export.
-  
+
 `per_page`::
   (Optional, number) The number of objects to return per page.
-  
+
 `page`::
   (Optional, number) The page of objects to return.
-  
+
 `search`::
   (Optional, string) An Elasticsearch {ref}/query-dsl-simple-query-string-query.html[simple_query_string] query that filters the objects in the response.
-  
+
 `default_search_operator`::
   (Optional, string) The default operator to use for the `simple_query_string`.
-  
+
 `search_fields`::
   (Optional, array|string) The fields to perform the `simple_query_string` parsed query against.
-  
+
 `fields`::
   (Optional, array|string) The fields to return in the response.
-  
+
 `sort_field`::
   (Optional, string) The field that sorts the response.
-  
+
 `has_reference`::
   (Optional, object) Filters to objects that have a relationship with the type and ID combination.
 
@@ -52,7 +60,7 @@ change. Use the find API for traditional paginated results, but avoid using it t
 [[saved-objects-api-find-request-codes]]
 ==== Response code
 
-`200`:: 
+`200`::
     Indicates a successful call.
 
 ==== Examples
@@ -92,4 +100,3 @@ query parameter for each value:
 GET api/saved_objects/_find?fields=id&fields=title
 --------------------------------------------------
 // KIBANA
-
diff --git a/docs/api/saved-objects/get.asciidoc b/docs/api/saved-objects/get.asciidoc
index f0c22ced4b121..29f8ef67e0a83 100644
--- a/docs/api/saved-objects/get.asciidoc
+++ b/docs/api/saved-objects/get.asciidoc
@@ -11,9 +11,15 @@ experimental[] Retrieve a single {kib} saved object by ID.
 
 `GET /api/saved_objects/<type>/<id>`
 
+`GET /s/<space_id>/api/saved_objects/<type>/<id>`
+
 [[saved-objects-api-get-params]]
 ==== Path parameters
 
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
+
+
 `type`::
   (Required, string) Valid options include `visualization`, `dashboard`, `search`, `index-pattern`, `config`, and `timelion-sheet`.
 
@@ -23,10 +29,10 @@ experimental[] Retrieve a single {kib} saved object by ID.
 [[saved-objects-api-get-codes]]
 ==== Response code
 
-`200`:: 
+`200`::
     Indicates a successful call.
 
-[[saved-objects-api-get-example]]      
+[[saved-objects-api-get-example]]
 ==== Example
 
 Retrieve the index pattern object with the `my-pattern` ID:
@@ -50,3 +56,59 @@ The API returns the following:
   }
 }
 --------------------------------------------------
+
+The following example retrieves a dashboard object in the `testspace` by id.
+
+[source,js]
+--------------------------------------------------
+GET /s/testspace/api/saved_objects/dashboard/7adfa750-4c81-11e8-b3d7-01146121b73d
+--------------------------------------------------
+// KIBANA
+
+The API returns the following:
+
+[source,js]
+--------------------------------------------------
+{
+  "id": "7adfa750-4c81-11e8-b3d7-01146121b73d",
+  "type": "dashboard",
+  "updated_at": "2019-07-23T00:11:07.059Z",
+  "version": "WzQ0LDFd",
+  "attributes": {
+    "title": "[Flights] Global Flight Dashboard",
+    "hits": 0,
+    "description": "Analyze mock flight data for ES-Air, Logstash Airways, Kibana Airlines and JetBeats",
+    "panelsJSON": "[{\"panelIndex\":\"1\",\"gridData\":{\"x\":0,\"y\":0,\"w\":32,\"h\":7,\"i\":\"1\"},\"embeddableConfig\":{},\"version\":\"6.3.0\",\"panelRefName\":\"panel_0\"},{\"panelIndex\":\"3\",\"gridData\":{\"x\":17,\"y\":7,\"w\":23,\"h\":12,\"i\":\"3\"},\"embeddableConfig\":{\"vis\":{\"colors\":{\"Average Ticket Price\":\"#0A50A1\",\"Flight Count\":\"#82B5D8\"},\"legendOpen\":false}},\"version\":\"6.3.0\",\"panelRefName\":\"panel_1\"},{\"panelIndex\":\"4\",\"gridData\":{\"x\":0,\"y\":85,\"w\":48,\"h\":15,\"i\":\"4\"},\"embeddableConfig\":{},\"version\":\"6.3.0\",\"panelRefName\":\"panel_2\"},{\"panelIndex\":\"5\",\"gridData\":{\"x\":0,\"y\":7,\"w\":17,\"h\":12,\"i\":\"5\"},\"embeddableConfig\":{\"vis\":{\"colors\":{\"ES-Air\":\"#447EBC\",\"JetBeats\":\"#65C5DB\",\"Kibana Airlines\":\"#BA43A9\",\"Logstash Airways\":\"#E5AC0E\"},\"legendOpen\":false}},\"version\":\"6.3.0\",\"panelRefName\":\"panel_3\"},{\"panelIndex\":\"6\",\"gridData\":{\"x\":24,\"y\":33,\"w\":24,\"h\":14,\"i\":\"6\"},\"embeddableConfig\":{\"vis\":{\"colors\":{\"Carrier Delay\":\"#5195CE\",\"Late Aircraft Delay\":\"#1F78C1\",\"NAS Delay\":\"#70DBED\",\"No Delay\":\"#BADFF4\",\"Security Delay\":\"#052B51\",\"Weather Delay\":\"#6ED0E0\"}}},\"version\":\"6.3.0\",\"panelRefName\":\"panel_4\"},{\"panelIndex\":\"7\",\"gridData\":{\"x\":24,\"y\":19,\"w\":24,\"h\":14,\"i\":\"7\"},\"embeddableConfig\":{},\"version\":\"6.3.0\",\"panelRefName\":\"panel_5\"},{\"panelIndex\":\"10\",\"gridData\":{\"x\":0,\"y\":35,\"w\":24,\"h\":12,\"i\":\"10\"},\"embeddableConfig\":{\"vis\":{\"colors\":{\"Count\":\"#1F78C1\"},\"legendOpen\":false}},\"version\":\"6.3.0\",\"panelRefName\":\"panel_6\"},{\"panelIndex\":\"13\",\"gridData\":{\"x\":10,\"y\":19,\"w\":14,\"h\":8,\"i\":\"13\"},\"embeddableConfig\":{\"vis\":{\"colors\":{\"Count\":\"#1F78C1\"},\"legendOpen\":false}},\"version\":\"6.3.0\",\"panelRefName\":\"panel_7\"},{\"panelIndex\":\"14\",\"gridData\":{\"x\":10,\"y\":27,\"w\":14,\"h\":8,\"i\":\"14\"},\"embeddableConfig\":{\"vis\":{\"colors\":{\"Count\":\"#1F78C1\"},\"legendOpen\":false}},\"version\":\"6.3.0\",\"panelRefName\":\"panel_8\"},{\"panelIndex\":\"18\",\"gridData\":{\"x\":24,\"y\":70,\"w\":24,\"h\":15,\"i\":\"18\"},\"embeddableConfig\":{\"mapCenter\":[27.421687059550266,15.371002131141724],\"mapZoom\":1},\"version\":\"6.3.0\",\"panelRefName\":\"panel_9\"},{\"panelIndex\":\"21\",\"gridData\":{\"x\":0,\"y\":62,\"w\":48,\"h\":8,\"i\":\"21\"},\"embeddableConfig\":{},\"version\":\"6.3.0\",\"panelRefName\":\"panel_10\"},{\"panelIndex\":\"22\",\"gridData\":{\"x\":32,\"y\":0,\"w\":16,\"h\":7,\"i\":\"22\"},\"embeddableConfig\":{},\"version\":\"6.3.0\",\"panelRefName\":\"panel_11\"},{\"panelIndex\":\"23\",\"gridData\":{\"x\":0,\"y\":70,\"w\":24,\"h\":15,\"i\":\"23\"},\"embeddableConfig\":{\"mapCenter\":[42.19556096274418,9.536742995308601e-7],\"mapZoom\":1},\"version\":\"6.3.0\",\"panelRefName\":\"panel_12\"},{\"panelIndex\":\"25\",\"gridData\":{\"x\":0,\"y\":19,\"w\":10,\"h\":8,\"i\":\"25\"},\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(247,251,255)\",\"100 - 150\":\"rgb(107,174,214)\",\"150 - 200\":\"rgb(33,113,181)\",\"200 - 250\":\"rgb(8,48,107)\",\"50 - 100\":\"rgb(198,219,239)\"},\"legendOpen\":false}},\"version\":\"6.3.0\",\"panelRefName\":\"panel_13\"},{\"panelIndex\":\"27\",\"gridData\":{\"x\":0,\"y\":27,\"w\":10,\"h\":8,\"i\":\"27\"},\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 - 50\":\"rgb(247,251,255)\",\"100 - 150\":\"rgb(107,174,214)\",\"150 - 200\":\"rgb(33,113,181)\",\"200 - 250\":\"rgb(8,48,107)\",\"50 - 100\":\"rgb(198,219,239)\"},\"legendOpen\":false}},\"version\":\"6.3.0\",\"panelRefName\":\"panel_14\"},{\"panelIndex\":\"28\",\"gridData\":{\"x\":0,\"y\":47,\"w\":24,\"h\":15,\"i\":\"28\"},\"embeddableConfig\":{\"vis\":{\"defaultColors\":{\"0 -* Connection #0 to host 69c72adb58fa46c69a01afdf4a6cbfd3.us-west1.gcp.cloud.es.io left intact\n 11\":\"rgb(247,251,255)\",\"11 - 22\":\"rgb(208,225,242)\",\"22 - 33\":\"rgb(148,196,223)\",\"33 - 44\":\"rgb(74,152,201)\",\"44 - 55\":\"rgb(23,100,171)\"},\"legendOpen\":false}},\"version\":\"6.3.0\",\"panelRefName\":\"panel_15\"},{\"panelIndex\":\"29\",\"gridData\":{\"x\":40,\"y\":7,\"w\":8,\"h\":6,\"i\":\"29\"},\"embeddableConfig\":{},\"version\":\"6.3.0\",\"panelRefName\":\"panel_16\"},{\"panelIndex\":\"30\",\"gridData\":{\"x\":40,\"y\":13,\"w\":8,\"h\":6,\"i\":\"30\"},\"embeddableConfig\":{},\"version\":\"6.3.0\",\"panelRefName\":\"panel_17\"},{\"panelIndex\":\"31\",\"gridData\":{\"x\":24,\"y\":47,\"w\":24,\"h\":15,\"i\":\"31\"},\"embeddableConfig\":{},\"version\":\"6.3.0\",\"panelRefName\":\"panel_18\"}]",
+    "optionsJSON": "{\"hidePanelTitles\":false,\"useMargins\":true}",
+    "version": 1,
+    "timeRestore": true,
+    "timeTo": "now",
+    "timeFrom": "now-24h",
+    "refreshInterval": {
+      "display": "15 minutes",
+      "pause": false,
+      "section": 2,
+      "value": 900000
+    },
+    "kibanaSavedObjectMeta": {
+      "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}"
+    }
+  },
+  "references": [
+    {
+      "name": "panel_0",
+      "type": "visualization",
+      "id": "aeb212e0-4c84-11e8-b3d7-01146121b73d"
+    },
+    . . .
+    {
+      "name": "panel_18",
+      "type": "visualization",
+      "id": "ed78a660-53a0-11e8-acbd-0be0ad9d822b"
+    }
+  ],
+  "migrationVersion": {
+    "dashboard": "7.0.0"
+  }
+}
+--------------------------------------------------
diff --git a/docs/api/saved-objects/import.asciidoc b/docs/api/saved-objects/import.asciidoc
index 63e733863cc85..1a380830ed21a 100644
--- a/docs/api/saved-objects/import.asciidoc
+++ b/docs/api/saved-objects/import.asciidoc
@@ -11,8 +11,16 @@ experimental[] Create sets of {kib} saved objects from a file created by the exp
 
 `POST /api/saved_objects/_import`
 
+`POST /s/<space_id>/api/saved_objects/_import`
+
+[[saved-objects-api-import-path-params]]
+==== Path parameters
+
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
+
 [[saved-objects-api-import-query-params]]
-==== Query parameter
+==== Query parameters
 
 `overwrite`::
   (Optional, boolean) Overwrites saved objects.
@@ -28,19 +36,19 @@ The request body must include the multipart/form-data type.
 [[saved-objects-api-import-response-body]]
 ==== Response body
 
-`success`:: 
-  Top-level property that indicates if the import was successful. 
+`success`::
+  Top-level property that indicates if the import was successful.
 
-`successCount`:: 
+`successCount`::
   Indicates the number of successfully imported records.
 
 `errors`::
   (array) Indicates the import was unsuccessful and specifies the objects that failed to import.
-  
+
 [[saved-objects-api-import-codes]]
 ==== Response code
 
-`200`:: 
+`200`::
     Indicates a successful call.
 
 ==== Examples
diff --git a/docs/api/saved-objects/resolve_import_errors.asciidoc b/docs/api/saved-objects/resolve_import_errors.asciidoc
index b97e5c2a617b0..b64e5deb361b2 100644
--- a/docs/api/saved-objects/resolve_import_errors.asciidoc
+++ b/docs/api/saved-objects/resolve_import_errors.asciidoc
@@ -4,9 +4,9 @@
 <titleabbrev>Resolve import errors</titleabbrev>
 ++++
 
-experimental[] Resolve errors from the import API. 
+experimental[] Resolve errors from the import API.
 
-To resolve errors, you can: 
+To resolve errors, you can:
 
 * Retry certain saved objects
 
@@ -19,6 +19,14 @@ To resolve errors, you can:
 
 `POST /api/saved_objects/_resolve_import_errors`
 
+`POST /s/<space_id>/api/saved_objects/_resolve_import_errors`
+
+[[saved-objects-api-resolve-import-errors-path-params]]
+==== Path parameters
+
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
+
 [[saved-objects-api-resolve-import-errors-request-body]]
 ==== Request body
 
@@ -33,19 +41,19 @@ The request body must include the multipart/form-data type.
 [[saved-objects-api-resolve-import-errors-response-body]]
 ==== Response body
 
-`success`:: 
+`success`::
   Top-level property that indicates if the errors successfully resolved.
-  
-`successCount`:: 
+
+`successCount`::
   Indicates the number of successfully resolved records.
 
 `errors`::
   (array) Specifies the objects that failed to resolve.
-  
+
 [[saved-objects-api-resolve-import-errors-codes]]
 ==== Response code
 
-`200`:: 
+`200`::
     Indicates a successful call.
 
 [[saved-objects-api-resolve-import-errors-example]]
diff --git a/docs/api/saved-objects/update.asciidoc b/docs/api/saved-objects/update.asciidoc
index 5c4bb98d09228..99a9bd4ad15bb 100644
--- a/docs/api/saved-objects/update.asciidoc
+++ b/docs/api/saved-objects/update.asciidoc
@@ -11,8 +11,13 @@ experimental[] Update the attributes for existing {kib} saved objects.
 
 `PUT /api/saved_objects/<type>/<id>`
 
+`PUT /s/<space_id>/api/saved_objects/<type>/<id>`
+
 [[saved-objects-api-update-path-params]]
-==== Path Parameters
+==== Path parameters
+
+`space_id`::
+  (Optional, string) An identifier for the space. If `space_id` is not provided in the URL, the default space is used.
 
 `type`::
   (Required, string) Valid options include `visualization`, `dashboard`, `search`, `index-pattern`, `config`, and `timelion-sheet`.
@@ -21,7 +26,7 @@ experimental[] Update the attributes for existing {kib} saved objects.
   (Required, string) The object ID to update.
 
 [[saved-objects-api-update-request-body]]
-==== Request Body
+==== Request body
 
 `attributes`::
   (Required, object) The data to persist.
@@ -30,11 +35,11 @@ WARNING: When you update, attributes are not validated, which allows you to pass
 
 `references`::
   (Optional, array) Objects with `name`, `id`, and `type` properties that describe the other saved objects this object references. To refer to the other saved object, use `name` in the attributes, but never the `id`, which automatically updates during migrations or import/export.
-  
+
 [[saved-objects-api-update-errors-codes]]
 ==== Response code
 
-`200`:: 
+`200`::
     Indicates a successful call.
 
 [[saved-objects-api-update-example]]
diff --git a/docs/development/core/public/kibana-plugin-core-public.app.mount.md b/docs/development/core/public/kibana-plugin-core-public.app.mount.md
index c42f73ced95af..8a9dfd9e2e972 100644
--- a/docs/development/core/public/kibana-plugin-core-public.app.mount.md
+++ b/docs/development/core/public/kibana-plugin-core-public.app.mount.md
@@ -14,5 +14,5 @@ mount: AppMount<HistoryLocationState> | AppMountDeprecated<HistoryLocationState>
 
 ## Remarks
 
-When function has two arguments, it will be called with a [context](./kibana-plugin-core-public.appmountcontext.md) as the first argument. This behavior is \*\*deprecated\*\*, and consumers should instead use [CoreSetup.getStartServices()](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
+When function has two arguments, it will be called with a [context](./kibana-plugin-core-public.appmountcontext.md) as the first argument. This behavior is \*\*deprecated\*\*, and consumers should instead use [CoreSetup.getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.applicationsetup.md b/docs/development/core/public/kibana-plugin-core-public.applicationsetup.md
index e5554be515077..fc99e2208220f 100644
--- a/docs/development/core/public/kibana-plugin-core-public.applicationsetup.md
+++ b/docs/development/core/public/kibana-plugin-core-public.applicationsetup.md
@@ -17,5 +17,5 @@ export interface ApplicationSetup
 |  --- | --- |
 |  [register(app)](./kibana-plugin-core-public.applicationsetup.register.md) | Register an mountable application to the system. |
 |  [registerAppUpdater(appUpdater$)](./kibana-plugin-core-public.applicationsetup.registerappupdater.md) | Register an application updater that can be used to change the [AppUpdatableFields](./kibana-plugin-core-public.appupdatablefields.md) fields of all applications at runtime.<!-- -->This is meant to be used by plugins that needs to updates the whole list of applications. To only updates a specific application, use the <code>updater$</code> property of the registered application instead. |
-|  [registerMountContext(contextName, provider)](./kibana-plugin-core-public.applicationsetup.registermountcontext.md) | Register a context provider for application mounting. Will only be available to applications that depend on the plugin that registered this context. Deprecated, use [CoreSetup.getStartServices()](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->. |
+|  [registerMountContext(contextName, provider)](./kibana-plugin-core-public.applicationsetup.registermountcontext.md) | Register a context provider for application mounting. Will only be available to applications that depend on the plugin that registered this context. Deprecated, use [CoreSetup.getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->. |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.applicationsetup.registermountcontext.md b/docs/development/core/public/kibana-plugin-core-public.applicationsetup.registermountcontext.md
index 92a7ae1c0deee..1735d5df943ae 100644
--- a/docs/development/core/public/kibana-plugin-core-public.applicationsetup.registermountcontext.md
+++ b/docs/development/core/public/kibana-plugin-core-public.applicationsetup.registermountcontext.md
@@ -8,7 +8,7 @@
 > 
 > 
 
-Register a context provider for application mounting. Will only be available to applications that depend on the plugin that registered this context. Deprecated, use [CoreSetup.getStartServices()](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
+Register a context provider for application mounting. Will only be available to applications that depend on the plugin that registered this context. Deprecated, use [CoreSetup.getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.applicationstart.md b/docs/development/core/public/kibana-plugin-core-public.applicationstart.md
index 834411de5d57c..a93bc61bac527 100644
--- a/docs/development/core/public/kibana-plugin-core-public.applicationstart.md
+++ b/docs/development/core/public/kibana-plugin-core-public.applicationstart.md
@@ -24,5 +24,5 @@ export interface ApplicationStart
 |  --- | --- |
 |  [getUrlForApp(appId, options)](./kibana-plugin-core-public.applicationstart.geturlforapp.md) | Returns an URL to a given app, including the global base path. By default, the URL is relative (/basePath/app/my-app). Use the <code>absolute</code> option to generate an absolute url (http://host:port/basePath/app/my-app)<!-- -->Note that when generating absolute urls, the protocol, host and port are determined from the browser location. |
 |  [navigateToApp(appId, options)](./kibana-plugin-core-public.applicationstart.navigatetoapp.md) | Navigate to a given app |
-|  [registerMountContext(contextName, provider)](./kibana-plugin-core-public.applicationstart.registermountcontext.md) | Register a context provider for application mounting. Will only be available to applications that depend on the plugin that registered this context. Deprecated, use [CoreSetup.getStartServices()](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->. |
+|  [registerMountContext(contextName, provider)](./kibana-plugin-core-public.applicationstart.registermountcontext.md) | Register a context provider for application mounting. Will only be available to applications that depend on the plugin that registered this context. Deprecated, use [CoreSetup.getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->. |
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.applicationstart.registermountcontext.md b/docs/development/core/public/kibana-plugin-core-public.applicationstart.registermountcontext.md
index 6e0fbb46e9a1e..11f661c4af2b3 100644
--- a/docs/development/core/public/kibana-plugin-core-public.applicationstart.registermountcontext.md
+++ b/docs/development/core/public/kibana-plugin-core-public.applicationstart.registermountcontext.md
@@ -8,7 +8,7 @@
 > 
 > 
 
-Register a context provider for application mounting. Will only be available to applications that depend on the plugin that registered this context. Deprecated, use [CoreSetup.getStartServices()](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
+Register a context provider for application mounting. Will only be available to applications that depend on the plugin that registered this context. Deprecated, use [CoreSetup.getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.appmountcontext.md b/docs/development/core/public/kibana-plugin-core-public.appmountcontext.md
index d0b243859aab0..52a36b0b56f02 100644
--- a/docs/development/core/public/kibana-plugin-core-public.appmountcontext.md
+++ b/docs/development/core/public/kibana-plugin-core-public.appmountcontext.md
@@ -8,7 +8,7 @@
 > 
 > 
 
-The context object received when applications are mounted to the DOM. Deprecated, use [CoreSetup.getStartServices()](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
+The context object received when applications are mounted to the DOM. Deprecated, use [CoreSetup.getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
 
 <b>Signature:</b>
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.appmountdeprecated.md b/docs/development/core/public/kibana-plugin-core-public.appmountdeprecated.md
index 130689882495a..66b8a69d84a38 100644
--- a/docs/development/core/public/kibana-plugin-core-public.appmountdeprecated.md
+++ b/docs/development/core/public/kibana-plugin-core-public.appmountdeprecated.md
@@ -18,5 +18,5 @@ export declare type AppMountDeprecated<HistoryLocationState = unknown> = (contex
 
 ## Remarks
 
-When function has two arguments, it will be called with a [context](./kibana-plugin-core-public.appmountcontext.md) as the first argument. This behavior is \*\*deprecated\*\*, and consumers should instead use [CoreSetup.getStartServices()](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
+When function has two arguments, it will be called with a [context](./kibana-plugin-core-public.appmountcontext.md) as the first argument. This behavior is \*\*deprecated\*\*, and consumers should instead use [CoreSetup.getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->.
 
diff --git a/docs/development/core/public/kibana-plugin-core-public.coresetup.getstartservices.md b/docs/development/core/public/kibana-plugin-core-public.coresetup.getstartservices.md
index 91b906cf83d01..e4fec4eae31b1 100644
--- a/docs/development/core/public/kibana-plugin-core-public.coresetup.getstartservices.md
+++ b/docs/development/core/public/kibana-plugin-core-public.coresetup.getstartservices.md
@@ -2,16 +2,12 @@
 
 [Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [CoreSetup](./kibana-plugin-core-public.coresetup.md) &gt; [getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md)
 
-## CoreSetup.getStartServices() method
+## CoreSetup.getStartServices property
 
-Allows plugins to get access to APIs available in start inside async handlers, such as [App.mount](./kibana-plugin-core-public.app.mount.md)<!-- -->. Promise will not resolve until Core and plugin dependencies have completed `start`<!-- -->.
+[StartServicesAccessor](./kibana-plugin-core-public.startservicesaccessor.md)
 
 <b>Signature:</b>
 
 ```typescript
-getStartServices(): Promise<[CoreStart, TPluginsStart]>;
+getStartServices: StartServicesAccessor<TPluginsStart>;
 ```
-<b>Returns:</b>
-
-`Promise<[CoreStart, TPluginsStart]>`
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.coresetup.md b/docs/development/core/public/kibana-plugin-core-public.coresetup.md
index f211b740e84a3..c039bc19348cc 100644
--- a/docs/development/core/public/kibana-plugin-core-public.coresetup.md
+++ b/docs/development/core/public/kibana-plugin-core-public.coresetup.md
@@ -19,14 +19,9 @@ export interface CoreSetup<TPluginsStart extends object = object>
 |  [application](./kibana-plugin-core-public.coresetup.application.md) | <code>ApplicationSetup</code> | [ApplicationSetup](./kibana-plugin-core-public.applicationsetup.md) |
 |  [context](./kibana-plugin-core-public.coresetup.context.md) | <code>ContextSetup</code> | [ContextSetup](./kibana-plugin-core-public.contextsetup.md) |
 |  [fatalErrors](./kibana-plugin-core-public.coresetup.fatalerrors.md) | <code>FatalErrorsSetup</code> | [FatalErrorsSetup](./kibana-plugin-core-public.fatalerrorssetup.md) |
+|  [getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md) | <code>StartServicesAccessor&lt;TPluginsStart&gt;</code> | [StartServicesAccessor](./kibana-plugin-core-public.startservicesaccessor.md) |
 |  [http](./kibana-plugin-core-public.coresetup.http.md) | <code>HttpSetup</code> | [HttpSetup](./kibana-plugin-core-public.httpsetup.md) |
 |  [injectedMetadata](./kibana-plugin-core-public.coresetup.injectedmetadata.md) | <code>{</code><br/><code>        getInjectedVar: (name: string, defaultValue?: any) =&gt; unknown;</code><br/><code>    }</code> | exposed temporarily until https://github.com/elastic/kibana/issues/41990 done use \*only\* to retrieve config values. There is no way to set injected values in the new platform. Use the legacy platform API instead. |
 |  [notifications](./kibana-plugin-core-public.coresetup.notifications.md) | <code>NotificationsSetup</code> | [NotificationsSetup](./kibana-plugin-core-public.notificationssetup.md) |
 |  [uiSettings](./kibana-plugin-core-public.coresetup.uisettings.md) | <code>IUiSettingsClient</code> | [IUiSettingsClient](./kibana-plugin-core-public.iuisettingsclient.md) |
 
-## Methods
-
-|  Method | Description |
-|  --- | --- |
-|  [getStartServices()](./kibana-plugin-core-public.coresetup.getstartservices.md) | Allows plugins to get access to APIs available in start inside async handlers, such as [App.mount](./kibana-plugin-core-public.app.mount.md)<!-- -->. Promise will not resolve until Core and plugin dependencies have completed <code>start</code>. |
-
diff --git a/docs/development/core/public/kibana-plugin-core-public.md b/docs/development/core/public/kibana-plugin-core-public.md
index b8aa56eb2941b..adc87de2b9e7e 100644
--- a/docs/development/core/public/kibana-plugin-core-public.md
+++ b/docs/development/core/public/kibana-plugin-core-public.md
@@ -38,7 +38,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [AppLeaveDefaultAction](./kibana-plugin-core-public.appleavedefaultaction.md) | Action to return from a [AppLeaveHandler](./kibana-plugin-core-public.appleavehandler.md) to execute the default behaviour when leaving the application.<!-- -->See  |
 |  [ApplicationSetup](./kibana-plugin-core-public.applicationsetup.md) |  |
 |  [ApplicationStart](./kibana-plugin-core-public.applicationstart.md) |  |
-|  [AppMountContext](./kibana-plugin-core-public.appmountcontext.md) | The context object received when applications are mounted to the DOM. Deprecated, use [CoreSetup.getStartServices()](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->. |
+|  [AppMountContext](./kibana-plugin-core-public.appmountcontext.md) | The context object received when applications are mounted to the DOM. Deprecated, use [CoreSetup.getStartServices](./kibana-plugin-core-public.coresetup.getstartservices.md)<!-- -->. |
 |  [AppMountParameters](./kibana-plugin-core-public.appmountparameters.md) |  |
 |  [Capabilities](./kibana-plugin-core-public.capabilities.md) | The read-only set of capabilities available for the current UI session. Capabilities are simple key-value pairs of (string, boolean), where the string denotes the capability ID, and the boolean is a flag indicating if the capability is enabled or disabled. |
 |  [ChromeBadge](./kibana-plugin-core-public.chromebadge.md) |  |
@@ -153,6 +153,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [SavedObjectAttribute](./kibana-plugin-core-public.savedobjectattribute.md) | Type definition for a Saved Object attribute value |
 |  [SavedObjectAttributeSingle](./kibana-plugin-core-public.savedobjectattributesingle.md) | Don't use this type, it's simply a helper type for [SavedObjectAttribute](./kibana-plugin-core-public.savedobjectattribute.md) |
 |  [SavedObjectsClientContract](./kibana-plugin-core-public.savedobjectsclientcontract.md) | SavedObjectsClientContract as implemented by the [SavedObjectsClient](./kibana-plugin-core-public.savedobjectsclient.md) |
+|  [StartServicesAccessor](./kibana-plugin-core-public.startservicesaccessor.md) | Allows plugins to get access to APIs available in start inside async handlers, such as [App.mount](./kibana-plugin-core-public.app.mount.md)<!-- -->. Promise will not resolve until Core and plugin dependencies have completed <code>start</code>. |
 |  [StringValidation](./kibana-plugin-core-public.stringvalidation.md) | Allows regex objects or a regex string |
 |  [Toast](./kibana-plugin-core-public.toast.md) |  |
 |  [ToastInput](./kibana-plugin-core-public.toastinput.md) | Inputs for [IToasts](./kibana-plugin-core-public.itoasts.md) APIs. |
diff --git a/docs/development/core/public/kibana-plugin-core-public.startservicesaccessor.md b/docs/development/core/public/kibana-plugin-core-public.startservicesaccessor.md
new file mode 100644
index 0000000000000..02e896a6b47e5
--- /dev/null
+++ b/docs/development/core/public/kibana-plugin-core-public.startservicesaccessor.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-public](./kibana-plugin-core-public.md) &gt; [StartServicesAccessor](./kibana-plugin-core-public.startservicesaccessor.md)
+
+## StartServicesAccessor type
+
+Allows plugins to get access to APIs available in start inside async handlers, such as [App.mount](./kibana-plugin-core-public.app.mount.md)<!-- -->. Promise will not resolve until Core and plugin dependencies have completed `start`<!-- -->.
+
+<b>Signature:</b>
+
+```typescript
+export declare type StartServicesAccessor<TPluginsStart extends object = object> = () => Promise<[CoreStart, TPluginsStart]>;
+```
diff --git a/docs/development/core/server/kibana-plugin-core-server.coresetup.getstartservices.md b/docs/development/core/server/kibana-plugin-core-server.coresetup.getstartservices.md
index 10a656363c0d0..ea8e610ee56de 100644
--- a/docs/development/core/server/kibana-plugin-core-server.coresetup.getstartservices.md
+++ b/docs/development/core/server/kibana-plugin-core-server.coresetup.getstartservices.md
@@ -2,16 +2,12 @@
 
 [Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [CoreSetup](./kibana-plugin-core-server.coresetup.md) &gt; [getStartServices](./kibana-plugin-core-server.coresetup.getstartservices.md)
 
-## CoreSetup.getStartServices() method
+## CoreSetup.getStartServices property
 
-Allows plugins to get access to APIs available in start inside async handlers. Promise will not resolve until Core and plugin dependencies have completed `start`<!-- -->. This should only be used inside handlers registered during `setup` that will only be executed after `start` lifecycle.
+[StartServicesAccessor](./kibana-plugin-core-server.startservicesaccessor.md)
 
 <b>Signature:</b>
 
 ```typescript
-getStartServices(): Promise<[CoreStart, TPluginsStart]>;
+getStartServices: StartServicesAccessor<TPluginsStart>;
 ```
-<b>Returns:</b>
-
-`Promise<[CoreStart, TPluginsStart]>`
-
diff --git a/docs/development/core/server/kibana-plugin-core-server.coresetup.md b/docs/development/core/server/kibana-plugin-core-server.coresetup.md
index 5b5803629cc86..b0eba8ac78063 100644
--- a/docs/development/core/server/kibana-plugin-core-server.coresetup.md
+++ b/docs/development/core/server/kibana-plugin-core-server.coresetup.md
@@ -19,15 +19,10 @@ export interface CoreSetup<TPluginsStart extends object = object>
 |  [capabilities](./kibana-plugin-core-server.coresetup.capabilities.md) | <code>CapabilitiesSetup</code> | [CapabilitiesSetup](./kibana-plugin-core-server.capabilitiessetup.md) |
 |  [context](./kibana-plugin-core-server.coresetup.context.md) | <code>ContextSetup</code> | [ContextSetup](./kibana-plugin-core-server.contextsetup.md) |
 |  [elasticsearch](./kibana-plugin-core-server.coresetup.elasticsearch.md) | <code>ElasticsearchServiceSetup</code> | [ElasticsearchServiceSetup](./kibana-plugin-core-server.elasticsearchservicesetup.md) |
+|  [getStartServices](./kibana-plugin-core-server.coresetup.getstartservices.md) | <code>StartServicesAccessor&lt;TPluginsStart&gt;</code> | [StartServicesAccessor](./kibana-plugin-core-server.startservicesaccessor.md) |
 |  [http](./kibana-plugin-core-server.coresetup.http.md) | <code>HttpServiceSetup</code> | [HttpServiceSetup](./kibana-plugin-core-server.httpservicesetup.md) |
 |  [metrics](./kibana-plugin-core-server.coresetup.metrics.md) | <code>MetricsServiceSetup</code> | [MetricsServiceSetup](./kibana-plugin-core-server.metricsservicesetup.md) |
 |  [savedObjects](./kibana-plugin-core-server.coresetup.savedobjects.md) | <code>SavedObjectsServiceSetup</code> | [SavedObjectsServiceSetup](./kibana-plugin-core-server.savedobjectsservicesetup.md) |
 |  [uiSettings](./kibana-plugin-core-server.coresetup.uisettings.md) | <code>UiSettingsServiceSetup</code> | [UiSettingsServiceSetup](./kibana-plugin-core-server.uisettingsservicesetup.md) |
 |  [uuid](./kibana-plugin-core-server.coresetup.uuid.md) | <code>UuidServiceSetup</code> | [UuidServiceSetup](./kibana-plugin-core-server.uuidservicesetup.md) |
 
-## Methods
-
-|  Method | Description |
-|  --- | --- |
-|  [getStartServices()](./kibana-plugin-core-server.coresetup.getstartservices.md) | Allows plugins to get access to APIs available in start inside async handlers. Promise will not resolve until Core and plugin dependencies have completed <code>start</code>. This should only be used inside handlers registered during <code>setup</code> that will only be executed after <code>start</code> lifecycle. |
-
diff --git a/docs/development/core/server/kibana-plugin-core-server.md b/docs/development/core/server/kibana-plugin-core-server.md
index 54cf496b2d6af..a1158dc853918 100644
--- a/docs/development/core/server/kibana-plugin-core-server.md
+++ b/docs/development/core/server/kibana-plugin-core-server.md
@@ -259,6 +259,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [SavedObjectsFieldMapping](./kibana-plugin-core-server.savedobjectsfieldmapping.md) | Describe a [saved object type mapping](./kibana-plugin-core-server.savedobjectstypemappingdefinition.md) field.<!-- -->Please refer to [elasticsearch documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html) For the mapping documentation |
 |  [ScopeableRequest](./kibana-plugin-core-server.scopeablerequest.md) | A user credentials container. It accommodates the necessary auth credentials to impersonate the current user.<!-- -->See [KibanaRequest](./kibana-plugin-core-server.kibanarequest.md)<!-- -->. |
 |  [SharedGlobalConfig](./kibana-plugin-core-server.sharedglobalconfig.md) |  |
+|  [StartServicesAccessor](./kibana-plugin-core-server.startservicesaccessor.md) | Allows plugins to get access to APIs available in start inside async handlers. Promise will not resolve until Core and plugin dependencies have completed <code>start</code>. This should only be used inside handlers registered during <code>setup</code> that will only be executed after <code>start</code> lifecycle. |
 |  [StringValidation](./kibana-plugin-core-server.stringvalidation.md) | Allows regex objects or a regex string |
 |  [UiSettingsType](./kibana-plugin-core-server.uisettingstype.md) | UI element type to represent the settings. |
 
diff --git a/docs/development/core/server/kibana-plugin-core-server.startservicesaccessor.md b/docs/development/core/server/kibana-plugin-core-server.startservicesaccessor.md
new file mode 100644
index 0000000000000..4de781fc99cc1
--- /dev/null
+++ b/docs/development/core/server/kibana-plugin-core-server.startservicesaccessor.md
@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [StartServicesAccessor](./kibana-plugin-core-server.startservicesaccessor.md)
+
+## StartServicesAccessor type
+
+Allows plugins to get access to APIs available in start inside async handlers. Promise will not resolve until Core and plugin dependencies have completed `start`<!-- -->. This should only be used inside handlers registered during `setup` that will only be executed after `start` lifecycle.
+
+<b>Signature:</b>
+
+```typescript
+export declare type StartServicesAccessor<TPluginsStart extends object = object> = () => Promise<[CoreStart, TPluginsStart]>;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.enabled.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.enabled.md
new file mode 100644
index 0000000000000..2ef8c797f4054
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.enabled.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigOptions](./kibana-plugin-plugins-data-public.aggconfigoptions.md) &gt; [enabled](./kibana-plugin-plugins-data-public.aggconfigoptions.enabled.md)
+
+## AggConfigOptions.enabled property
+
+<b>Signature:</b>
+
+```typescript
+enabled?: boolean;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.id.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.id.md
new file mode 100644
index 0000000000000..8939854ab19ca
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.id.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigOptions](./kibana-plugin-plugins-data-public.aggconfigoptions.md) &gt; [id](./kibana-plugin-plugins-data-public.aggconfigoptions.id.md)
+
+## AggConfigOptions.id property
+
+<b>Signature:</b>
+
+```typescript
+id?: string;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.md
new file mode 100644
index 0000000000000..b841d9b04d6a7
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.md
@@ -0,0 +1,22 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigOptions](./kibana-plugin-plugins-data-public.aggconfigoptions.md)
+
+## AggConfigOptions interface
+
+<b>Signature:</b>
+
+```typescript
+export interface AggConfigOptions 
+```
+
+## Properties
+
+|  Property | Type | Description |
+|  --- | --- | --- |
+|  [enabled](./kibana-plugin-plugins-data-public.aggconfigoptions.enabled.md) | <code>boolean</code> |  |
+|  [id](./kibana-plugin-plugins-data-public.aggconfigoptions.id.md) | <code>string</code> |  |
+|  [params](./kibana-plugin-plugins-data-public.aggconfigoptions.params.md) | <code>Record&lt;string, any&gt;</code> |  |
+|  [schema](./kibana-plugin-plugins-data-public.aggconfigoptions.schema.md) | <code>string</code> |  |
+|  [type](./kibana-plugin-plugins-data-public.aggconfigoptions.type.md) | <code>IAggType</code> |  |
+
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.params.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.params.md
new file mode 100644
index 0000000000000..45219a837cc33
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.params.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigOptions](./kibana-plugin-plugins-data-public.aggconfigoptions.md) &gt; [params](./kibana-plugin-plugins-data-public.aggconfigoptions.params.md)
+
+## AggConfigOptions.params property
+
+<b>Signature:</b>
+
+```typescript
+params?: Record<string, any>;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.schema.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.schema.md
new file mode 100644
index 0000000000000..b2b42eb2e5b4d
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.schema.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigOptions](./kibana-plugin-plugins-data-public.aggconfigoptions.md) &gt; [schema](./kibana-plugin-plugins-data-public.aggconfigoptions.schema.md)
+
+## AggConfigOptions.schema property
+
+<b>Signature:</b>
+
+```typescript
+schema?: string;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.type.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.type.md
new file mode 100644
index 0000000000000..866065ce52ba6
--- /dev/null
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.aggconfigoptions.type.md
@@ -0,0 +1,11 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-plugins-data-public](./kibana-plugin-plugins-data-public.md) &gt; [AggConfigOptions](./kibana-plugin-plugins-data-public.aggconfigoptions.md) &gt; [type](./kibana-plugin-plugins-data-public.aggconfigoptions.type.md)
+
+## AggConfigOptions.type property
+
+<b>Signature:</b>
+
+```typescript
+type: IAggType;
+```
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.es_field_types.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.es_field_types.md
index e7341caf7b3cd..c5e01715534d1 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.es_field_types.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.es_field_types.md
@@ -30,6 +30,7 @@ export declare enum ES_FIELD_TYPES
 |  GEO\_POINT | <code>&quot;geo_point&quot;</code> |  |
 |  GEO\_SHAPE | <code>&quot;geo_shape&quot;</code> |  |
 |  HALF\_FLOAT | <code>&quot;half_float&quot;</code> |  |
+|  HISTOGRAM | <code>&quot;histogram&quot;</code> |  |
 |  INTEGER | <code>&quot;integer&quot;</code> |  |
 |  IP | <code>&quot;ip&quot;</code> |  |
 |  KEYWORD | <code>&quot;keyword&quot;</code> |  |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.kbn_field_types.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.kbn_field_types.md
index e5ae8ffbd2877..30c3aa946c1ce 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.kbn_field_types.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.kbn_field_types.md
@@ -23,6 +23,7 @@ export declare enum KBN_FIELD_TYPES
 |  DATE | <code>&quot;date&quot;</code> |  |
 |  GEO\_POINT | <code>&quot;geo_point&quot;</code> |  |
 |  GEO\_SHAPE | <code>&quot;geo_shape&quot;</code> |  |
+|  HISTOGRAM | <code>&quot;histogram&quot;</code> |  |
 |  IP | <code>&quot;ip&quot;</code> |  |
 |  MURMUR3 | <code>&quot;murmur3&quot;</code> |  |
 |  NESTED | <code>&quot;nested&quot;</code> |  |
diff --git a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
index f8516ec476e88..ea77d6f39389b 100644
--- a/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
+++ b/docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md
@@ -48,6 +48,7 @@
 
 |  Interface | Description |
 |  --- | --- |
+|  [AggConfigOptions](./kibana-plugin-plugins-data-public.aggconfigoptions.md) |  |
 |  [AggParamOption](./kibana-plugin-plugins-data-public.aggparamoption.md) |  |
 |  [DataPublicPluginSetup](./kibana-plugin-plugins-data-public.datapublicpluginsetup.md) |  |
 |  [DataPublicPluginStart](./kibana-plugin-plugins-data-public.datapublicpluginstart.md) |  |
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.es_field_types.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.es_field_types.md
index 81a7cbca77c48..d071955f4f522 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.es_field_types.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.es_field_types.md
@@ -30,6 +30,7 @@ export declare enum ES_FIELD_TYPES
 |  GEO\_POINT | <code>&quot;geo_point&quot;</code> |  |
 |  GEO\_SHAPE | <code>&quot;geo_shape&quot;</code> |  |
 |  HALF\_FLOAT | <code>&quot;half_float&quot;</code> |  |
+|  HISTOGRAM | <code>&quot;histogram&quot;</code> |  |
 |  INTEGER | <code>&quot;integer&quot;</code> |  |
 |  IP | <code>&quot;ip&quot;</code> |  |
 |  KEYWORD | <code>&quot;keyword&quot;</code> |  |
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kbn_field_types.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kbn_field_types.md
index 40b81d2f6ac4d..a0a64190497c8 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kbn_field_types.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.kbn_field_types.md
@@ -23,6 +23,7 @@ export declare enum KBN_FIELD_TYPES
 |  DATE | <code>&quot;date&quot;</code> |  |
 |  GEO\_POINT | <code>&quot;geo_point&quot;</code> |  |
 |  GEO\_SHAPE | <code>&quot;geo_shape&quot;</code> |  |
+|  HISTOGRAM | <code>&quot;histogram&quot;</code> |  |
 |  IP | <code>&quot;ip&quot;</code> |  |
 |  MURMUR3 | <code>&quot;murmur3&quot;</code> |  |
 |  NESTED | <code>&quot;nested&quot;</code> |  |
diff --git a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
index d179b9d9dcd82..e756eb9b72905 100644
--- a/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
+++ b/docs/development/plugins/data/server/kibana-plugin-plugins-data-server.md
@@ -60,6 +60,7 @@
 |  [esQuery](./kibana-plugin-plugins-data-server.esquery.md) |  |
 |  [fieldFormats](./kibana-plugin-plugins-data-server.fieldformats.md) |  |
 |  [indexPatterns](./kibana-plugin-plugins-data-server.indexpatterns.md) |  |
+|  [search](./kibana-plugin-plugins-data-server.search.md) |  |
 
 ## Type Aliases
 
@@ -69,5 +70,6 @@
 |  [IFieldFormatsRegistry](./kibana-plugin-plugins-data-server.ifieldformatsregistry.md) |  |
 |  [ISearch](./kibana-plugin-plugins-data-server.isearch.md) |  |
 |  [ISearchCancel](./kibana-plugin-plugins-data-server.isearchcancel.md) |  |
+|  [ParsedInterval](./kibana-plugin-plugins-data-server.parsedinterval.md) |  |
 |  [TSearchStrategyProvider](./kibana-plugin-plugins-data-server.tsearchstrategyprovider.md) | Search strategy provider creates an instance of a search strategy with the request handler context bound to it. This way every search strategy can use whatever information they require from the request context. |
 
diff --git a/docs/setup/settings.asciidoc b/docs/setup/settings.asciidoc
index 385b3af2ba4a4..b3437dfca2768 100644
--- a/docs/setup/settings.asciidoc
+++ b/docs/setup/settings.asciidoc
@@ -200,7 +200,7 @@ that feature would not take any effect.
 
 `logging.rotate.everyBytes:`:: [experimental] *Default: 10485760* The maximum size of a log file (that is `not an exact` limit). After the
 limit is reached, a new log file is generated. The default size limit is 10485760 (10 MB) and
-this option should be in the range of 102400 (100KB) to 1073741824 (1GB).
+this option should be in the range of 1048576 (1 MB) to 1073741824 (1 GB).
 
 `logging.rotate.keepFiles:`:: [experimental] *Default: 7* The number of most recent rotated log files to keep
 on disk. Older files are deleted during log rotation. The default value is 7. The `logging.rotate.keepFiles`
@@ -210,7 +210,7 @@ option has to be in the range of 2 to 1024 files.
 the `logging.rotate.usePolling` is enabled. That option has to be in the range of 5000 to 3600000 milliseconds.
 
 `logging.rotate.usePolling:`:: [experimental] *Default: false* By default we try to understand the best way to monitoring
-the log file. However, there is some systems where it could not be always accurate. In those cases, if needed,
+the log file and warning about it. Please be aware there are some systems where watch api is not accurate. In those cases, in order to get the feature working,
 the `polling` method could be used enabling that option.
 
 `logging.silent:`:: *Default: false* Set the value of this setting to `true` to
diff --git a/package.json b/package.json
index ac70640271b29..f156c432ab03e 100644
--- a/package.json
+++ b/package.json
@@ -187,7 +187,7 @@
     "hjson": "3.2.1",
     "hoek": "^5.0.4",
     "http-proxy-agent": "^2.1.0",
-    "https-proxy-agent": "^2.2.2",
+    "https-proxy-agent": "^5.0.0",
     "immer": "^1.5.0",
     "inert": "^5.1.0",
     "inline-style": "^2.0.0",
@@ -343,7 +343,7 @@
     "@types/lru-cache": "^5.1.0",
     "@types/markdown-it": "^0.0.7",
     "@types/minimatch": "^2.0.29",
-    "@types/mocha": "^5.2.7",
+    "@types/mocha": "^7.0.2",
     "@types/moment-timezone": "^0.5.12",
     "@types/mustache": "^0.8.31",
     "@types/node": ">=10.17.17 <10.20.0",
@@ -450,7 +450,7 @@
     "license-checker": "^16.0.0",
     "listr": "^0.14.1",
     "load-grunt-config": "^3.0.1",
-    "mocha": "^6.2.2",
+    "mocha": "^7.1.1",
     "mock-http-server": "1.3.0",
     "multistream": "^2.1.1",
     "murmurhash3js": "3.0.1",
diff --git a/packages/kbn-ui-shared-deps/monaco.ts b/packages/kbn-ui-shared-deps/monaco.ts
index 570aca86c484c..42801c69a3e2c 100644
--- a/packages/kbn-ui-shared-deps/monaco.ts
+++ b/packages/kbn-ui-shared-deps/monaco.ts
@@ -25,6 +25,8 @@ import 'monaco-editor/esm/vs/base/worker/defaultWorkerFactory';
 import 'monaco-editor/esm/vs/editor/browser/controller/coreCommands.js';
 import 'monaco-editor/esm/vs/editor/browser/widget/codeEditorWidget.js';
 
+import 'monaco-editor/esm/vs/editor/contrib/wordOperations/wordOperations.js'; // Needed for word-wise char navigation
+
 import 'monaco-editor/esm/vs/editor/contrib/suggest/suggestController.js'; // Needed for suggestions
 import 'monaco-editor/esm/vs/editor/contrib/hover/hover.js'; // Needed for hover
 import 'monaco-editor/esm/vs/editor/contrib/parameterHints/parameterHints.js'; // Needed for signature
diff --git a/src/core/MIGRATION.md b/src/core/MIGRATION.md
index 1ca9b63a51d18..0d5d300ec3b79 100644
--- a/src/core/MIGRATION.md
+++ b/src/core/MIGRATION.md
@@ -1233,11 +1233,11 @@ This table shows where these uiExports have moved to in the New Platform. In mos
 | `chromeNavControls`          | [`core.chrome.navControls.register{Left,Right}`](/docs/development/core/public/kibana-plugin-public.chromenavcontrols.md) |                                                                                                                                       |
 | `contextMenuActions`         |                                                                                                                           | Should be an API on the devTools plugin.                                                                                              |
 | `devTools`                   |                                                                                                                           |                                                                                                                                       |
-| `docViews`                   |                                                                                                                           |                                                                                                                                       |
+| `docViews`                   | [`plugins.discover.docViews.addDocView`](./src/plugins/discover/public/doc_views)                                         | Should be an API on the discover plugin.                                                                                              |
 | `embeddableActions`          |                                                                                                                           | Should be an API on the embeddables plugin.                                                                                           |
 | `embeddableFactories`        |                                                                                                                           | Should be an API on the embeddables plugin.                                                                                           |
-| `fieldFormatEditors`         |                                                                                                                          |                                                                                                                                       |
-| `fieldFormats`               | [`plugins.data.fieldFormats`](./src/plugins/data/public/field_formats)                                                                                                                          |                                                                                                                                       |
+| `fieldFormatEditors`         |                                                                                                                          |                                                                                                                                        |
+| `fieldFormats`               | [`plugins.data.fieldFormats`](./src/plugins/data/public/field_formats)                                                                                                                                                                                            |                                                                                                                                       |
 | `hacks`                      | n/a                                                                                                                       | Just run the code in your plugin's `start` method.                                                                                    |
 | `home`                       | [`plugins.home.featureCatalogue.register`](./src/plugins/home/public/feature_catalogue)                                   | Must add `home` as a dependency in your kibana.json.                                                                                  |
 | `indexManagement`            |                                                                                                                           | Should be an API on the indexManagement plugin.                                                                                       |
diff --git a/src/core/public/index.ts b/src/core/public/index.ts
index 360b254ca50c1..00fd790bf4cc2 100644
--- a/src/core/public/index.ts
+++ b/src/core/public/index.ts
@@ -209,15 +209,21 @@ export interface CoreSetup<TPluginsStart extends object = object> {
   injectedMetadata: {
     getInjectedVar: (name: string, defaultValue?: any) => unknown;
   };
-
-  /**
-   * Allows plugins to get access to APIs available in start inside async
-   * handlers, such as {@link App.mount}. Promise will not resolve until Core
-   * and plugin dependencies have completed `start`.
-   */
-  getStartServices(): Promise<[CoreStart, TPluginsStart]>;
+  /** {@link StartServicesAccessor} */
+  getStartServices: StartServicesAccessor<TPluginsStart>;
 }
 
+/**
+ * Allows plugins to get access to APIs available in start inside async
+ * handlers, such as {@link App.mount}. Promise will not resolve until Core
+ * and plugin dependencies have completed `start`.
+ *
+ * @public
+ */
+export type StartServicesAccessor<TPluginsStart extends object = object> = () => Promise<
+  [CoreStart, TPluginsStart]
+>;
+
 /**
  * Core services exposed to the `Plugin` start lifecycle
  *
diff --git a/src/core/public/public.api.md b/src/core/public/public.api.md
index 37212a07ee631..eec12f2348176 100644
--- a/src/core/public/public.api.md
+++ b/src/core/public/public.api.md
@@ -378,7 +378,8 @@ export interface CoreSetup<TPluginsStart extends object = object> {
     context: ContextSetup;
     // (undocumented)
     fatalErrors: FatalErrorsSetup;
-    getStartServices(): Promise<[CoreStart, TPluginsStart]>;
+    // (undocumented)
+    getStartServices: StartServicesAccessor<TPluginsStart>;
     // (undocumented)
     http: HttpSetup;
     // @deprecated
@@ -1235,6 +1236,9 @@ export class SimpleSavedObject<T = unknown> {
     _version?: SavedObject<T>['version'];
 }
 
+// @public
+export type StartServicesAccessor<TPluginsStart extends object = object> = () => Promise<[CoreStart, TPluginsStart]>;
+
 // @public
 export type StringValidation = StringValidationRegex | StringValidationRegexString;
 
diff --git a/src/core/server/index.ts b/src/core/server/index.ts
index 89fee92a7ef02..1b436bfd72622 100644
--- a/src/core/server/index.ts
+++ b/src/core/server/index.ts
@@ -352,15 +352,22 @@ export interface CoreSetup<TPluginsStart extends object = object> {
   uuid: UuidServiceSetup;
   /** {@link MetricsServiceSetup} */
   metrics: MetricsServiceSetup;
-  /**
-   * Allows plugins to get access to APIs available in start inside async handlers.
-   * Promise will not resolve until Core and plugin dependencies have completed `start`.
-   * This should only be used inside handlers registered during `setup` that will only be executed
-   * after `start` lifecycle.
-   */
-  getStartServices(): Promise<[CoreStart, TPluginsStart]>;
+  /** {@link StartServicesAccessor} */
+  getStartServices: StartServicesAccessor<TPluginsStart>;
 }
 
+/**
+ * Allows plugins to get access to APIs available in start inside async handlers.
+ * Promise will not resolve until Core and plugin dependencies have completed `start`.
+ * This should only be used inside handlers registered during `setup` that will only be executed
+ * after `start` lifecycle.
+ *
+ * @public
+ */
+export type StartServicesAccessor<TPluginsStart extends object = object> = () => Promise<
+  [CoreStart, TPluginsStart]
+>;
+
 /**
  * Context passed to the plugins `start` method.
  *
diff --git a/src/core/server/server.api.md b/src/core/server/server.api.md
index 229ffc4d21575..6d4181e5e1ab3 100644
--- a/src/core/server/server.api.md
+++ b/src/core/server/server.api.md
@@ -629,7 +629,8 @@ export interface CoreSetup<TPluginsStart extends object = object> {
     context: ContextSetup;
     // (undocumented)
     elasticsearch: ElasticsearchServiceSetup;
-    getStartServices(): Promise<[CoreStart, TPluginsStart]>;
+    // (undocumented)
+    getStartServices: StartServicesAccessor<TPluginsStart>;
     // (undocumented)
     http: HttpServiceSetup;
     // (undocumented)
@@ -2269,6 +2270,9 @@ export type SharedGlobalConfig = RecursiveReadonly_2<{
     path: Pick<PathConfigType, typeof SharedGlobalConfigKeys.path[number]>;
 }>;
 
+// @public
+export type StartServicesAccessor<TPluginsStart extends object = object> = () => Promise<[CoreStart, TPluginsStart]>;
+
 // @public
 export type StringValidation = StringValidationRegex | StringValidationRegexString;
 
diff --git a/src/legacy/core_plugins/application_usage/mappings.ts b/src/legacy/core_plugins/application_usage/mappings.ts
deleted file mode 100644
index 39adc53f7e9ff..0000000000000
--- a/src/legacy/core_plugins/application_usage/mappings.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-export const mappings = {
-  application_usage_totals: {
-    properties: {
-      appId: { type: 'keyword' },
-      numberOfClicks: { type: 'long' },
-      minutesOnScreen: { type: 'float' },
-    },
-  },
-  application_usage_transactional: {
-    properties: {
-      timestamp: { type: 'date' },
-      appId: { type: 'keyword' },
-      numberOfClicks: { type: 'long' },
-      minutesOnScreen: { type: 'float' },
-    },
-  },
-};
diff --git a/src/legacy/core_plugins/application_usage/package.json b/src/legacy/core_plugins/application_usage/package.json
deleted file mode 100644
index 5ab10a2f8d237..0000000000000
--- a/src/legacy/core_plugins/application_usage/package.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "name": "application_usage",
-  "version": "kibana"
-}
\ No newline at end of file
diff --git a/src/legacy/core_plugins/data/package.json b/src/legacy/core_plugins/data/package.json
deleted file mode 100644
index 3f40374650ad7..0000000000000
--- a/src/legacy/core_plugins/data/package.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "name": "data",
-  "version": "kibana"
-}
diff --git a/src/legacy/core_plugins/data/public/legacy.ts b/src/legacy/core_plugins/data/public/legacy.ts
deleted file mode 100644
index 370b412127db8..0000000000000
--- a/src/legacy/core_plugins/data/public/legacy.ts
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * New Platform Shim
- *
- * In this file, we import any legacy dependencies we have, and shim them into
- * our plugin by manually constructing the values that the new platform will
- * eventually be passing to the `setup` method of our plugin definition.
- *
- * The idea is that our `plugin.ts` can stay "pure" and not contain any legacy
- * world code. Then when it comes time to migrate to the new platform, we can
- * simply delete this shim file.
- *
- * We are also calling `setup` here and exporting our public contract so that
- * other legacy plugins are able to import from '../core_plugins/data/legacy'
- * and receive the response value of the `setup` contract, mimicking the
- * data that will eventually be injected by the new platform.
- */
-
-import { npSetup, npStart } from 'ui/new_platform';
-import { plugin } from '.';
-
-const dataPlugin = plugin();
-
-export const setup = dataPlugin.setup(npSetup.core);
-
-export const start = dataPlugin.start(npStart.core);
diff --git a/src/legacy/core_plugins/data/public/plugin.ts b/src/legacy/core_plugins/data/public/plugin.ts
deleted file mode 100644
index 76a3d92d20283..0000000000000
--- a/src/legacy/core_plugins/data/public/plugin.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { CoreSetup, CoreStart, Plugin } from 'kibana/public';
-
-/**
- * Interface for this plugin's returned `setup` contract.
- *
- * @public
- */
-export interface DataSetup {} // eslint-disable-line @typescript-eslint/no-empty-interface
-
-/**
- * Interface for this plugin's returned `start` contract.
- *
- * @public
- */
-export interface DataStart {} // eslint-disable-line @typescript-eslint/no-empty-interface
-
-/**
- * Data Plugin - public
- *
- * This is the entry point for the entire client-side public contract of the plugin.
- * If something is not explicitly exported here, you can safely assume it is private
- * to the plugin and not considered stable.
- *
- * All stateful contracts will be injected by the platform at runtime, and are defined
- * in the setup/start interfaces. The remaining items exported here are either types,
- * or static code.
- */
-
-export class DataPlugin implements Plugin<DataSetup, DataStart> {
-  public setup(core: CoreSetup) {
-    return {};
-  }
-
-  public start(core: CoreStart): DataStart {
-    return {};
-  }
-
-  public stop() {}
-}
diff --git a/src/legacy/core_plugins/input_control_vis/index.ts b/src/legacy/core_plugins/input_control_vis/index.ts
index 8f6178e26126b..d67472ac4b95f 100644
--- a/src/legacy/core_plugins/input_control_vis/index.ts
+++ b/src/legacy/core_plugins/input_control_vis/index.ts
@@ -25,7 +25,7 @@ import { LegacyPluginApi, LegacyPluginInitializer } from '../../../../src/legacy
 const inputControlVisPluginInitializer: LegacyPluginInitializer = ({ Plugin }: LegacyPluginApi) =>
   new Plugin({
     id: 'input_control_vis',
-    require: ['kibana', 'elasticsearch', 'visualizations', 'interpreter', 'data'],
+    require: ['kibana', 'elasticsearch', 'visualizations', 'interpreter'],
     publicDir: resolve(__dirname, 'public'),
     uiExports: {
       styleSheetPaths: resolve(__dirname, 'public/index.scss'),
diff --git a/src/legacy/core_plugins/input_control_vis/public/input_control_vis_type.ts b/src/legacy/core_plugins/input_control_vis/public/input_control_vis_type.ts
index dae6c9abb625e..023e6ebb7125c 100644
--- a/src/legacy/core_plugins/input_control_vis/public/input_control_vis_type.ts
+++ b/src/legacy/core_plugins/input_control_vis/public/input_control_vis_type.ts
@@ -22,7 +22,6 @@ import { i18n } from '@kbn/i18n';
 import { createInputControlVisController } from './vis_controller';
 import { getControlsTab } from './components/editor/controls_tab';
 import { OptionsTab } from './components/editor/options_tab';
-import { Status } from '../../visualizations/public';
 import { InputControlVisDependencies } from './plugin';
 import { defaultFeedbackMessage } from '../../../../plugins/kibana_utils/common';
 
@@ -40,7 +39,6 @@ export function createInputControlVisTypeDefinition(deps: InputControlVisDepende
       defaultMessage: 'Create interactive controls for easy dashboard manipulation.',
     }),
     stage: 'experimental',
-    requiresUpdateStatus: [Status.PARAMS, Status.TIME],
     feedbackMessage: defaultFeedbackMessage,
     visualization: InputControlVisController,
     visConfig: {
diff --git a/src/legacy/core_plugins/input_control_vis/public/vis_controller.tsx b/src/legacy/core_plugins/input_control_vis/public/vis_controller.tsx
index 624d000dd8d7a..c0ab235c1b9d1 100644
--- a/src/legacy/core_plugins/input_control_vis/public/vis_controller.tsx
+++ b/src/legacy/core_plugins/input_control_vis/public/vis_controller.tsx
@@ -54,7 +54,7 @@ export const createInputControlVisController = (deps: InputControlVisDependencie
         .subscribe(this.queryBarUpdateHandler);
     }
 
-    async render(visData: any, visParams: VisParams, status: any) {
+    async render(visData: any, visParams: VisParams) {
       this.visParams = visParams;
       this.controls = [];
       this.controls = await this.initControls();
diff --git a/src/legacy/core_plugins/kibana/public/.eslintrc.js b/src/legacy/core_plugins/kibana/public/.eslintrc.js
index e7171a5291d26..1153706eb8566 100644
--- a/src/legacy/core_plugins/kibana/public/.eslintrc.js
+++ b/src/legacy/core_plugins/kibana/public/.eslintrc.js
@@ -43,8 +43,6 @@ function buildRestrictedPaths(shimmedPlugins) {
           'ui/**/*',
           'src/legacy/ui/**/*',
           'src/legacy/core_plugins/kibana/public/**/*',
-          'src/legacy/core_plugins/data/public/**/*',
-          '!src/legacy/core_plugins/data/public/index.ts',
           `!src/legacy/core_plugins/kibana/public/${shimmedPlugin}/**/*`,
         ],
         allowSameFolder: false,
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/dashboard_app_controller.tsx b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/dashboard_app_controller.tsx
index d1e4c9d2d2a0c..0c6686c993371 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/dashboard_app_controller.tsx
+++ b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/dashboard_app_controller.tsx
@@ -754,7 +754,7 @@ export class DashboardAppController {
        * When de-angularizing this code, please call the underlaying action function
        * directly and not via the top nav object.
        **/
-      navActions[TopNavIds.ADD]();
+      navActions[TopNavIds.ADD_EXISTING]();
     };
     $scope.enterEditMode = () => {
       dashboardStateManager.setFullScreenMode(false);
@@ -847,7 +847,8 @@ export class DashboardAppController {
 
       showCloneModal(onClone, currentTitle);
     };
-    navActions[TopNavIds.ADD] = () => {
+
+    navActions[TopNavIds.ADD_EXISTING] = () => {
       if (dashboardContainer && !isErrorEmbeddable(dashboardContainer)) {
         openAddPanelFlyout({
           embeddable: dashboardContainer,
@@ -889,7 +890,8 @@ export class DashboardAppController {
       share.toggleShareContextMenu({
         anchorElement,
         allowEmbed: true,
-        allowShortUrl: !dashboardConfig.getHideWriteControls(),
+        allowShortUrl:
+          !dashboardConfig.getHideWriteControls() || dashboardCapabilities.createShortUrl,
         shareableUrl: unhashUrl(window.location.href),
         objectId: dash.id,
         objectType: 'dashboard',
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/get_top_nav_config.ts b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/get_top_nav_config.ts
index 7188fab19d6f2..7a3cb4b7dad56 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/get_top_nav_config.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/get_top_nav_config.ts
@@ -48,9 +48,10 @@ export function getTopNavConfig(
           ];
     case ViewMode.EDIT:
       return [
+        getCreateNewConfig(actions[TopNavIds.VISUALIZE]),
         getSaveConfig(actions[TopNavIds.SAVE]),
         getViewConfig(actions[TopNavIds.EXIT_EDIT_MODE]),
-        getAddConfig(actions[TopNavIds.ADD]),
+        getAddConfig(actions[TopNavIds.ADD_EXISTING]),
         getOptionsConfig(actions[TopNavIds.OPTIONS]),
         getShareConfig(actions[TopNavIds.SHARE]),
       ];
@@ -161,6 +162,25 @@ function getAddConfig(action: NavAction) {
   };
 }
 
+/**
+ * @returns {kbnTopNavConfig}
+ */
+function getCreateNewConfig(action: NavAction) {
+  return {
+    emphasize: true,
+    iconType: 'plusInCircle',
+    id: 'addNew',
+    label: i18n.translate('kbn.dashboard.topNave.addNewButtonAriaLabel', {
+      defaultMessage: 'Create new',
+    }),
+    description: i18n.translate('kbn.dashboard.topNave.addNewConfigDescription', {
+      defaultMessage: 'Create a new panel on this dashboard',
+    }),
+    testId: 'dashboardAddNewPanelButton',
+    run: action,
+  };
+}
+
 /**
  * @returns {kbnTopNavConfig}
  */
diff --git a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/top_nav_ids.ts b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/top_nav_ids.ts
index c67d6891c18e7..748bfaaab6141 100644
--- a/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/top_nav_ids.ts
+++ b/src/legacy/core_plugins/kibana/public/dashboard/np_ready/top_nav/top_nav_ids.ts
@@ -18,7 +18,6 @@
  */
 
 export const TopNavIds = {
-  ADD: 'add',
   SHARE: 'share',
   OPTIONS: 'options',
   SAVE: 'save',
@@ -27,4 +26,5 @@ export const TopNavIds = {
   CLONE: 'clone',
   FULL_SCREEN: 'fullScreenMode',
   VISUALIZE: 'visualize',
+  ADD_EXISTING: 'addExisting',
 };
diff --git a/src/legacy/core_plugins/kibana/public/discover/build_services.ts b/src/legacy/core_plugins/kibana/public/discover/build_services.ts
index 282eef0c983eb..f881eb96e4e81 100644
--- a/src/legacy/core_plugins/kibana/public/discover/build_services.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/build_services.ts
@@ -35,10 +35,13 @@ import {
 
 import { DiscoverStartPlugins } from './plugin';
 import { SharePluginStart } from '../../../../../plugins/share/public';
-import { DocViewsRegistry } from './np_ready/doc_views/doc_views_registry';
 import { ChartsPluginStart } from '../../../../../plugins/charts/public';
 import { VisualizationsStart } from '../../../visualizations/public';
-import { createSavedSearchesLoader, SavedSearch } from '../../../../../plugins/discover/public';
+import {
+  createSavedSearchesLoader,
+  DocViewerComponent,
+  SavedSearch,
+} from '../../../../../plugins/discover/public';
 
 export interface DiscoverServices {
   addBasePath: (path: string) => string;
@@ -47,7 +50,7 @@ export interface DiscoverServices {
   core: CoreStart;
   data: DataPublicPluginStart;
   docLinks: DocLinksStart;
-  docViewsRegistry: DocViewsRegistry;
+  DocViewer: DocViewerComponent;
   history: History;
   theme: ChartsPluginStart['theme'];
   filterManager: FilterManager;
@@ -64,8 +67,7 @@ export interface DiscoverServices {
 }
 export async function buildServices(
   core: CoreStart,
-  plugins: DiscoverStartPlugins,
-  docViewsRegistry: DocViewsRegistry
+  plugins: DiscoverStartPlugins
 ): Promise<DiscoverServices> {
   const services = {
     savedObjectsClient: core.savedObjects.client,
@@ -81,7 +83,7 @@ export async function buildServices(
     core,
     data: plugins.data,
     docLinks: core.docLinks,
-    docViewsRegistry,
+    DocViewer: plugins.discover.docViews.DocViewer,
     history: createHashHistory(),
     theme: plugins.charts.theme,
     filterManager: plugins.data.query.filterManager,
diff --git a/src/legacy/core_plugins/kibana/public/discover/kibana_services.ts b/src/legacy/core_plugins/kibana/public/discover/kibana_services.ts
index cf76a9355e384..7a3a6949baa94 100644
--- a/src/legacy/core_plugins/kibana/public/discover/kibana_services.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/kibana_services.ts
@@ -52,9 +52,6 @@ export { angular };
 export { wrapInI18nContext } from 'ui/i18n';
 import { search } from '../../../../../plugins/data/public';
 export const { getRequestInspectorStats, getResponseInspectorStats, tabifyAggResponse } = search;
-// @ts-ignore
-// @ts-ignore
-export { timezoneProvider } from 'ui/vis/lib/timezone';
 export {
   unhashUrl,
   redirectWhenMissing,
@@ -78,7 +75,6 @@ export {
   EsQuerySortValue,
   SortDirection,
 } from '../../../../../plugins/data/public';
-export { ElasticSearchHit } from './np_ready/doc_views/doc_views_types';
 export { getFormat } from 'ui/visualize/loader/pipeline_helpers/utilities';
 // @ts-ignore
 export { buildPointSeriesData } from 'ui/agg_response/point_series/point_series';
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name.js
index b020113381992..47e50f3cc3d4b 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name.js
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { FieldName } from './field_name/field_name';
+import { FieldName } from '../../../../../../../../plugins/discover/public';
 import { getServices, wrapInI18nContext } from '../../../kibana_services';
 
 export function FieldNameDirectiveProvider(reactDirective) {
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/histogram.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/histogram.tsx
index 107c30ec5e688..f788347ac016c 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/histogram.tsx
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/histogram.tsx
@@ -42,9 +42,10 @@ import {
 } from '@elastic/charts';
 
 import { i18n } from '@kbn/i18n';
+import { IUiSettingsClient } from 'kibana/public';
 import { EuiChartThemeType } from '@elastic/eui/dist/eui_charts_theme';
 import { Subscription } from 'rxjs';
-import { getServices, timezoneProvider } from '../../../kibana_services';
+import { getServices } from '../../../kibana_services';
 
 export interface DiscoverHistogramProps {
   chartData: any;
@@ -86,6 +87,16 @@ function getIntervalInMs(
   }
 }
 
+function getTimezone(uiSettings: IUiSettingsClient) {
+  if (uiSettings.isDefault('dateFormat:tz')) {
+    const detectedTimezone = moment.tz.guess();
+    if (detectedTimezone) return detectedTimezone;
+    else return moment().format('Z');
+  } else {
+    return uiSettings.get('dateFormat:tz', 'Browser');
+  }
+}
+
 export function findMinInterval(
   xValues: number[],
   esValue: number,
@@ -193,7 +204,7 @@ export class DiscoverHistogram extends Component<DiscoverHistogramProps, Discove
 
   public render() {
     const uiSettings = getServices().uiSettings;
-    const timeZone = timezoneProvider(uiSettings)();
+    const timeZone = getTimezone(uiSettings);
     const { chartData } = this.props;
     const { chartsTheme } = this.state;
 
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.js b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.js
index 278317ec2e87b..8e4e77b2d18a6 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.js
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/discover.js
@@ -672,7 +672,7 @@ function discoverController(
         // no timefield, no vis, nothing to update
         if (!getTimeField() || !$scope.vis) return;
 
-        const buckets = $scope.vis.getAggConfig().byTypeName('buckets');
+        const buckets = $scope.vis.data.aggs.byTypeName('buckets');
 
         if (buckets && buckets.length === 1) {
           $scope.bucketInterval = buckets[0].buckets.getInterval();
@@ -876,11 +876,11 @@ function discoverController(
     inspectorRequest.stats(getResponseInspectorStats($scope.searchSource, resp)).ok({ json: resp });
 
     if (getTimeField()) {
-      const tabifiedData = tabifyAggResponse($scope.vis.aggs, resp);
+      const tabifiedData = tabifyAggResponse($scope.vis.data.aggs, resp);
       $scope.searchSource.rawResponse = resp;
       $scope.histogramData = discoverResponseHandler(
         tabifiedData,
-        getDimensions($scope.vis.aggs.aggs, $scope.timeRange)
+        getDimensions($scope.vis.data.aggs.aggs, $scope.timeRange)
       );
     }
 
@@ -1023,41 +1023,27 @@ function discoverController(
       },
     ];
 
-    if ($scope.vis) {
-      const visState = $scope.vis.getEnabledState();
-      visState.aggs = visStateAggs;
-
-      $scope.vis.setState(visState);
-      return;
-    }
-
-    const visSavedObject = {
-      indexPattern: $scope.indexPattern.id,
-      visState: {
-        type: 'histogram',
-        title: savedSearch.title,
-        params: {
-          addLegend: false,
-          addTimeMarker: true,
-        },
+    $scope.vis = visualizations.createVis('histogram', {
+      title: savedSearch.title,
+      params: {
+        addLegend: false,
+        addTimeMarker: true,
+      },
+      data: {
         aggs: visStateAggs,
+        indexPattern: $scope.searchSource.getField('index').id,
+        searchSource: $scope.searchSource,
       },
-    };
-
-    $scope.vis = visualizations.createVis(
-      $scope.searchSource.getField('index'),
-      visSavedObject.visState
-    );
-    visSavedObject.vis = $scope.vis;
+    });
 
     $scope.searchSource.onRequestStart((searchSource, options) => {
       if (!$scope.vis) return;
-      return $scope.vis.getAggConfig().onSearchRequestStart(searchSource, options);
+      return $scope.vis.data.aggs.onSearchRequestStart(searchSource, options);
     });
 
     $scope.searchSource.setField('aggs', function() {
       if (!$scope.vis) return;
-      return $scope.vis.getAggConfig().toDsl();
+      return $scope.vis.data.aggs.toDsl();
     });
   }
 
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_viewer.ts b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_viewer.tsx
similarity index 87%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_viewer.ts
rename to src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_viewer.tsx
index 6ba47b839563b..90e061ac1aa05 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_viewer.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/doc_viewer.tsx
@@ -17,11 +17,15 @@
  * under the License.
  */
 
-import { DocViewer } from '../components/doc_viewer/doc_viewer';
+import React from 'react';
+import { getServices } from '../../kibana_services';
 
 export function createDocViewerDirective(reactDirective: any) {
   return reactDirective(
-    DocViewer,
+    (props: any) => {
+      const { DocViewer } = getServices();
+      return <DocViewer {...props} />;
+    },
     [
       'hit',
       ['indexPattern', { watchDepth: 'reference' }],
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/_index.scss b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/_index.scss
index 0491430e5fddd..7161560f8fda4 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/_index.scss
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/_index.scss
@@ -1,3 +1,2 @@
 @import 'fetch_error/index';
 @import 'field_chooser/index';
-@import 'doc_viewer/index';
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/doc.test.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/doc.test.tsx
index 2278b243ecc14..1d19dc112d193 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/doc.test.tsx
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/doc.test.tsx
@@ -24,19 +24,13 @@ import { ReactWrapper } from 'enzyme';
 import { findTestSubject } from '@elastic/eui/lib/test';
 import { Doc, DocProps } from './doc';
 
-jest.mock('../doc_viewer/doc_viewer', () => ({
-  DocViewer: () => null,
-}));
-
 jest.mock('../../../kibana_services', () => {
   return {
     getServices: () => ({
       metadata: {
         branch: 'test',
       },
-      getDocViewsSorted: () => {
-        return [];
-      },
+      DocViewer: () => null,
     }),
   };
 });
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/doc.tsx b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/doc.tsx
index 819eb9df592bd..28a17dbdb67b7 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/doc.tsx
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/doc.tsx
@@ -20,9 +20,9 @@ import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { EuiCallOut, EuiLink, EuiLoadingSpinner, EuiPageContent } from '@elastic/eui';
 import { IndexPatternsContract } from 'src/plugins/data/public';
-import { DocViewer } from '../doc_viewer/doc_viewer';
 import { ElasticRequestState, useEsDocSearch } from './use_es_doc_search';
-import { ElasticSearchHit, getServices } from '../../../kibana_services';
+import { getServices } from '../../../kibana_services';
+import { ElasticSearchHit } from '../../../../../../../../plugins/discover/public';
 
 export interface ElasticSearchResult {
   hits: {
@@ -61,6 +61,7 @@ export interface DocProps {
 }
 
 export function Doc(props: DocProps) {
+  const { DocViewer } = getServices();
   const [reqState, hit, indexPattern] = useEsDocSearch(props);
 
   return (
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/use_es_doc_search.ts b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/use_es_doc_search.ts
index 6cffc2cc533b0..2cd264578a596 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/use_es_doc_search.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc/use_es_doc_search.ts
@@ -17,8 +17,9 @@
  * under the License.
  */
 import { useEffect, useState } from 'react';
-import { ElasticSearchHit, IndexPattern } from '../../../kibana_services';
+import { IndexPattern } from '../../../kibana_services';
 import { DocProps } from './doc';
+import { ElasticSearchHit } from '../../../../../../../../plugins/discover/public';
 
 export enum ElasticRequestState {
   Loading,
diff --git a/src/legacy/core_plugins/kibana/public/discover/plugin.ts b/src/legacy/core_plugins/kibana/public/discover/plugin.ts
index ba671a64592a5..d3cdeb49fba71 100644
--- a/src/legacy/core_plugins/kibana/public/discover/plugin.ts
+++ b/src/legacy/core_plugins/kibana/public/discover/plugin.ts
@@ -19,7 +19,6 @@
 
 import { BehaviorSubject } from 'rxjs';
 import { filter, map } from 'rxjs/operators';
-import { i18n } from '@kbn/i18n';
 import { AppMountParameters, CoreSetup, CoreStart, Plugin } from 'kibana/public';
 import angular, { auto } from 'angular';
 import { UiActionsSetup, UiActionsStart } from 'src/plugins/ui_actions/public';
@@ -41,10 +40,7 @@ import {
   KibanaLegacySetup,
   AngularRenderedAppUpdater,
 } from '../../../../../plugins/kibana_legacy/public';
-import { DocViewsRegistry } from './np_ready/doc_views/doc_views_registry';
-import { DocViewInput, DocViewInputFn } from './np_ready/doc_views/doc_views_types';
-import { DocViewTable } from './np_ready/components/table/table';
-import { JsonCodeBlock } from './np_ready/components/json_code_block/json_code_block';
+import { DiscoverSetup, DiscoverStart } from '../../../../../plugins/discover/public';
 import { HomePublicPluginSetup } from '../../../../../plugins/home/public';
 import {
   VisualizationsStart,
@@ -52,15 +48,6 @@ import {
 } from '../../../visualizations/public/np_ready/public';
 import { createKbnUrlTracker } from '../../../../../plugins/kibana_utils/public';
 
-/**
- * These are the interfaces with your public contracts. You should export these
- * for other plugins to use in _their_ `SetupDeps`/`StartDeps` interfaces.
- * @public
- */
-export interface DiscoverSetup {
-  addDocView(docViewRaw: DocViewInput | DocViewInputFn): void;
-}
-export type DiscoverStart = void;
 export interface DiscoverSetupPlugins {
   uiActions: UiActionsSetup;
   embeddable: EmbeddableSetup;
@@ -68,6 +55,7 @@ export interface DiscoverSetupPlugins {
   home: HomePublicPluginSetup;
   visualizations: VisualizationsSetup;
   data: DataPublicPluginSetup;
+  discover: DiscoverSetup;
 }
 export interface DiscoverStartPlugins {
   uiActions: UiActionsStart;
@@ -78,6 +66,7 @@ export interface DiscoverStartPlugins {
   share: SharePluginStart;
   inspector: any;
   visualizations: VisualizationsStart;
+  discover: DiscoverStart;
 }
 const innerAngularName = 'app/discover';
 const embeddableAngularName = 'app/discoverEmbeddable';
@@ -87,10 +76,9 @@ const embeddableAngularName = 'app/discoverEmbeddable';
  * There are 2 kinds of Angular bootstrapped for rendering, additionally to the main Angular
  * Discover provides embeddables, those contain a slimmer Angular
  */
-export class DiscoverPlugin implements Plugin<DiscoverSetup, DiscoverStart> {
+export class DiscoverPlugin implements Plugin<void, void> {
   private servicesInitialized: boolean = false;
   private innerAngularInitialized: boolean = false;
-  private docViewsRegistry: DocViewsRegistry | null = null;
   private embeddableInjector: auto.IInjectorService | null = null;
   private getEmbeddableInjector: (() => Promise<auto.IInjectorService>) | null = null;
   private appStateUpdater = new BehaviorSubject<AngularRenderedAppUpdater>(() => ({}));
@@ -103,7 +91,7 @@ export class DiscoverPlugin implements Plugin<DiscoverSetup, DiscoverStart> {
   public initializeInnerAngular?: () => void;
   public initializeServices?: () => Promise<{ core: CoreStart; plugins: DiscoverStartPlugins }>;
 
-  setup(core: CoreSetup<DiscoverStartPlugins>, plugins: DiscoverSetupPlugins): DiscoverSetup {
+  setup(core: CoreSetup<DiscoverStartPlugins>, plugins: DiscoverSetupPlugins) {
     const { appMounted, appUnMounted, stop: stopUrlTracker } = createKbnUrlTracker({
       baseUrl: core.http.basePath.prepend('/app/kibana'),
       defaultSubUrl: '#/discover',
@@ -130,21 +118,7 @@ export class DiscoverPlugin implements Plugin<DiscoverSetup, DiscoverStart> {
     };
 
     this.getEmbeddableInjector = this.getInjector.bind(this);
-    this.docViewsRegistry = new DocViewsRegistry(this.getEmbeddableInjector);
-    this.docViewsRegistry.addDocView({
-      title: i18n.translate('kbn.discover.docViews.table.tableTitle', {
-        defaultMessage: 'Table',
-      }),
-      order: 10,
-      component: DocViewTable,
-    });
-    this.docViewsRegistry.addDocView({
-      title: i18n.translate('kbn.discover.docViews.json.jsonTitle', {
-        defaultMessage: 'JSON',
-      }),
-      order: 20,
-      component: JsonCodeBlock,
-    });
+    plugins.discover.docViews.setAngularInjectorGetter(this.getEmbeddableInjector);
     plugins.kibanaLegacy.registerLegacyApp({
       id: 'discover',
       title: 'Discover',
@@ -172,14 +146,10 @@ export class DiscoverPlugin implements Plugin<DiscoverSetup, DiscoverStart> {
       },
     });
     registerFeature(plugins.home);
-
     this.registerEmbeddable(core, plugins);
-    return {
-      addDocView: this.docViewsRegistry.addDocView.bind(this.docViewsRegistry),
-    };
   }
 
-  start(core: CoreStart, plugins: DiscoverStartPlugins): DiscoverStart {
+  start(core: CoreStart, plugins: DiscoverStartPlugins) {
     // we need to register the application service at setup, but to render it
     // there are some start dependencies necessary, for this reason
     // initializeInnerAngular + initializeServices are assigned at start and used
@@ -198,7 +168,7 @@ export class DiscoverPlugin implements Plugin<DiscoverSetup, DiscoverStart> {
       if (this.servicesInitialized) {
         return { core, plugins };
       }
-      const services = await buildServices(core, plugins, this.docViewsRegistry!);
+      const services = await buildServices(core, plugins);
       setServices(services);
       this.servicesInitialized = true;
 
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/relationships/__jest__/__snapshots__/relationships.test.js.snap b/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/relationships/__jest__/__snapshots__/relationships.test.js.snap
index c1241d5d7c1e5..728944f3ccbfe 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/relationships/__jest__/__snapshots__/relationships.test.js.snap
+++ b/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/relationships/__jest__/__snapshots__/relationships.test.js.snap
@@ -53,6 +53,7 @@ exports[`Relationships should render dashboards normally 1`] = `
               "width": "50px",
             },
             Object {
+              "data-test-subj": "directRelationship",
               "dataType": "string",
               "field": "relationship",
               "name": "Direct relationship",
@@ -72,6 +73,7 @@ exports[`Relationships should render dashboards normally 1`] = `
               "actions": Array [
                 Object {
                   "available": [Function],
+                  "data-test-subj": "relationshipsTableAction-inspect",
                   "description": "Inspect this saved object",
                   "icon": "inspect",
                   "name": "Inspect",
@@ -117,6 +119,7 @@ exports[`Relationships should render dashboards normally 1`] = `
         }
         pagination={true}
         responsive={true}
+        rowProps={[Function]}
         search={
           Object {
             "filters": Array [
@@ -263,6 +266,7 @@ exports[`Relationships should render index patterns normally 1`] = `
               "width": "50px",
             },
             Object {
+              "data-test-subj": "directRelationship",
               "dataType": "string",
               "field": "relationship",
               "name": "Direct relationship",
@@ -282,6 +286,7 @@ exports[`Relationships should render index patterns normally 1`] = `
               "actions": Array [
                 Object {
                   "available": [Function],
+                  "data-test-subj": "relationshipsTableAction-inspect",
                   "description": "Inspect this saved object",
                   "icon": "inspect",
                   "name": "Inspect",
@@ -327,6 +332,7 @@ exports[`Relationships should render index patterns normally 1`] = `
         }
         pagination={true}
         responsive={true}
+        rowProps={[Function]}
         search={
           Object {
             "filters": Array [
@@ -429,6 +435,7 @@ exports[`Relationships should render searches normally 1`] = `
               "width": "50px",
             },
             Object {
+              "data-test-subj": "directRelationship",
               "dataType": "string",
               "field": "relationship",
               "name": "Direct relationship",
@@ -448,6 +455,7 @@ exports[`Relationships should render searches normally 1`] = `
               "actions": Array [
                 Object {
                   "available": [Function],
+                  "data-test-subj": "relationshipsTableAction-inspect",
                   "description": "Inspect this saved object",
                   "icon": "inspect",
                   "name": "Inspect",
@@ -493,6 +501,7 @@ exports[`Relationships should render searches normally 1`] = `
         }
         pagination={true}
         responsive={true}
+        rowProps={[Function]}
         search={
           Object {
             "filters": Array [
@@ -595,6 +604,7 @@ exports[`Relationships should render visualizations normally 1`] = `
               "width": "50px",
             },
             Object {
+              "data-test-subj": "directRelationship",
               "dataType": "string",
               "field": "relationship",
               "name": "Direct relationship",
@@ -614,6 +624,7 @@ exports[`Relationships should render visualizations normally 1`] = `
               "actions": Array [
                 Object {
                   "available": [Function],
+                  "data-test-subj": "relationshipsTableAction-inspect",
                   "description": "Inspect this saved object",
                   "icon": "inspect",
                   "name": "Inspect",
@@ -659,6 +670,7 @@ exports[`Relationships should render visualizations normally 1`] = `
         }
         pagination={true}
         responsive={true}
+        rowProps={[Function]}
         search={
           Object {
             "filters": Array [
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/relationships/relationships.js b/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/relationships/relationships.js
index ee9fb70e31fb2..ce3415ad2f0e7 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/relationships/relationships.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/relationships/relationships.js
@@ -135,6 +135,7 @@ export class Relationships extends Component {
                 aria-label={getSavedObjectLabel(type)}
                 type={object.meta.icon || 'apps'}
                 size="s"
+                data-test-subj="relationshipsObjectType"
               />
             </EuiToolTip>
           );
@@ -149,6 +150,7 @@ export class Relationships extends Component {
         dataType: 'string',
         sortable: false,
         width: '125px',
+        'data-test-subj': 'directRelationship',
         render: relationship => {
           if (relationship === 'parent') {
             return (
@@ -187,10 +189,16 @@ export class Relationships extends Component {
           const { path } = object.meta.inAppUrl || {};
           const canGoInApp = this.props.canGoInApp(object);
           if (!canGoInApp) {
-            return <EuiText size="s">{title || getDefaultTitle(object)}</EuiText>;
+            return (
+              <EuiText size="s" data-test-subj="relationshipsTitle">
+                {title || getDefaultTitle(object)}
+              </EuiText>
+            );
           }
           return (
-            <EuiLink href={chrome.addBasePath(path)}>{title || getDefaultTitle(object)}</EuiLink>
+            <EuiLink href={chrome.addBasePath(path)} data-test-subj="relationshipsTitle">
+              {title || getDefaultTitle(object)}
+            </EuiLink>
           );
         },
       },
@@ -211,6 +219,7 @@ export class Relationships extends Component {
             ),
             type: 'icon',
             icon: 'inspect',
+            'data-test-subj': 'relationshipsTableAction-inspect',
             onClick: object => goInspectObject(object),
             available: object => !!object.meta.editUrl,
           },
@@ -295,6 +304,9 @@ export class Relationships extends Component {
           columns={columns}
           pagination={true}
           search={search}
+          rowProps={() => ({
+            'data-test-subj': `relationshipsTableRow`,
+          })}
         />
       </div>
     );
diff --git a/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/table/table.js b/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/table/table.js
index 386b35399b754..5342693113bca 100644
--- a/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/table/table.js
+++ b/src/legacy/core_plugins/kibana/public/management/sections/objects/components/objects_table/components/table/table.js
@@ -186,6 +186,7 @@ export class Table extends PureComponent {
                 aria-label={getSavedObjectLabel(type)}
                 type={object.meta.icon || 'apps'}
                 size="s"
+                data-test-subj="objectType"
               />
             </EuiToolTip>
           );
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/breadcrumbs.ts b/src/legacy/core_plugins/kibana/public/visualize/np_ready/breadcrumbs.ts
index c334172805b9f..b6a63d50b205b 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/breadcrumbs.ts
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/breadcrumbs.ts
@@ -69,7 +69,7 @@ export function getEditBreadcrumbs($route: any) {
   return [
     ...getLandingBreadcrumbs(),
     {
-      text: $route.current.locals.savedVis.title,
+      text: $route.current.locals.resolved.savedVis.title,
     },
   ];
 }
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.html b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.html
index 28baf21925cbe..0dcacd30fba4e 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.html
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.html
@@ -69,7 +69,8 @@
   <visualization-embedded
     ng-if="!isVisible"
     class="visualize"
-    saved-obj="savedVis"
+    vis="vis"
+    embeddable-handler="embeddableHandler"
     ui-state="uiState"
     time-range="timeRange"
     filters="filters"
@@ -89,13 +90,15 @@
   </h1>
   <visualization-editor
     ng-if="isVisible"
-    saved-obj="savedVis"
+    vis="vis"
+    saved-search="savedSearch"
+    embeddable-handler="embeddableHandler"
+    event-emitter="eventEmitter"
     ui-state="uiState"
     time-range="timeRange"
     filters="filters"
     query="query"
     class="visEditor__content"
-    app-state="appState"
   />
 
 </visualize-app>
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js
index 7d1c29fbf48da..c5325ca3108b4 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/editor.js
@@ -22,6 +22,7 @@ import _ from 'lodash';
 import { Subscription } from 'rxjs';
 import { map } from 'rxjs/operators';
 import { i18n } from '@kbn/i18n';
+import { EventEmitter } from 'events';
 
 import React from 'react';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -84,6 +85,7 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
     uiSettings,
     I18nContext,
     setActiveUrl,
+    visualizations,
   } = getServices();
 
   const {
@@ -98,27 +100,63 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
   );
 
   // Retrieve the resolved SavedVis instance.
-  const savedVis = $route.current.locals.savedVis;
+  const { vis, savedVis, savedSearch, embeddableHandler } = $route.current.locals.resolved;
+  $scope.eventEmitter = new EventEmitter();
   const _applyVis = () => {
     $scope.$apply();
   };
   // This will trigger a digest cycle. This is needed when vis is updated from a global angular like in visualize_embeddable.js.
-  savedVis.vis.on('apply', _applyVis);
+  $scope.eventEmitter.on('apply', _applyVis);
   // vis is instance of src/legacy/ui/public/vis/vis.js.
   // SearchSource is a promise-based stream of search results that can inherit from other search sources.
-  const { vis, searchSource, savedSearch } = savedVis;
+  const searchSource = vis.data.searchSource;
 
   $scope.vis = vis;
+  $scope.savedSearch = savedSearch;
 
   const $appStatus = {
     dirty: !savedVis.id,
   };
 
-  vis.on('dirtyStateChange', ({ isDirty }) => {
-    vis.dirty = isDirty;
-    $scope.$digest();
+  const defaultQuery = {
+    query: '',
+    language:
+      localStorage.get('kibana.userQueryLanguage') || uiSettings.get('search:queryLanguage'),
+  };
+
+  const visStateToEditorState = () => {
+    const savedVisState = visualizations.convertFromSerializedVis(vis.serialize());
+    return {
+      uiState: vis.uiState.toJSON(),
+      query: vis.data.searchSource.getOwnField('query') || defaultQuery,
+      filters: vis.data.searchSource.getOwnField('filter') || [],
+      vis: { ...savedVisState.visState, title: vis.title },
+      linked: !!savedVis.savedSearchId,
+    };
+  };
+
+  const stateDefaults = visStateToEditorState();
+
+  const { stateContainer, stopStateSync } = useVisualizeAppState({
+    stateDefaults,
+    kbnUrlStateStorage,
+  });
+
+  $scope.eventEmitter.on('dirtyStateChange', ({ isDirty }) => {
+    if (!isDirty) {
+      stateContainer.transitions.updateVisState(visStateToEditorState().vis);
+    }
+    $timeout(() => {
+      $scope.dirty = isDirty;
+    });
+  });
+
+  $scope.eventEmitter.on('updateVis', () => {
+    embeddableHandler.reload();
   });
 
+  $scope.embeddableHandler = embeddableHandler;
+
   $scope.topNavMenu = [
     ...(visualizeCapabilities.save
       ? [
@@ -135,10 +173,10 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
             ),
             testId: 'visualizeSaveButton',
             disableButton() {
-              return Boolean(vis.dirty);
+              return Boolean($scope.dirty);
             },
             tooltip() {
-              if (vis.dirty) {
+              if ($scope.dirty) {
                 return i18n.translate(
                   'kbn.visualize.topNavMenu.saveVisualizationDisabledButtonTooltip',
                   {
@@ -207,7 +245,7 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
       }),
       testId: 'shareTopNavButton',
       run: anchorElement => {
-        const hasUnappliedChanges = vis.dirty;
+        const hasUnappliedChanges = $scope.dirty;
         const hasUnsavedChanges = $appStatus.dirty;
         share.toggleShareContextMenu({
           anchorElement,
@@ -233,17 +271,17 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
       }),
       testId: 'openInspectorButton',
       disableButton() {
-        return !vis.hasInspector || !vis.hasInspector();
+        return !embeddableHandler.hasInspector || !embeddableHandler.hasInspector();
       },
       run() {
-        const inspectorSession = vis.openInspector();
+        const inspectorSession = embeddableHandler.openInspector();
         // Close the inspector if this scope is destroyed (e.g. because the user navigates away).
         const removeWatch = $scope.$on('$destroy', () => inspectorSession.close());
         // Remove that watch in case the user closes the inspector session herself.
         inspectorSession.onClose.finally(removeWatch);
       },
       tooltip() {
-        if (!vis.hasInspector || !vis.hasInspector()) {
+        if (!embeddableHandler.hasInspector || !embeddableHandler.hasInspector()) {
           return i18n.translate('kbn.visualize.topNavMenu.openInspectorDisabledButtonTooltip', {
             defaultMessage: `This visualization doesn't support any inspectors.`,
           });
@@ -257,7 +295,7 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
         defaultMessage: 'Refresh',
       }),
       run: function() {
-        vis.forceReload();
+        embeddableHandler.reload();
       },
       testId: 'visualizeRefreshButton',
     },
@@ -267,28 +305,6 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
     chrome.docTitle.change(savedVis.title);
   }
 
-  const defaultQuery = {
-    query: '',
-    language:
-      localStorage.get('kibana.userQueryLanguage') || uiSettings.get('search:queryLanguage'),
-  };
-
-  // Extract visualization state with filtered aggs. You can see these filtered aggs in the URL.
-  // Consists of things like aggs, params, listeners, title, type, etc.
-  const savedVisState = vis.getState();
-  const stateDefaults = {
-    uiState: savedVis.uiStateJSON ? JSON.parse(savedVis.uiStateJSON) : {},
-    query: searchSource.getOwnField('query') || defaultQuery,
-    filters: searchSource.getOwnField('filter') || [],
-    vis: savedVisState,
-    linked: !!savedVis.savedSearchId,
-  };
-
-  const { stateContainer, stopStateSync } = useVisualizeAppState({
-    stateDefaults,
-    kbnUrlStateStorage,
-  });
-
   // sync initial app filters from state to filterManager
   filterManager.setAppFilters(_.cloneDeep(stateContainer.getState().filters));
   // setup syncing of app filters between appState and filterManager
@@ -315,7 +331,8 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
   // appState then they won't be equal.
   if (!_.isEqual(stateContainer.getState().vis, stateDefaults.vis)) {
     try {
-      vis.setState(stateContainer.getState().vis);
+      const { aggs, ...visState } = stateContainer.getState().vis;
+      vis.setState({ ...visState, data: { aggs } });
     } catch (error) {
       // stop syncing url updtes with the state to prevent extra syncing
       stopAllSyncing();
@@ -369,8 +386,8 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
   };
 
   function init() {
-    if (vis.indexPattern) {
-      $scope.indexPattern = vis.indexPattern;
+    if (vis.data.indexPattern) {
+      $scope.indexPattern = vis.data.indexPattern;
     } else {
       indexPatterns.getDefault().then(defaultIndexPattern => {
         $scope.indexPattern = defaultIndexPattern;
@@ -379,22 +396,14 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
 
     const initialState = stateContainer.getState();
 
-    $scope.appState = {
-      // mock implementation of the legacy appState.save()
-      // this could be even replaced by passing only "updateAppState" callback
-      save() {
-        stateContainer.transitions.updateVisState(vis.getState());
-      },
-    };
-
     const handleLinkedSearch = linked => {
       if (linked && !savedVis.savedSearchId && savedSearch) {
         savedVis.savedSearchId = savedSearch.id;
-        vis.savedSearchId = savedSearch.id;
+        vis.data.savedSearchId = savedSearch.id;
         searchSource.setParent(savedSearch.searchSource);
       } else if (!linked && savedVis.savedSearchId) {
         delete savedVis.savedSearchId;
-        delete vis.savedSearchId;
+        delete vis.data.savedSearchId;
       }
     };
 
@@ -403,6 +412,7 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
       'uiState',
       stateContainer
     );
+    vis.uiState = persistedState;
     $scope.uiState = persistedState;
     $scope.savedVis = savedVis;
     $scope.query = initialState.query;
@@ -427,7 +437,7 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
     $scope.showQueryBarTimePicker = () => {
       // tsvb loads without an indexPattern initially (TODO investigate).
       // hide timefilter only if timeFieldName is explicitly undefined.
-      const hasTimeField = vis.indexPattern ? !!vis.indexPattern.timeFieldName : true;
+      const hasTimeField = vis.data.indexPattern ? !!vis.data.indexPattern.timeFieldName : true;
       return vis.type.options.showTimePicker && hasTimeField;
     };
 
@@ -442,10 +452,24 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
       updateSavedQueryFromUrl(state.savedQuery);
 
       // if the browser history was changed manually we need to reflect changes in the editor
-      if (!_.isEqual(vis.getState(), state.vis)) {
-        vis.setState(state.vis);
-        vis.forceReload();
-        vis.emit('updateEditor');
+      if (
+        !_.isEqual(
+          {
+            ...visualizations.convertFromSerializedVis(vis.serialize()).visState,
+            title: vis.title,
+          },
+          state.vis
+        )
+      ) {
+        const { aggs, ...visState } = state.vis;
+        vis.setState({
+          ...visState,
+          data: {
+            aggs,
+          },
+        });
+        embeddableHandler.reload();
+        $scope.eventEmitter.emit('updateEditor');
       }
 
       $appStatus.dirty = true;
@@ -498,8 +522,8 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
       const { query, linked, filters } = stateContainer.getState();
       $scope.query = query;
       handleLinkedSearch(linked);
-      savedVis.searchSource.setField('query', query);
-      savedVis.searchSource.setField('filter', filters);
+      vis.data.searchSource.setField('query', query);
+      vis.data.searchSource.setField('filter', filters);
       $scope.$broadcast('render');
     };
 
@@ -533,7 +557,7 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
       }
       savedVis.destroy();
       subscriptions.unsubscribe();
-      $scope.vis.off('apply', _applyVis);
+      $scope.eventEmitter.off('apply', _applyVis);
 
       unsubscribePersisted();
       unsubscribeStateUpdates();
@@ -556,7 +580,7 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
 
     // If nothing has changed, trigger the fetch manually, otherwise it will happen as a result of the changes
     if (!isUpdate) {
-      $scope.vis.forceReload();
+      embeddableHandler.reload();
     }
   };
 
@@ -605,8 +629,10 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
       title: savedVis.title,
       type: savedVis.type || stateContainer.getState().vis.type,
     });
+    savedVis.searchSource.setField('query', stateContainer.getState().query);
+    savedVis.searchSource.setField('filter', stateContainer.getState().filters);
     savedVis.visState = stateContainer.getState().vis;
-    savedVis.uiStateJSON = angular.toJson($scope.uiState.getChanges());
+    savedVis.uiStateJSON = angular.toJson($scope.uiState.toJSON());
     $appStatus.dirty = false;
 
     return savedVis.save(saveOptions).then(
@@ -720,7 +746,7 @@ function VisualizeAppController($scope, $route, $injector, $timeout, kbnUrlState
     );
   };
 
-  vis.on('unlinkFromSavedSearch', unlinkFromSavedSearch);
+  $scope.eventEmitter.on('unlinkFromSavedSearch', unlinkFromSavedSearch);
 
   addHelpMenuToAppChrome(chrome, docLinks);
 
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/visualization.js b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/visualization.js
index c8acea168444f..fbabd6fc87c98 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/visualization.js
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/visualization.js
@@ -17,12 +17,12 @@
  * under the License.
  */
 
-export function initVisualizationDirective(app, deps) {
+export function initVisualizationDirective(app) {
   app.directive('visualizationEmbedded', function($timeout) {
     return {
       restrict: 'E',
       scope: {
-        savedObj: '=',
+        embeddableHandler: '=',
         uiState: '=?',
         timeRange: '=',
         filters: '=',
@@ -31,24 +31,16 @@ export function initVisualizationDirective(app, deps) {
       },
       link: function($scope, element) {
         $scope.renderFunction = async () => {
-          if (!$scope._handler) {
-            $scope._handler = await deps.embeddable
-              .getEmbeddableFactory('visualization')
-              .createFromObject($scope.savedObj, {
-                timeRange: $scope.timeRange,
-                filters: $scope.filters || [],
-                query: $scope.query,
-                appState: $scope.appState,
-                uiState: $scope.uiState,
-              });
-            $scope._handler.render(element[0]);
-          } else {
-            $scope._handler.updateInput({
-              timeRange: $scope.timeRange,
-              filters: $scope.filters || [],
-              query: $scope.query,
-            });
+          if (!$scope.rendered) {
+            $scope.embeddableHandler.render(element[0]);
+            $scope.rendered = true;
           }
+
+          $scope.embeddableHandler.updateInput({
+            timeRange: $scope.timeRange,
+            filters: $scope.filters || [],
+            query: $scope.query,
+          });
         };
 
         $scope.$on('render', event => {
@@ -59,8 +51,8 @@ export function initVisualizationDirective(app, deps) {
         });
 
         $scope.$on('$destroy', () => {
-          if ($scope._handler) {
-            $scope._handler.destroy();
+          if ($scope.embeddableHandler) {
+            $scope.embeddableHandler.destroy();
           }
         });
       },
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/visualization_editor.js b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/visualization_editor.js
index f2d9cbe2ad84c..ef174dbaa5865 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/visualization_editor.js
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/editor/visualization_editor.js
@@ -22,16 +22,23 @@ export function initVisEditorDirective(app, deps) {
     return {
       restrict: 'E',
       scope: {
-        savedObj: '=',
+        vis: '=',
         uiState: '=?',
         timeRange: '=',
         filters: '=',
         query: '=',
-        appState: '=',
+        savedSearch: '=',
+        embeddableHandler: '=',
+        eventEmitter: '=',
       },
       link: function($scope, element) {
-        const Editor = $scope.savedObj.vis.type.editor || deps.DefaultVisualizationEditor;
-        const editor = new Editor(element[0], $scope.savedObj);
+        const Editor = $scope.vis.type.editor || deps.DefaultVisualizationEditor;
+        const editor = new Editor(
+          element[0],
+          $scope.vis,
+          $scope.eventEmitter,
+          $scope.embeddableHandler
+        );
 
         $scope.renderFunction = () => {
           editor.render({
@@ -42,8 +49,8 @@ export function initVisEditorDirective(app, deps) {
             timeRange: $scope.timeRange,
             filters: $scope.filters,
             query: $scope.query,
-            appState: $scope.appState,
-            linked: !!$scope.savedObj.savedSearchId,
+            linked: !!$scope.vis.data.savedSearchId,
+            savedSearch: $scope.savedSearch,
           });
         };
 
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/legacy_app.js b/src/legacy/core_plugins/kibana/public/visualize/np_ready/legacy_app.js
index 0f1d50b149cd9..b0b1ae31a02a5 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/legacy_app.js
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/legacy_app.js
@@ -40,6 +40,50 @@ import {
   getCreateBreadcrumbs,
   getEditBreadcrumbs,
 } from './breadcrumbs';
+import { createSavedSearchesLoader } from '../../../../../../plugins/discover/public';
+
+const getResolvedResults = deps => {
+  const { core, data, visualizations } = deps;
+
+  const results = {};
+
+  return savedVis => {
+    results.savedVis = savedVis;
+    return visualizations
+      .convertToSerializedVis(savedVis)
+      .then(serializedVis => visualizations.createVis(serializedVis.type, serializedVis))
+      .then(vis => {
+        if (vis.type.setup) {
+          return vis.type.setup(vis).catch(() => vis);
+        }
+        return vis;
+      })
+      .then(vis => {
+        results.vis = vis;
+        return deps.embeddable.getEmbeddableFactory('visualization').createFromObject(results.vis, {
+          timeRange: data.query.timefilter.timefilter.getTime(),
+          filters: data.query.filterManager.getFilters(),
+        });
+      })
+      .then(embeddableHandler => {
+        results.embeddableHandler = embeddableHandler;
+        if (results.vis.data.savedSearchId) {
+          return createSavedSearchesLoader({
+            savedObjectsClient: core.savedObjects.client,
+            indexPatterns: data.indexPatterns,
+            chrome: core.chrome,
+            overlays: core.overlays,
+          }).get(results.vis.data.savedSearchId);
+        }
+      })
+      .then(savedSearch => {
+        if (savedSearch) {
+          results.savedSearch = savedSearch;
+        }
+        return results;
+      });
+  };
+};
 
 export function initVisualizeApp(app, deps) {
   initVisualizeAppDirective(app, deps);
@@ -101,7 +145,7 @@ export function initVisualizeApp(app, deps) {
         template: editorTemplate,
         k7Breadcrumbs: getCreateBreadcrumbs,
         resolve: {
-          savedVis: function($route, history) {
+          resolved: function($route, history) {
             const { core, data, savedVisualizations, visualizations, toastNotifications } = deps;
             const visTypes = visualizations.all();
             const visType = find(visTypes, { name: $route.current.params.type });
@@ -121,12 +165,7 @@ export function initVisualizeApp(app, deps) {
 
             return ensureDefaultIndexPattern(core, data, history)
               .then(() => savedVisualizations.get($route.current.params))
-              .then(savedVis => {
-                if (savedVis.vis.type.setup) {
-                  return savedVis.vis.type.setup(savedVis).catch(() => savedVis);
-                }
-                return savedVis;
-              })
+              .then(getResolvedResults(deps))
               .catch(
                 redirectWhenMissing({
                   history,
@@ -142,20 +181,16 @@ export function initVisualizeApp(app, deps) {
         template: editorTemplate,
         k7Breadcrumbs: getEditBreadcrumbs,
         resolve: {
-          savedVis: function($route, history) {
+          resolved: function($route, history) {
             const { chrome, core, data, savedVisualizations, toastNotifications } = deps;
+
             return ensureDefaultIndexPattern(core, data, history)
               .then(() => savedVisualizations.get($route.current.params.id))
               .then(savedVis => {
                 chrome.recentlyAccessed.add(savedVis.getFullPath(), savedVis.title, savedVis.id);
                 return savedVis;
               })
-              .then(savedVis => {
-                if (savedVis.vis.type.setup) {
-                  return savedVis.vis.type.setup(savedVis).catch(() => savedVis);
-                }
-                return savedVis;
-              })
+              .then(getResolvedResults(deps))
               .catch(
                 redirectWhenMissing({
                   history,
diff --git a/src/legacy/core_plugins/kibana/public/visualize/np_ready/types.d.ts b/src/legacy/core_plugins/kibana/public/visualize/np_ready/types.d.ts
index 01ce872aeb679..246a031f05769 100644
--- a/src/legacy/core_plugins/kibana/public/visualize/np_ready/types.d.ts
+++ b/src/legacy/core_plugins/kibana/public/visualize/np_ready/types.d.ts
@@ -29,8 +29,10 @@ import { PersistedState } from 'src/plugins/visualizations/public';
 import { LegacyCoreStart } from 'kibana/public';
 import { Vis } from 'src/legacy/core_plugins/visualizations/public';
 import { VisSavedObject } from '../legacy_imports';
+import { SavedVisState } from '../../../../visualizations/public/np_ready/public/types';
+import { SavedSearch } from '../../../../../../plugins/discover/public';
 
-export type PureVisState = ReturnType<Vis['getCurrentState']>;
+export type PureVisState = SavedVisState;
 
 export interface VisualizeAppState {
   filters: Filter[];
@@ -58,14 +60,13 @@ export interface VisualizeAppStateTransitions {
 }
 
 export interface EditorRenderProps {
-  appState: { save(): void };
   core: LegacyCoreStart;
   data: DataPublicPluginStart;
-  embeddable: EmbeddableStart;
   filters: Filter[];
-  uiState: PersistedState;
   timeRange: TimeRange;
   query?: Query;
+  savedSearch?: SavedSearch;
+  uiState: PersistedState;
   /**
    * Flag to determine if visualiztion is linked to the saved search
    */
diff --git a/src/legacy/core_plugins/region_map/public/__tests__/region_map_visualization.js b/src/legacy/core_plugins/region_map/public/__tests__/region_map_visualization.js
index 6bdb5d00e67d8..23ca99791e92e 100644
--- a/src/legacy/core_plugins/region_map/public/__tests__/region_map_visualization.js
+++ b/src/legacy/core_plugins/region_map/public/__tests__/region_map_visualization.js
@@ -21,7 +21,6 @@ import expect from '@kbn/expect';
 import ngMock from 'ng_mock';
 import _ from 'lodash';
 import ChoroplethLayer from '../choropleth_layer';
-import LogstashIndexPatternStubProvider from 'fixtures/stubbed_logstash_index_pattern';
 import { ImageComparator } from 'test_utils/image_comparator';
 import worldJson from './world.json';
 import EMS_CATALOGUE from '../../../../ui/public/vis/__tests__/map/ems_mocks/sample_manifest.json';
@@ -38,13 +37,11 @@ import afterdatachangePng from './afterdatachange.png';
 import afterdatachangeandresizePng from './afterdatachangeandresize.png';
 import aftercolorchangePng from './aftercolorchange.png';
 import changestartupPng from './changestartup.png';
-import {
-  setup as visualizationsSetup,
-  start as visualizationsStart,
-} from '../../../visualizations/public/np_ready/public/legacy';
+import { setup as visualizationsSetup } from '../../../visualizations/public/np_ready/public/legacy';
 
 import { createRegionMapVisualization } from '../region_map_visualization';
 import { createRegionMapTypeDefinition } from '../region_map_type';
+import { ExprVis } from '../../../visualizations/public/np_ready/public/expressions/vis';
 
 const THRESHOLD = 0.45;
 const PIXEL_DIFF = 96;
@@ -52,7 +49,6 @@ const PIXEL_DIFF = 96;
 describe('RegionMapsVisualizationTests', function() {
   let domNode;
   let RegionMapsVisualization;
-  let indexPattern;
   let vis;
   let dependencies;
 
@@ -115,7 +111,6 @@ describe('RegionMapsVisualizationTests', function() {
       }
 
       RegionMapsVisualization = createRegionMapVisualization(dependencies);
-      indexPattern = Private(LogstashIndexPatternStubProvider);
 
       ChoroplethLayer.prototype._makeJsonAjaxCall = async function() {
         //simulate network call
@@ -158,7 +153,7 @@ describe('RegionMapsVisualizationTests', function() {
 
       imageComparator = new ImageComparator();
 
-      vis = visualizationsStart.createVis(indexPattern, {
+      vis = new ExprVis({
         type: 'region_map',
       });
 
diff --git a/src/legacy/core_plugins/region_map/public/region_map_type.js b/src/legacy/core_plugins/region_map/public/region_map_type.js
index 9a1a76362e094..4faa3f92abb5a 100644
--- a/src/legacy/core_plugins/region_map/public/region_map_type.js
+++ b/src/legacy/core_plugins/region_map/public/region_map_type.js
@@ -20,7 +20,6 @@ import React from 'react';
 import { i18n } from '@kbn/i18n';
 import { mapToLayerWithId } from './util';
 import { createRegionMapVisualization } from './region_map_visualization';
-import { Status } from '../../visualizations/public';
 import { RegionMapOptions } from './components/region_map_options';
 import { truncatedColorSchemas } from '../../../../plugins/charts/public';
 import { Schemas } from '../../vis_default_editor/public';
@@ -55,7 +54,6 @@ provided base maps, or add your own. Darker colors represent higher values.',
         showAllShapes: true, //still under consideration
       },
     },
-    requiresUpdateStatus: [Status.AGGS, Status.PARAMS, Status.RESIZE, Status.DATA, Status.UI_STATE],
     visualization,
     editorConfig: {
       optionsTemplate: props => <RegionMapOptions {...props} serviceSettings={serviceSettings} />,
@@ -100,9 +98,7 @@ provided base maps, or add your own. Darker colors represent higher values.',
         },
       ]),
     },
-    setup: async savedVis => {
-      const vis = savedVis.vis;
-
+    setup: async vis => {
       const tmsLayers = await serviceSettings.getTMSServices();
       vis.type.editorConfig.collections.tmsLayers = tmsLayers;
       if (!vis.params.wms.selectedTmsLayer && tmsLayers.length) {
@@ -146,7 +142,7 @@ provided base maps, or add your own. Darker colors represent higher values.',
         vis.params.selectedJoinField = selectedJoinField;
       }
 
-      return savedVis;
+      return vis;
     },
   };
 }
diff --git a/src/legacy/core_plugins/region_map/public/region_map_visualization.js b/src/legacy/core_plugins/region_map/public/region_map_visualization.js
index 8b5812052a395..25641ea76809d 100644
--- a/src/legacy/core_plugins/region_map/public/region_map_visualization.js
+++ b/src/legacy/core_plugins/region_map/public/region_map_visualization.js
@@ -39,8 +39,8 @@ export function createRegionMapVisualization({ serviceSettings, $injector, uiSet
       this._choroplethLayer = null;
     }
 
-    async render(esResponse, visParams, status) {
-      await super.render(esResponse, visParams, status);
+    async render(esResponse, visParams) {
+      await super.render(esResponse, visParams);
       if (this._choroplethLayer) {
         await this._choroplethLayer.whenDataLoaded();
       }
diff --git a/src/legacy/core_plugins/telemetry/common/constants.ts b/src/legacy/core_plugins/telemetry/common/constants.ts
deleted file mode 100644
index b44bf319e6627..0000000000000
--- a/src/legacy/core_plugins/telemetry/common/constants.ts
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { i18n } from '@kbn/i18n';
-
-/*
- * config options opt into telemetry
- * @type {string}
- */
-export const CONFIG_TELEMETRY = 'telemetry:optIn';
-/*
- * config description for opting into telemetry
- * @type {string}
- */
-export const getConfigTelemetryDesc = () => {
-  return i18n.translate('telemetry.telemetryConfigDescription', {
-    defaultMessage:
-      'Help us improve the Elastic Stack by providing usage statistics for basic features. We will not share this data outside of Elastic.',
-  });
-};
-
-/**
- * The amount of time, in milliseconds, to wait between reports when enabled.
- *
- * Currently 24 hours.
- * @type {Number}
- */
-export const REPORT_INTERVAL_MS = 86400000;
-
-/**
- * Link to the Elastic Telemetry privacy statement.
- */
-export const PRIVACY_STATEMENT_URL = `https://www.elastic.co/legal/privacy-statement`;
-
-/**
- * The type name used within the Monitoring index to publish localization stats.
- * @type {string}
- */
-export const KIBANA_LOCALIZATION_STATS_TYPE = 'localization';
-
-/**
- * The type name used to publish telemetry plugin stats.
- * @type {string}
- */
-export const TELEMETRY_STATS_TYPE = 'telemetry';
-
-/**
- * UI metric usage type
- * @type {string}
- */
-export const UI_METRIC_USAGE_TYPE = 'ui_metric';
-
-/**
- * Application Usage type
- */
-export const APPLICATION_USAGE_TYPE = 'application_usage';
-
-/**
- * Link to Advanced Settings.
- */
-export const PATH_TO_ADVANCED_SETTINGS = 'kibana#/management/kibana/settings';
-
-/**
- * The type name used within the Monitoring index to publish management stats.
- * @type {string}
- */
-export const KIBANA_STACK_MANAGEMENT_STATS_TYPE = 'stack_management';
diff --git a/src/legacy/core_plugins/telemetry/index.ts b/src/legacy/core_plugins/telemetry/index.ts
deleted file mode 100644
index 1e88e7d65cffd..0000000000000
--- a/src/legacy/core_plugins/telemetry/index.ts
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import * as Rx from 'rxjs';
-import { resolve } from 'path';
-import JoiNamespace from 'joi';
-import { Server } from 'hapi';
-import { PluginInitializerContext } from 'src/core/server';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { getConfigPath } from '../../../core/server/path';
-// @ts-ignore
-import mappings from './mappings.json';
-import {
-  telemetryPlugin,
-  replaceTelemetryInjectedVars,
-  FetcherTask,
-  PluginsSetup,
-  handleOldSettings,
-} from './server';
-
-const ENDPOINT_VERSION = 'v2';
-
-const telemetry = (kibana: any) => {
-  return new kibana.Plugin({
-    id: 'telemetry',
-    configPrefix: 'telemetry',
-    publicDir: resolve(__dirname, 'public'),
-    require: ['elasticsearch'],
-    config(Joi: typeof JoiNamespace) {
-      return Joi.object({
-        enabled: Joi.boolean().default(true),
-        allowChangingOptInStatus: Joi.boolean().default(true),
-        optIn: Joi.when('allowChangingOptInStatus', {
-          is: false,
-          then: Joi.valid(true).default(true),
-          otherwise: Joi.boolean().default(true),
-        }),
-        // `config` is used internally and not intended to be set
-        config: Joi.string().default(getConfigPath()),
-        banner: Joi.boolean().default(true),
-        url: Joi.when('$dev', {
-          is: true,
-          then: Joi.string().default(
-            `https://telemetry-staging.elastic.co/xpack/${ENDPOINT_VERSION}/send`
-          ),
-          otherwise: Joi.string().default(
-            `https://telemetry.elastic.co/xpack/${ENDPOINT_VERSION}/send`
-          ),
-        }),
-        optInStatusUrl: Joi.when('$dev', {
-          is: true,
-          then: Joi.string().default(
-            `https://telemetry-staging.elastic.co/opt_in_status/${ENDPOINT_VERSION}/send`
-          ),
-          otherwise: Joi.string().default(
-            `https://telemetry.elastic.co/opt_in_status/${ENDPOINT_VERSION}/send`
-          ),
-        }),
-        sendUsageFrom: Joi.string()
-          .allow(['server', 'browser'])
-          .default('browser'),
-      }).default();
-    },
-    uiExports: {
-      managementSections: ['plugins/telemetry/views/management'],
-      savedObjectSchemas: {
-        telemetry: {
-          isNamespaceAgnostic: true,
-        },
-      },
-      async replaceInjectedVars(originalInjectedVars: any, request: any, server: any) {
-        const telemetryInjectedVars = await replaceTelemetryInjectedVars(request, server);
-        return Object.assign({}, originalInjectedVars, telemetryInjectedVars);
-      },
-      injectDefaultVars(server: Server) {
-        const config = server.config();
-        return {
-          telemetryEnabled: config.get('telemetry.enabled'),
-          telemetryUrl: config.get('telemetry.url'),
-          telemetryBanner:
-            config.get('telemetry.allowChangingOptInStatus') !== false &&
-            config.get('telemetry.banner'),
-          telemetryOptedIn: config.get('telemetry.optIn'),
-          telemetryOptInStatusUrl: config.get('telemetry.optInStatusUrl'),
-          allowChangingOptInStatus: config.get('telemetry.allowChangingOptInStatus'),
-          telemetrySendUsageFrom: config.get('telemetry.sendUsageFrom'),
-          telemetryNotifyUserAboutOptInDefault: false,
-        };
-      },
-      mappings,
-    },
-    postInit(server: Server) {
-      const fetcherTask = new FetcherTask(server);
-      fetcherTask.start();
-    },
-    async init(server: Server) {
-      const { usageCollection } = server.newPlatform.setup.plugins;
-      const initializerContext = {
-        env: {
-          packageInfo: {
-            version: server.config().get('pkg.version'),
-          },
-        },
-        config: {
-          create() {
-            const config = server.config();
-            return Rx.of({
-              enabled: config.get('telemetry.enabled'),
-              optIn: config.get('telemetry.optIn'),
-              config: config.get('telemetry.config'),
-              banner: config.get('telemetry.banner'),
-              url: config.get('telemetry.url'),
-              allowChangingOptInStatus: config.get('telemetry.allowChangingOptInStatus'),
-            });
-          },
-        },
-      } as PluginInitializerContext;
-
-      try {
-        await handleOldSettings(server);
-      } catch (err) {
-        server.log(['warning', 'telemetry'], 'Unable to update legacy telemetry configs.');
-      }
-
-      const pluginsSetup: PluginsSetup = {
-        usageCollection,
-      };
-
-      const npPlugin = telemetryPlugin(initializerContext);
-      await npPlugin.setup(server.newPlatform.setup.core, pluginsSetup, server);
-      await npPlugin.start(server.newPlatform.start.core);
-    },
-  });
-};
-
-// eslint-disable-next-line import/no-default-export
-export default telemetry;
diff --git a/src/legacy/core_plugins/telemetry/mappings.json b/src/legacy/core_plugins/telemetry/mappings.json
deleted file mode 100644
index fa9cc93d6363a..0000000000000
--- a/src/legacy/core_plugins/telemetry/mappings.json
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  "telemetry": {
-    "properties": {
-      "enabled": {
-        "type": "boolean"
-      },
-      "sendUsageFrom": {
-        "ignore_above": 256,
-        "type": "keyword"
-      },
-      "lastReported": {
-        "type": "date"
-      },
-      "lastVersionChecked": {
-        "ignore_above": 256,
-        "type": "keyword"
-      },
-      "userHasSeenNotice": {
-        "type": "boolean"
-      },
-      "reportFailureCount": {
-        "type": "integer"
-      },
-      "reportFailureVersion": {
-        "ignore_above": 256,
-        "type": "keyword"
-      }
-    }
-  }
-}
diff --git a/src/legacy/core_plugins/telemetry/package.json b/src/legacy/core_plugins/telemetry/package.json
deleted file mode 100644
index 979e68cce742f..0000000000000
--- a/src/legacy/core_plugins/telemetry/package.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "name": "telemetry",
-  "version": "kibana"
-}
diff --git a/src/legacy/core_plugins/telemetry/public/views/management/management.tsx b/src/legacy/core_plugins/telemetry/public/views/management/management.tsx
deleted file mode 100644
index c8ae410e0aa57..0000000000000
--- a/src/legacy/core_plugins/telemetry/public/views/management/management.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-import React from 'react';
-import routes from 'ui/routes';
-import { npStart, npSetup } from 'ui/new_platform';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { TelemetryManagementSection } from '../../../../../../plugins/telemetry/public/components';
-
-routes.defaults(/\/management/, {
-  resolve: {
-    telemetryManagementSection() {
-      const { telemetry } = npStart.plugins as any;
-      const { advancedSettings } = npSetup.plugins as any;
-
-      if (telemetry && advancedSettings) {
-        const componentRegistry = advancedSettings.component;
-        const Component = (props: any) => (
-          <TelemetryManagementSection
-            showAppliesSettingMessage={true}
-            telemetryService={telemetry.telemetryService}
-            {...props}
-          />
-        );
-
-        componentRegistry.register(
-          componentRegistry.componentType.PAGE_FOOTER_COMPONENT,
-          Component,
-          true
-        );
-      }
-    },
-  },
-});
diff --git a/src/legacy/core_plugins/telemetry/server/collection_manager.ts b/src/legacy/core_plugins/telemetry/server/collection_manager.ts
deleted file mode 100644
index ebac4bede85bb..0000000000000
--- a/src/legacy/core_plugins/telemetry/server/collection_manager.ts
+++ /dev/null
@@ -1,249 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { encryptTelemetry } from './collectors';
-import { CallCluster } from '../../elasticsearch';
-import { UsageCollectionSetup } from '../../../../plugins/usage_collection/server';
-import { Cluster } from '../../elasticsearch';
-import { ESLicense } from './telemetry_collection/get_local_license';
-
-export type EncryptedStatsGetterConfig = { unencrypted: false } & {
-  server: any;
-  start: string;
-  end: string;
-};
-
-export type UnencryptedStatsGetterConfig = { unencrypted: true } & {
-  req: any;
-  start: string;
-  end: string;
-};
-
-export interface ClusterDetails {
-  clusterUuid: string;
-}
-
-export interface StatsCollectionConfig {
-  usageCollection: UsageCollectionSetup;
-  callCluster: CallCluster;
-  server: any;
-  start: string | number;
-  end: string | number;
-}
-
-export interface BasicStatsPayload {
-  timestamp: string;
-  cluster_uuid: string;
-  cluster_name: string;
-  version: string;
-  cluster_stats: object;
-  collection?: string;
-  stack_stats: object;
-}
-
-export type StatsGetterConfig = UnencryptedStatsGetterConfig | EncryptedStatsGetterConfig;
-export type ClusterDetailsGetter = (config: StatsCollectionConfig) => Promise<ClusterDetails[]>;
-export type StatsGetter<T extends BasicStatsPayload = BasicStatsPayload> = (
-  clustersDetails: ClusterDetails[],
-  config: StatsCollectionConfig
-) => Promise<T[]>;
-export type LicenseGetter = (
-  clustersDetails: ClusterDetails[],
-  config: StatsCollectionConfig
-) => Promise<{ [clusterUuid: string]: ESLicense | undefined }>;
-
-interface CollectionConfig<T extends BasicStatsPayload> {
-  title: string;
-  priority: number;
-  esCluster: string | Cluster;
-  statsGetter: StatsGetter<T>;
-  clusterDetailsGetter: ClusterDetailsGetter;
-  licenseGetter: LicenseGetter;
-}
-interface Collection {
-  statsGetter: StatsGetter;
-  licenseGetter: LicenseGetter;
-  clusterDetailsGetter: ClusterDetailsGetter;
-  esCluster: string | Cluster;
-  title: string;
-}
-
-export class TelemetryCollectionManager {
-  private usageGetterMethodPriority = -1;
-  private collections: Collection[] = [];
-
-  public setCollection = <T extends BasicStatsPayload>(collectionConfig: CollectionConfig<T>) => {
-    const {
-      title,
-      priority,
-      esCluster,
-      statsGetter,
-      clusterDetailsGetter,
-      licenseGetter,
-    } = collectionConfig;
-
-    if (typeof priority !== 'number') {
-      throw new Error('priority must be set.');
-    }
-    if (priority === this.usageGetterMethodPriority) {
-      throw new Error(`A Usage Getter with the same priority is already set.`);
-    }
-
-    if (priority > this.usageGetterMethodPriority) {
-      if (!statsGetter) {
-        throw Error('Stats getter method not set.');
-      }
-      if (!esCluster) {
-        throw Error('esCluster name must be set for the getCluster method.');
-      }
-      if (!clusterDetailsGetter) {
-        throw Error('Cluster UUIds method is not set.');
-      }
-      if (!licenseGetter) {
-        throw Error('License getter method not set.');
-      }
-
-      this.collections.unshift({
-        licenseGetter,
-        statsGetter,
-        clusterDetailsGetter,
-        esCluster,
-        title,
-      });
-      this.usageGetterMethodPriority = priority;
-    }
-  };
-
-  private getStatsCollectionConfig = async (
-    collection: Collection,
-    config: StatsGetterConfig
-  ): Promise<StatsCollectionConfig> => {
-    const { start, end } = config;
-    const server = config.unencrypted ? config.req.server : config.server;
-    const { callWithRequest, callWithInternalUser } =
-      typeof collection.esCluster === 'string'
-        ? server.plugins.elasticsearch.getCluster(collection.esCluster)
-        : collection.esCluster;
-    const callCluster = config.unencrypted
-      ? (...args: any[]) => callWithRequest(config.req, ...args)
-      : callWithInternalUser;
-
-    const { usageCollection } = server.newPlatform.setup.plugins;
-    return { server, callCluster, start, end, usageCollection };
-  };
-
-  private getOptInStatsForCollection = async (
-    collection: Collection,
-    optInStatus: boolean,
-    statsCollectionConfig: StatsCollectionConfig
-  ) => {
-    const clustersDetails = await collection.clusterDetailsGetter(statsCollectionConfig);
-    return clustersDetails.map(({ clusterUuid }) => ({
-      cluster_uuid: clusterUuid,
-      opt_in_status: optInStatus,
-    }));
-  };
-
-  private getUsageForCollection = async (
-    collection: Collection,
-    statsCollectionConfig: StatsCollectionConfig
-  ) => {
-    const clustersDetails = await collection.clusterDetailsGetter(statsCollectionConfig);
-
-    if (clustersDetails.length === 0) {
-      // don't bother doing a further lookup, try next collection.
-      return;
-    }
-
-    const [stats, licenses] = await Promise.all([
-      collection.statsGetter(clustersDetails, statsCollectionConfig),
-      collection.licenseGetter(clustersDetails, statsCollectionConfig),
-    ]);
-
-    return stats.map(stat => {
-      const license = licenses[stat.cluster_uuid];
-      return {
-        ...(license ? { license } : {}),
-        ...stat,
-        collectionSource: collection.title,
-      };
-    });
-  };
-
-  public getOptInStats = async (optInStatus: boolean, config: StatsGetterConfig) => {
-    for (const collection of this.collections) {
-      const statsCollectionConfig = await this.getStatsCollectionConfig(collection, config);
-      try {
-        const optInStats = await this.getOptInStatsForCollection(
-          collection,
-          optInStatus,
-          statsCollectionConfig
-        );
-        if (optInStats && optInStats.length) {
-          statsCollectionConfig.server.log(
-            ['debug', 'telemetry', 'collection'],
-            `Got Opt In stats using ${collection.title} collection.`
-          );
-          if (config.unencrypted) {
-            return optInStats;
-          }
-          const isDev = statsCollectionConfig.server.config().get('env.dev');
-          return encryptTelemetry(optInStats, isDev);
-        }
-      } catch (err) {
-        statsCollectionConfig.server.log(
-          ['debu', 'telemetry', 'collection'],
-          `Failed to collect any opt in stats with registered collections.`
-        );
-        // swallow error to try next collection;
-      }
-    }
-
-    return [];
-  };
-  public getStats = async (config: StatsGetterConfig) => {
-    for (const collection of this.collections) {
-      const statsCollectionConfig = await this.getStatsCollectionConfig(collection, config);
-      try {
-        const usageData = await this.getUsageForCollection(collection, statsCollectionConfig);
-        if (usageData && usageData.length) {
-          statsCollectionConfig.server.log(
-            ['debug', 'telemetry', 'collection'],
-            `Got Usage using ${collection.title} collection.`
-          );
-          if (config.unencrypted) {
-            return usageData;
-          }
-          const isDev = statsCollectionConfig.server.config().get('env.dev');
-          return encryptTelemetry(usageData, isDev);
-        }
-      } catch (err) {
-        statsCollectionConfig.server.log(
-          ['debug', 'telemetry', 'collection'],
-          `Failed to collect any usage with registered collections.`
-        );
-        // swallow error to try next collection;
-      }
-    }
-
-    return [];
-  };
-}
-
-export const telemetryCollectionManager = new TelemetryCollectionManager();
diff --git a/src/legacy/core_plugins/telemetry/server/plugin.ts b/src/legacy/core_plugins/telemetry/server/plugin.ts
deleted file mode 100644
index 0b9f0526988c8..0000000000000
--- a/src/legacy/core_plugins/telemetry/server/plugin.ts
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import {
-  CoreSetup,
-  PluginInitializerContext,
-  ISavedObjectsRepository,
-  CoreStart,
-} from 'src/core/server';
-import { Server } from 'hapi';
-import { registerRoutes } from './routes';
-import { registerCollection } from './telemetry_collection';
-import { UsageCollectionSetup } from '../../../../plugins/usage_collection/server';
-import {
-  registerUiMetricUsageCollector,
-  registerTelemetryUsageCollector,
-  registerLocalizationUsageCollector,
-  registerTelemetryPluginUsageCollector,
-  registerManagementUsageCollector,
-  registerApplicationUsageCollector,
-} from './collectors';
-
-export interface PluginsSetup {
-  usageCollection: UsageCollectionSetup;
-}
-
-export class TelemetryPlugin {
-  private readonly currentKibanaVersion: string;
-  private savedObjectsClient?: ISavedObjectsRepository;
-
-  constructor(initializerContext: PluginInitializerContext) {
-    this.currentKibanaVersion = initializerContext.env.packageInfo.version;
-  }
-
-  public setup(core: CoreSetup, { usageCollection }: PluginsSetup, server: Server) {
-    const currentKibanaVersion = this.currentKibanaVersion;
-
-    registerCollection();
-    registerRoutes({ core, currentKibanaVersion, server });
-
-    const getSavedObjectsClient = () => this.savedObjectsClient;
-
-    registerTelemetryPluginUsageCollector(usageCollection, server);
-    registerLocalizationUsageCollector(usageCollection, server);
-    registerTelemetryUsageCollector(usageCollection, server);
-    registerUiMetricUsageCollector(usageCollection, getSavedObjectsClient);
-    registerManagementUsageCollector(usageCollection, server);
-    registerApplicationUsageCollector(usageCollection, getSavedObjectsClient);
-  }
-
-  public start({ savedObjects }: CoreStart) {
-    this.savedObjectsClient = savedObjects.createInternalRepository();
-  }
-}
diff --git a/src/legacy/core_plugins/telemetry/server/routes/telemetry_opt_in.ts b/src/legacy/core_plugins/telemetry/server/routes/telemetry_opt_in.ts
deleted file mode 100644
index ccbc28f6cbadb..0000000000000
--- a/src/legacy/core_plugins/telemetry/server/routes/telemetry_opt_in.ts
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import Joi from 'joi';
-import moment from 'moment';
-import { boomify } from 'boom';
-import { CoreSetup } from 'src/core/server';
-import { Legacy } from 'kibana';
-import { getTelemetryAllowChangingOptInStatus } from '../telemetry_config';
-import { sendTelemetryOptInStatus } from './telemetry_opt_in_stats';
-
-import {
-  TelemetrySavedObjectAttributes,
-  updateTelemetrySavedObject,
-} from '../telemetry_repository';
-
-interface RegisterOptInRoutesParams {
-  core: CoreSetup;
-  currentKibanaVersion: string;
-  server: Legacy.Server;
-}
-
-export function registerTelemetryOptInRoutes({
-  server,
-  currentKibanaVersion,
-}: RegisterOptInRoutesParams) {
-  server.route({
-    method: 'POST',
-    path: '/api/telemetry/v2/optIn',
-    options: {
-      validate: {
-        payload: Joi.object({
-          enabled: Joi.bool().required(),
-        }),
-      },
-    },
-    handler: async (req: any, h: any) => {
-      try {
-        const newOptInStatus = req.payload.enabled;
-        const attributes: TelemetrySavedObjectAttributes = {
-          enabled: newOptInStatus,
-          lastVersionChecked: currentKibanaVersion,
-        };
-        const config = req.server.config();
-        const savedObjectsClient = req.getSavedObjectsClient();
-        const configTelemetryAllowChangingOptInStatus = config.get(
-          'telemetry.allowChangingOptInStatus'
-        );
-
-        const allowChangingOptInStatus = getTelemetryAllowChangingOptInStatus({
-          telemetrySavedObject: savedObjectsClient,
-          configTelemetryAllowChangingOptInStatus,
-        });
-        if (!allowChangingOptInStatus) {
-          return h.response({ error: 'Not allowed to change Opt-in Status.' }).code(400);
-        }
-
-        const sendUsageFrom = config.get('telemetry.sendUsageFrom');
-        if (sendUsageFrom === 'server') {
-          const optInStatusUrl = config.get('telemetry.optInStatusUrl');
-          await sendTelemetryOptInStatus(
-            { optInStatusUrl, newOptInStatus },
-            {
-              start: moment()
-                .subtract(20, 'minutes')
-                .toISOString(),
-              end: moment().toISOString(),
-              server: req.server,
-              unencrypted: false,
-            }
-          );
-        }
-
-        await updateTelemetrySavedObject(savedObjectsClient, attributes);
-        return h.response({}).code(200);
-      } catch (err) {
-        return boomify(err);
-      }
-    },
-  });
-}
diff --git a/src/legacy/core_plugins/telemetry/server/routes/telemetry_usage_stats.ts b/src/legacy/core_plugins/telemetry/server/routes/telemetry_usage_stats.ts
deleted file mode 100644
index ee3241b0dc2ea..0000000000000
--- a/src/legacy/core_plugins/telemetry/server/routes/telemetry_usage_stats.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import Joi from 'joi';
-import { boomify } from 'boom';
-import { Legacy } from 'kibana';
-import { telemetryCollectionManager } from '../collection_manager';
-
-export function registerTelemetryUsageStatsRoutes(server: Legacy.Server) {
-  server.route({
-    method: 'POST',
-    path: '/api/telemetry/v2/clusters/_stats',
-    options: {
-      validate: {
-        payload: Joi.object({
-          unencrypted: Joi.bool(),
-          timeRange: Joi.object({
-            min: Joi.date().required(),
-            max: Joi.date().required(),
-          }).required(),
-        }),
-      },
-    },
-    handler: async (req: any, h: any) => {
-      const config = req.server.config();
-      const start = req.payload.timeRange.min;
-      const end = req.payload.timeRange.max;
-      const unencrypted = req.payload.unencrypted;
-
-      try {
-        return await telemetryCollectionManager.getStats({
-          unencrypted,
-          server,
-          req,
-          start,
-          end,
-        });
-      } catch (err) {
-        const isDev = config.get('env.dev');
-        if (isDev) {
-          // don't ignore errors when running in dev mode
-          return boomify(err, { statusCode: err.status || 500 });
-        } else {
-          const statusCode = unencrypted && err.status === 403 ? 403 : 200;
-          // ignore errors and return empty set
-          return h.response([]).code(statusCode);
-        }
-      }
-    },
-  });
-}
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/replace_injected_vars.ts b/src/legacy/core_plugins/telemetry/server/telemetry_config/replace_injected_vars.ts
deleted file mode 100644
index f09ee8623afac..0000000000000
--- a/src/legacy/core_plugins/telemetry/server/telemetry_config/replace_injected_vars.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { getTelemetrySavedObject } from '../telemetry_repository';
-import { getTelemetryOptIn } from './get_telemetry_opt_in';
-import { getTelemetrySendUsageFrom } from './get_telemetry_send_usage_from';
-import { getTelemetryAllowChangingOptInStatus } from './get_telemetry_allow_changing_opt_in_status';
-import { getNotifyUserAboutOptInDefault } from './get_telemetry_notify_user_about_optin_default';
-
-export async function replaceTelemetryInjectedVars(request: any, server: any) {
-  const config = server.config();
-  const configTelemetrySendUsageFrom = config.get('telemetry.sendUsageFrom');
-  const configTelemetryOptIn = config.get('telemetry.optIn');
-  const configTelemetryAllowChangingOptInStatus = config.get('telemetry.allowChangingOptInStatus');
-  const isRequestingApplication = request.path.startsWith('/app');
-
-  // Prevent interstitial screens (such as the space selector) from prompting for telemetry
-  if (!isRequestingApplication) {
-    return {
-      telemetryOptedIn: false,
-    };
-  }
-
-  const currentKibanaVersion = config.get('pkg.version');
-  const savedObjectsClient = server.savedObjects.getScopedSavedObjectsClient(request);
-  const telemetrySavedObject = await getTelemetrySavedObject(savedObjectsClient);
-  const allowChangingOptInStatus = getTelemetryAllowChangingOptInStatus({
-    configTelemetryAllowChangingOptInStatus,
-    telemetrySavedObject,
-  });
-
-  const telemetryOptedIn = getTelemetryOptIn({
-    configTelemetryOptIn,
-    allowChangingOptInStatus,
-    telemetrySavedObject,
-    currentKibanaVersion,
-  });
-
-  const telemetrySendUsageFrom = getTelemetrySendUsageFrom({
-    configTelemetrySendUsageFrom,
-    telemetrySavedObject,
-  });
-
-  const telemetryNotifyUserAboutOptInDefault = getNotifyUserAboutOptInDefault({
-    telemetrySavedObject,
-    allowChangingOptInStatus,
-    configTelemetryOptIn,
-    telemetryOptedIn,
-  });
-
-  return {
-    telemetryOptedIn,
-    telemetrySendUsageFrom,
-    telemetryNotifyUserAboutOptInDefault,
-  };
-}
diff --git a/src/legacy/core_plugins/tile_map/public/__tests__/coordinate_maps_visualization.js b/src/legacy/core_plugins/tile_map/public/__tests__/coordinate_maps_visualization.js
index 6a08405b5b6a5..3b8a7dfbed313 100644
--- a/src/legacy/core_plugins/tile_map/public/__tests__/coordinate_maps_visualization.js
+++ b/src/legacy/core_plugins/tile_map/public/__tests__/coordinate_maps_visualization.js
@@ -19,7 +19,6 @@
 
 import expect from '@kbn/expect';
 import ngMock from 'ng_mock';
-import LogstashIndexPatternStubProvider from 'fixtures/stubbed_logstash_index_pattern';
 import { ImageComparator } from 'test_utils/image_comparator';
 import dummyESResponse from './dummy_es_response.json';
 import initial from './initial.png';
@@ -32,13 +31,11 @@ import EMS_TILES from '../../../../ui/public/vis/__tests__/map/ems_mocks/sample_
 import EMS_STYLE_ROAD_MAP_BRIGHT from '../../../../ui/public/vis/__tests__/map/ems_mocks/sample_style_bright';
 import EMS_STYLE_ROAD_MAP_DESATURATED from '../../../../ui/public/vis/__tests__/map/ems_mocks/sample_style_desaturated';
 import EMS_STYLE_DARK_MAP from '../../../../ui/public/vis/__tests__/map/ems_mocks/sample_style_dark';
-import {
-  setup as visualizationsSetup,
-  start as visualizationsStart,
-} from '../../../visualizations/public/np_ready/public/legacy';
+import { setup as visualizationsSetup } from '../../../visualizations/public/np_ready/public/legacy';
 
 import { createTileMapVisualization } from '../tile_map_visualization';
 import { createTileMapTypeDefinition } from '../tile_map_type';
+import { ExprVis } from '../../../visualizations/public/np_ready/public/expressions/vis';
 
 function mockRawData() {
   const stack = [dummyESResponse];
@@ -67,7 +64,6 @@ let visRegComplete = false;
 describe('CoordinateMapsVisualizationTest', function() {
   let domNode;
   let CoordinateMapsVisualization;
-  let indexPattern;
   let vis;
   let dependencies;
 
@@ -92,7 +88,6 @@ describe('CoordinateMapsVisualizationTest', function() {
       }
 
       CoordinateMapsVisualization = createTileMapVisualization(dependencies);
-      indexPattern = Private(LogstashIndexPatternStubProvider);
 
       getManifestStub = serviceSettings.__debugStubManifestCalls(async url => {
         //simulate network calls
@@ -124,7 +119,7 @@ describe('CoordinateMapsVisualizationTest', function() {
       setupDOM('512px', '512px');
 
       imageComparator = new ImageComparator();
-      vis = visualizationsStart.createVis(indexPattern, {
+      vis = new ExprVis({
         type: 'tile_map',
       });
       vis.params = {
diff --git a/src/legacy/core_plugins/tile_map/public/base_maps_visualization.js b/src/legacy/core_plugins/tile_map/public/base_maps_visualization.js
index ebb0c24243263..d38159c91ef9f 100644
--- a/src/legacy/core_plugins/tile_map/public/base_maps_visualization.js
+++ b/src/legacy/core_plugins/tile_map/public/base_maps_visualization.js
@@ -63,28 +63,21 @@ export function BaseMapsVisualizationProvider(serviceSettings) {
      * @param status
      * @return {Promise}
      */
-    async render(esResponse, visParams, status) {
+    async render(esResponse, visParams) {
       if (!this._kibanaMap) {
         //the visualization has been destroyed;
         return;
       }
 
       await this._mapIsLoaded;
-
-      if (status.resize) {
-        this._kibanaMap.resize();
-      }
-      if (status.params || status.aggs) {
-        this._params = visParams;
-        await this._updateParams();
-      }
+      this._kibanaMap.resize();
+      this._params = visParams;
+      await this._updateParams();
 
       if (this._hasESResponseChanged(esResponse)) {
         await this._updateData(esResponse);
       }
-      if (status.uiState) {
-        this._kibanaMap.useUiStateFromVisualization(this.vis);
-      }
+      this._kibanaMap.useUiStateFromVisualization(this.vis);
 
       await this._whenBaseLayerIsLoaded();
     }
diff --git a/src/legacy/core_plugins/tile_map/public/tile_map_type.js b/src/legacy/core_plugins/tile_map/public/tile_map_type.js
index 0809bf6ecbab6..39d39a4c8f8fc 100644
--- a/src/legacy/core_plugins/tile_map/public/tile_map_type.js
+++ b/src/legacy/core_plugins/tile_map/public/tile_map_type.js
@@ -23,7 +23,6 @@ import { i18n } from '@kbn/i18n';
 import { convertToGeoJson } from 'ui/vis/map/convert_to_geojson';
 
 import { Schemas } from '../../vis_default_editor/public';
-import { Status } from '../../visualizations/public';
 import { createTileMapVisualization } from './tile_map_visualization';
 import { TileMapOptions } from './components/tile_map_options';
 import { MapTypes } from './map_types';
@@ -57,7 +56,6 @@ export function createTileMapTypeDefinition(dependencies) {
         wms: uiSettings.get('visualization:tileMap:WMSdefaults'),
       },
     },
-    requiresUpdateStatus: [Status.AGGS, Status.PARAMS, Status.RESIZE, Status.UI_STATE],
     requiresPartialRows: true,
     visualization: CoordinateMapsVisualization,
     responseHandler: convertToGeoJson,
@@ -143,21 +141,20 @@ export function createTileMapTypeDefinition(dependencies) {
         },
       ]),
     },
-    setup: async savedVis => {
-      const vis = savedVis.vis;
+    setup: async vis => {
       let tmsLayers;
 
       try {
         tmsLayers = await serviceSettings.getTMSServices();
       } catch (e) {
-        return savedVis;
+        return vis;
       }
 
       vis.type.editorConfig.collections.tmsLayers = tmsLayers;
       if (!vis.params.wms.selectedTmsLayer && tmsLayers.length) {
         vis.params.wms.selectedTmsLayer = tmsLayers[0];
       }
-      return savedVis;
+      return vis;
     },
   };
 }
diff --git a/src/legacy/core_plugins/timelion/index.ts b/src/legacy/core_plugins/timelion/index.ts
index 9e2bfd4023bd9..41a15dc4e0186 100644
--- a/src/legacy/core_plugins/timelion/index.ts
+++ b/src/legacy/core_plugins/timelion/index.ts
@@ -29,7 +29,7 @@ const experimentalLabel = i18n.translate('timelion.uiSettings.experimentalLabel'
 
 const timelionPluginInitializer: LegacyPluginInitializer = ({ Plugin }: LegacyPluginApi) =>
   new Plugin({
-    require: ['kibana', 'elasticsearch', 'data'],
+    require: ['kibana', 'elasticsearch'],
     config(Joi: any) {
       return Joi.object({
         enabled: Joi.boolean().default(true),
diff --git a/src/legacy/core_plugins/timelion/public/app.js b/src/legacy/core_plugins/timelion/public/app.js
index a9d678cfea79c..a50f8a2cd3e8d 100644
--- a/src/legacy/core_plugins/timelion/public/app.js
+++ b/src/legacy/core_plugins/timelion/public/app.js
@@ -24,10 +24,10 @@ import { i18n } from '@kbn/i18n';
 import { capabilities } from 'ui/capabilities';
 import { docTitle } from 'ui/doc_title';
 import { fatalError, toastNotifications } from 'ui/notify';
-import { timezoneProvider } from 'ui/vis/lib/timezone';
 import { timefilter } from 'ui/timefilter';
 import { npStart } from 'ui/new_platform';
 import { getSavedSheetBreadcrumbs, getCreateBreadcrumbs } from './breadcrumbs';
+import { getTimezone } from '../../vis_type_timelion/public';
 
 import 'uiExports/savedObjectTypes';
 
@@ -38,7 +38,6 @@ import 'ui/directives/input_focus';
 import './directives/saved_object_finder';
 import 'ui/directives/listen';
 import './directives/saved_object_save_as_checkbox';
-import '../../data/public/legacy';
 import './services/saved_sheet_register';
 
 import rootTemplate from 'plugins/timelion/index.html';
@@ -116,8 +115,7 @@ app.controller('timelion', function(
   $timeout,
   AppState,
   config,
-  kbnUrl,
-  Private
+  kbnUrl
 ) {
   // Keeping this at app scope allows us to keep the current page when the user
   // switches to say, the timepicker.
@@ -128,7 +126,7 @@ app.controller('timelion', function(
   timefilter.enableTimeRangeSelector();
 
   const savedVisualizations = visualizations.savedVisualizationsLoader;
-  const timezone = Private(timezoneProvider)();
+  const timezone = getTimezone(config);
 
   const defaultExpression = '.es(*)';
   const savedSheet = $route.current.locals.savedSheet;
diff --git a/src/legacy/core_plugins/ui_metric/index.ts b/src/legacy/core_plugins/ui_metric/index.ts
index 5a4a0ebf1a632..2e5be3d7b0a39 100644
--- a/src/legacy/core_plugins/ui_metric/index.ts
+++ b/src/legacy/core_plugins/ui_metric/index.ts
@@ -25,9 +25,6 @@ export default function(kibana: any) {
     id: 'ui_metric',
     require: ['kibana', 'elasticsearch'],
     publicDir: resolve(__dirname, 'public'),
-    uiExports: {
-      mappings: require('./mappings.json'),
-    },
     init() {},
   });
 }
diff --git a/src/legacy/core_plugins/ui_metric/mappings.json b/src/legacy/core_plugins/ui_metric/mappings.json
deleted file mode 100644
index 113e37e60e48b..0000000000000
--- a/src/legacy/core_plugins/ui_metric/mappings.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "ui-metric": {
-    "properties": {
-      "count": {
-        "type": "integer"
-      }
-    }
-  }
-}
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg.test.tsx
index 7e715be25bff3..feb5b3caa023b 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg.test.tsx
@@ -22,12 +22,12 @@ import { mount, shallow } from 'enzyme';
 import { act } from 'react-dom/test-utils';
 
 import { IndexPattern, IAggType, AggGroupNames } from 'src/plugins/data/public';
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 
 import { DefaultEditorAgg, DefaultEditorAggProps } from './agg';
 import { DefaultEditorAggParams } from './agg_params';
 import { AGGS_ACTION_KEYS } from './agg_group_state';
 import { Schema } from '../schemas';
+import { EditorVisState } from './sidebar/state/reducers';
 
 jest.mock('./agg_params', () => ({
   DefaultEditorAggParams: () => null,
@@ -67,7 +67,7 @@ describe('DefaultEditorAgg component', () => {
       isLastBucket: false,
       isRemovable: false,
       metricAggs: [],
-      state: { params: {} } as VisState,
+      state: { params: {} } as EditorVisState,
       setAggParamValue,
       setStateParamValue,
       onAggTypeChange: () => {},
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_common_props.ts b/src/legacy/core_plugins/vis_default_editor/public/components/agg_common_props.ts
index ec92f511b6eee..3aae10879138a 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_common_props.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_common_props.ts
@@ -17,9 +17,10 @@
  * under the License.
  */
 
-import { VisState, VisParams } from 'src/legacy/core_plugins/visualizations/public';
+import { VisParams } from 'src/legacy/core_plugins/visualizations/public';
 import { IAggType, IAggConfig, IAggGroupNames } from 'src/plugins/data/public';
 import { Schema } from '../schemas';
+import { EditorVisState } from './sidebar/state/reducers';
 
 type AggId = IAggConfig['id'];
 type AggParams = IAggConfig['params'];
@@ -31,7 +32,7 @@ export interface DefaultEditorCommonProps {
   formIsTouched: boolean;
   groupName: IAggGroupNames;
   metricAggs: IAggConfig[];
-  state: VisState;
+  state: EditorVisState;
   setAggParamValue: <T extends keyof AggParams>(
     aggId: AggId,
     paramName: T,
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.test.tsx
index 63f5e696c99f4..5d02f0a2c759e 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.test.tsx
@@ -20,12 +20,12 @@
 import React from 'react';
 import { mount, shallow } from 'enzyme';
 import { act } from 'react-dom/test-utils';
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import { IAggConfigs, IAggConfig } from 'src/plugins/data/public';
 import { DefaultEditorAggGroup, DefaultEditorAggGroupProps } from './agg_group';
 import { DefaultEditorAgg } from './agg';
 import { DefaultEditorAggAdd } from './agg_add';
 import { Schema } from '../schemas';
+import { EditorVisState } from './sidebar/state/reducers';
 
 jest.mock('@elastic/eui', () => ({
   EuiTitle: 'eui-title',
@@ -93,8 +93,8 @@ describe('DefaultEditorAgg component', () => {
       metricAggs: [],
       groupName: 'metrics',
       state: {
-        aggs,
-      } as VisState,
+        data: { aggs },
+      } as EditorVisState,
       schemas: [
         {
           name: 'metrics',
@@ -147,8 +147,8 @@ describe('DefaultEditorAgg component', () => {
     });
 
     expect(reorderAggs).toHaveBeenCalledWith(
-      defaultProps.state.aggs.aggs[0],
-      defaultProps.state.aggs.aggs[1]
+      defaultProps.state.data.aggs!.aggs[0],
+      defaultProps.state.data.aggs!.aggs[1]
     );
   });
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.tsx
index 600612f2cf9d8..08b69ef37f528 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_group.tsx
@@ -73,9 +73,10 @@ function DefaultEditorAggGroup({
   const schemaNames = getSchemasByGroup(schemas, groupName).map(s => s.name);
   const group: IAggConfig[] = useMemo(
     () =>
-      state.aggs.aggs.filter((agg: IAggConfig) => agg.schema && schemaNames.includes(agg.schema)) ||
-      [],
-    [state.aggs.aggs, schemaNames]
+      state.data.aggs!.aggs.filter(
+        (agg: IAggConfig) => agg.schema && schemaNames.includes(agg.schema)
+      ) || [],
+    [state.data.aggs, schemaNames]
   );
 
   const stats = {
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_param_props.ts b/src/legacy/core_plugins/vis_default_editor/public/components/agg_param_props.ts
index 7c2852798b403..aec332e8674d7 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_param_props.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_param_props.ts
@@ -18,10 +18,10 @@
  */
 
 import { IAggConfig, AggParam, IndexPatternField } from 'src/plugins/data/public';
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import { ComboBoxGroupedOptions } from '../utils';
 import { EditorConfig } from './utils';
 import { Schema } from '../schemas';
+import { EditorVisState } from './sidebar/state/reducers';
 
 // NOTE: we cannot export the interface with export { InterfaceName }
 // as there is currently a bug on babel typescript transform plugin for it
@@ -35,7 +35,7 @@ export interface AggParamCommonProps<T, P = AggParam> {
   formIsTouched: boolean;
   indexedFields?: ComboBoxGroupedOptions<IndexPatternField>;
   showValidation: boolean;
-  state: VisState;
+  state: EditorVisState;
   value?: T;
   metricAggs: IAggConfig[];
   schemas: Schema[];
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.test.tsx
index cd6486b6a1532..1c49ebf40640e 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params.test.tsx
@@ -20,7 +20,6 @@
 import React from 'react';
 import { mount } from 'enzyme';
 
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import { IndexPattern, IAggConfig, AggGroupNames } from 'src/plugins/data/public';
 import {
   DefaultEditorAggParams as PureDefaultEditorAggParams,
@@ -28,6 +27,7 @@ import {
 } from './agg_params';
 import { KibanaContextProvider } from '../../../../../plugins/kibana_react/public';
 import { dataPluginMock } from '../../../../../plugins/data/public/mocks';
+import { EditorVisState } from './sidebar/state/reducers';
 
 const mockEditorConfig = {
   useNormalizedEsInterval: { hidden: false, fixedValue: false },
@@ -108,7 +108,7 @@ describe('DefaultEditorAggParams component', () => {
       formIsTouched: false,
       indexPattern: {} as IndexPattern,
       metricAggs: [],
-      state: {} as VisState,
+      state: {} as EditorVisState,
       setAggParamValue,
       onAggTypeChange,
       setTouched,
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.test.ts b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.test.ts
index f2ebbdc87a60a..bed2561341737 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.test.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.test.ts
@@ -25,7 +25,6 @@ import {
   IndexPattern,
   IndexPatternField,
 } from 'src/plugins/data/public';
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import {
   getAggParamsToRender,
   getAggTypeOptions,
@@ -34,6 +33,7 @@ import {
 import { FieldParamEditor, OrderByParamEditor } from './controls';
 import { EditorConfig } from './utils';
 import { Schema } from '../schemas';
+import { EditorVisState } from './sidebar/state/reducers';
 
 jest.mock('../utils', () => ({
   groupAndSortBy: jest.fn(() => ['indexedFields']),
@@ -58,7 +58,7 @@ describe('DefaultEditorAggParams helpers', () => {
         hideCustomLabel: true,
       } as Schema,
     ];
-    const state = {} as VisState;
+    const state = {} as EditorVisState;
     const metricAggs: IAggConfig[] = [];
     const emptyParams = {
       basic: [],
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.ts b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.ts
index e07bf81697579..10590e1a59f4a 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/agg_params_helper.ts
@@ -28,7 +28,6 @@ import {
   IndexPattern,
   IndexPatternField,
 } from 'src/plugins/data/public';
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import { groupAndSortBy, ComboBoxGroupedOptions } from '../utils';
 import { AggTypeState, AggParamsState } from './agg_params_state';
 import { AggParamEditorProps } from './agg_param_props';
@@ -36,12 +35,13 @@ import { aggParamsMap } from './agg_params_map';
 import { EditorConfig } from './utils';
 import { Schema, getSchemaByName } from '../schemas';
 import { search } from '../../../../../plugins/data/public';
+import { EditorVisState } from './sidebar/state/reducers';
 
 interface ParamInstanceBase {
   agg: IAggConfig;
   editorConfig: EditorConfig;
   metricAggs: IAggConfig[];
-  state: VisState;
+  state: EditorVisState;
   schemas: Schema[];
   hideCustomLabel?: boolean;
 }
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.test.tsx
index 1043431475494..b33149dc51a19 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/field.test.tsx
@@ -23,9 +23,9 @@ import { mount, shallow, ReactWrapper } from 'enzyme';
 import { EuiComboBoxProps, EuiComboBox } from '@elastic/eui';
 
 import { IAggConfig, IndexPatternField } from 'src/plugins/data/public';
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import { ComboBoxGroupedOptions } from '../../utils';
 import { FieldParamEditor, FieldParamEditorProps } from './field';
+import { EditorVisState } from '../sidebar/state/reducers';
 
 function callComboBoxOnChange(comp: ReactWrapper, value: any = []) {
   const comboBoxProps = comp.find(EuiComboBox).props() as EuiComboBoxProps<any>;
@@ -78,7 +78,7 @@ describe('FieldParamEditor component', () => {
       setValue,
       setValidity,
       setTouched,
-      state: {} as VisState,
+      state: {} as EditorVisState,
       metricAggs: [] as IAggConfig[],
       schemas: [],
     };
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/percentiles.test.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/controls/percentiles.test.tsx
index 76eb12af8c4e2..82166440cf8e8 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/percentiles.test.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/percentiles.test.tsx
@@ -20,9 +20,9 @@
 import React from 'react';
 import { AggParamEditorProps } from '../agg_param_props';
 import { IAggConfig } from 'src/plugins/data/public';
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import { mount } from 'enzyme';
 import { PercentilesEditor } from './percentiles';
+import { EditorVisState } from '../sidebar/state/reducers';
 
 describe('PercentilesEditor component', () => {
   let setValue: jest.Mock;
@@ -45,7 +45,7 @@ describe('PercentilesEditor component', () => {
       setValue,
       setValidity,
       setTouched,
-      state: {} as VisState,
+      state: {} as EditorVisState,
       metricAggs: [] as IAggConfig[],
       schemas: [],
     };
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/controls/test_utils.ts b/src/legacy/core_plugins/vis_default_editor/public/components/controls/test_utils.ts
index b816e61cce355..7c7431015d175 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/controls/test_utils.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/controls/test_utils.ts
@@ -17,9 +17,9 @@
  * under the License.
  */
 
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import { IAggConfig, AggParam } from 'src/plugins/data/public';
 import { EditorConfig } from '../utils';
+import { EditorVisState } from '../sidebar/state/reducers';
 
 export const aggParamCommonPropsMock = {
   agg: {} as IAggConfig,
@@ -27,7 +27,7 @@ export const aggParamCommonPropsMock = {
   editorConfig: {} as EditorConfig,
   formIsTouched: false,
   metricAggs: [] as IAggConfig[],
-  state: {} as VisState,
+  state: {} as EditorVisState,
   showValidation: false,
   schemas: [],
 };
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/data_tab.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/data_tab.tsx
index 6f92c27e90ec1..a6a1980210be4 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/data_tab.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/data_tab.tsx
@@ -21,7 +21,6 @@ import React, { useMemo, useCallback } from 'react';
 import { findLast } from 'lodash';
 import { EuiSpacer } from '@elastic/eui';
 
-import { VisState } from 'src/legacy/core_plugins/visualizations/public';
 import {
   AggGroupNames,
   IAggConfig,
@@ -40,6 +39,7 @@ import {
 } from './state';
 import { AddSchema, ReorderAggs, DefaultEditorAggCommonProps } from '../agg_common_props';
 import { ISchemas } from '../../schemas';
+import { EditorVisState } from './state/reducers';
 
 export interface DefaultEditorDataTabProps {
   dispatch: React.Dispatch<EditorAction>;
@@ -47,7 +47,7 @@ export interface DefaultEditorDataTabProps {
   isTabSelected: boolean;
   metricAggs: IAggConfig[];
   schemas: ISchemas;
-  state: VisState;
+  state: EditorVisState;
   setTouched(isTouched: boolean): void;
   setValidity(modelName: string, value: boolean): void;
   setStateValue: DefaultEditorAggCommonProps['setStateParamValue'];
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/sidebar.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/sidebar.tsx
index 2508ef3a55537..04c931f593e5a 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/sidebar.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/sidebar.tsx
@@ -21,6 +21,7 @@ import React, { useMemo, useState, useCallback, KeyboardEventHandler, useEffect
 import { get, isEqual } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { keyCodes, EuiButtonIcon, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import { EventEmitter } from 'events';
 
 import { Vis } from 'src/legacy/core_plugins/visualizations/public';
 import { DefaultEditorNavBar, OptionTab } from './navbar';
@@ -40,6 +41,7 @@ interface DefaultEditorSideBarProps {
   uiState: PersistedState;
   vis: Vis;
   isLinkedSearch: boolean;
+  eventEmitter: EventEmitter;
   savedSearch?: SavedSearch;
 }
 
@@ -50,14 +52,17 @@ function DefaultEditorSideBar({
   uiState,
   vis,
   isLinkedSearch,
+  eventEmitter,
   savedSearch,
 }: DefaultEditorSideBarProps) {
   const [selectedTab, setSelectedTab] = useState(optionTabs[0].name);
   const [isDirty, setDirty] = useState(false);
-  const [state, dispatch] = useEditorReducer(vis);
+  const [state, dispatch] = useEditorReducer(vis, eventEmitter);
   const { formState, setTouched, setValidity, resetValidity } = useEditorFormState();
 
-  const responseAggs = useMemo(() => state.aggs.getResponseAggs(), [state.aggs]);
+  const responseAggs = useMemo(() => (state.data.aggs ? state.data.aggs.getResponseAggs() : []), [
+    state.data.aggs,
+  ]);
   const metricSchemas = getSchemasByGroup(vis.type.schemas.all || [], AggGroupNames.Metrics).map(
     s => s.name
   );
@@ -90,17 +95,20 @@ function DefaultEditorSideBar({
   const applyChanges = useCallback(() => {
     if (formState.invalid || !isDirty) {
       setTouched(true);
-
       return;
     }
 
-    vis.setCurrentState(state);
-    vis.updateState();
-    vis.emit('dirtyStateChange', {
+    vis.setState({
+      ...vis.serialize(),
+      params: state.params,
+      data: { aggs: state.data.aggs ? (state.data.aggs.aggs.map(agg => agg.toJSON()) as any) : [] },
+    });
+    eventEmitter.emit('updateVis');
+    eventEmitter.emit('dirtyStateChange', {
       isDirty: false,
     });
     setTouched(false);
-  }, [vis, state, formState.invalid, setTouched, isDirty]);
+  }, [vis, state, formState.invalid, setTouched, isDirty, eventEmitter]);
 
   const onSubmit: KeyboardEventHandler<HTMLFormElement> = useCallback(
     event => {
@@ -122,18 +130,22 @@ function DefaultEditorSideBar({
         resetValidity();
       }
     };
-    vis.on('dirtyStateChange', changeHandler);
+    eventEmitter.on('dirtyStateChange', changeHandler);
 
-    return () => vis.off('dirtyStateChange', changeHandler);
-  }, [resetValidity, vis]);
+    return () => {
+      eventEmitter.off('dirtyStateChange', changeHandler);
+    };
+  }, [resetValidity, eventEmitter]);
 
   // subscribe on external vis changes using browser history, for example press back button
   useEffect(() => {
     const resetHandler = () => dispatch(discardChanges(vis));
-    vis.on('updateEditor', resetHandler);
+    eventEmitter.on('updateEditor', resetHandler);
 
-    return () => vis.off('updateEditor', resetHandler);
-  }, [dispatch, vis]);
+    return () => {
+      eventEmitter.off('updateEditor', resetHandler);
+    };
+  }, [dispatch, vis, eventEmitter]);
 
   const dataTabProps = {
     dispatch,
@@ -147,7 +159,7 @@ function DefaultEditorSideBar({
   };
 
   const optionTabProps = {
-    aggs: state.aggs,
+    aggs: state.data.aggs!,
     hasHistogramAgg,
     stateParams: state.params,
     vis,
@@ -173,7 +185,12 @@ function DefaultEditorSideBar({
             onKeyDownCapture={onSubmit}
           >
             {vis.type.requiresSearch && (
-              <SidebarTitle isLinkedSearch={isLinkedSearch} savedSearch={savedSearch} vis={vis} />
+              <SidebarTitle
+                isLinkedSearch={isLinkedSearch}
+                savedSearch={savedSearch}
+                vis={vis}
+                eventEmitter={eventEmitter}
+              />
             )}
 
             {optionTabs.length > 1 && (
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx
index 876404851aed4..575ad5ae2a95c 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/sidebar_title.tsx
@@ -18,6 +18,7 @@
  */
 
 import React, { useCallback, useState } from 'react';
+import { EventEmitter } from 'events';
 import {
   EuiButton,
   EuiButtonEmpty,
@@ -39,23 +40,24 @@ import { SavedSearch } from '../../../../../../plugins/discover/public';
 
 interface LinkedSearchProps {
   savedSearch: SavedSearch;
-  vis: Vis;
+  eventEmitter: EventEmitter;
 }
 
 interface SidebarTitleProps {
   isLinkedSearch: boolean;
   savedSearch?: SavedSearch;
   vis: Vis;
+  eventEmitter: EventEmitter;
 }
 
-export function LinkedSearch({ savedSearch, vis }: LinkedSearchProps) {
+export function LinkedSearch({ savedSearch, eventEmitter }: LinkedSearchProps) {
   const [showPopover, setShowPopover] = useState(false);
   const closePopover = useCallback(() => setShowPopover(false), []);
   const onClickButtonLink = useCallback(() => setShowPopover(v => !v), []);
   const onClickUnlikFromSavedSearch = useCallback(() => {
     setShowPopover(false);
-    vis.emit('unlinkFromSavedSearch');
-  }, [vis]);
+    eventEmitter.emit('unlinkFromSavedSearch');
+  }, [eventEmitter]);
 
   const linkButtonAriaLabel = i18n.translate(
     'visDefaultEditor.sidebar.savedSearch.linkButtonAriaLabel',
@@ -151,20 +153,20 @@ export function LinkedSearch({ savedSearch, vis }: LinkedSearchProps) {
   );
 }
 
-function SidebarTitle({ savedSearch, vis, isLinkedSearch }: SidebarTitleProps) {
+function SidebarTitle({ savedSearch, vis, isLinkedSearch, eventEmitter }: SidebarTitleProps) {
   return isLinkedSearch && savedSearch ? (
-    <LinkedSearch savedSearch={savedSearch} vis={vis} />
+    <LinkedSearch savedSearch={savedSearch} eventEmitter={eventEmitter} />
   ) : vis.type.options.showIndexSelection ? (
     <EuiTitle size="xs" className="visEditorSidebar__titleContainer eui-textTruncate">
       <h2
         title={i18n.translate('visDefaultEditor.sidebar.indexPatternAriaLabel', {
           defaultMessage: 'Index pattern: {title}',
           values: {
-            title: vis.indexPattern.title,
+            title: vis.data.indexPattern!.title,
           },
         })}
       >
-        {vis.indexPattern.title}
+        {vis.data.indexPattern!.title}
       </h2>
     </EuiTitle>
   ) : (
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/index.ts b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/index.ts
index 6383ac866dcfc..11cbc3f93e9d3 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/index.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/index.ts
@@ -17,20 +17,23 @@
  * under the License.
  */
 
-import { useEffect, useReducer, useCallback } from 'react';
-import { isEqual } from 'lodash';
+import { useReducer, useCallback } from 'react';
+import { EventEmitter } from 'events';
 
-import { Vis, VisState, VisParams } from 'src/legacy/core_plugins/visualizations/public';
-import { createEditorStateReducer, initEditorState } from './reducers';
+import { Vis } from 'src/legacy/core_plugins/visualizations/public';
+import { createEditorStateReducer, initEditorState, EditorVisState } from './reducers';
 import { EditorStateActionTypes } from './constants';
-import { EditorAction, updateStateParams } from './actions';
+import { EditorAction } from './actions';
 import { useKibana } from '../../../../../../../plugins/kibana_react/public';
 import { VisDefaultEditorKibanaServices } from '../../../types';
 
 export * from './editor_form_state';
 export * from './actions';
 
-export function useEditorReducer(vis: Vis): [VisState, React.Dispatch<EditorAction>] {
+export function useEditorReducer(
+  vis: Vis,
+  eventEmitter: EventEmitter
+): [EditorVisState, React.Dispatch<EditorAction>] {
   const { services } = useKibana<VisDefaultEditorKibanaServices>();
   const [state, dispatch] = useReducer(
     createEditorStateReducer(services.data.search),
@@ -38,28 +41,15 @@ export function useEditorReducer(vis: Vis): [VisState, React.Dispatch<EditorActi
     initEditorState
   );
 
-  useEffect(() => {
-    const handleVisUpdate = (params: VisParams) => {
-      if (!isEqual(params, state.params)) {
-        dispatch(updateStateParams(params));
-      }
-    };
-
-    // fires when visualization state changes, and we need to copy changes to editorState
-    vis.on('updateEditorStateParams', handleVisUpdate);
-
-    return () => vis.off('updateEditorStateParams', handleVisUpdate);
-  }, [vis, state.params]);
-
   const wrappedDispatch = useCallback(
     (action: EditorAction) => {
       dispatch(action);
 
-      vis.emit('dirtyStateChange', {
+      eventEmitter.emit('dirtyStateChange', {
         isDirty: action.type !== EditorStateActionTypes.DISCARD_CHANGES,
       });
     },
-    [vis]
+    [eventEmitter]
   );
 
   return [state, wrappedDispatch];
diff --git a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/reducers.ts b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/reducers.ts
index 67220fd9fd91b..6e5bec7c69c90 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/reducers.ts
+++ b/src/legacy/core_plugins/vis_default_editor/public/components/sidebar/state/reducers.ts
@@ -19,35 +19,45 @@
 
 import { cloneDeep } from 'lodash';
 
-import { Vis, VisState } from 'src/legacy/core_plugins/visualizations/public';
+import { Vis } from 'src/legacy/core_plugins/visualizations/public';
 import { AggGroupNames, DataPublicPluginStart } from '../../../../../../../plugins/data/public';
 import { EditorStateActionTypes } from './constants';
 import { getEnabledMetricAggsCount } from '../../agg_group_helper';
 import { EditorAction } from './actions';
 
 function initEditorState(vis: Vis) {
-  return vis.copyCurrentState(true);
+  return {
+    ...vis.clone(),
+  };
 }
 
+export type EditorVisState = Pick<Vis, 'title' | 'description' | 'type' | 'params' | 'data'>;
+
 const createEditorStateReducer = ({
   aggs: { createAggConfigs },
-}: DataPublicPluginStart['search']) => (state: VisState, action: EditorAction): VisState => {
+}: DataPublicPluginStart['search']) => (
+  state: EditorVisState,
+  action: EditorAction
+): EditorVisState => {
   switch (action.type) {
     case EditorStateActionTypes.ADD_NEW_AGG: {
       const { schema } = action.payload;
       const defaultConfig =
-        !state.aggs.aggs.find(agg => agg.schema === schema.name) && schema.defaults
+        !state.data.aggs!.aggs.find(agg => agg.schema === schema.name) && schema.defaults
           ? (schema as any).defaults.slice(0, schema.max)
           : { schema: schema.name };
-      const aggConfig = state.aggs.createAggConfig(defaultConfig, {
+      const aggConfig = state.data.aggs!.createAggConfig(defaultConfig, {
         addToAggConfigs: false,
       });
       aggConfig.brandNew = true;
-      const newAggs = [...state.aggs.aggs, aggConfig];
+      const newAggs = [...state.data.aggs!.aggs, aggConfig];
 
       return {
         ...state,
-        aggs: createAggConfigs(state.aggs.indexPattern, newAggs),
+        data: {
+          ...state.data,
+          aggs: createAggConfigs(state.data.indexPattern!, newAggs),
+        },
       };
     }
 
@@ -58,7 +68,7 @@ const createEditorStateReducer = ({
     case EditorStateActionTypes.CHANGE_AGG_TYPE: {
       const { aggId, value } = action.payload;
 
-      const newAggs = state.aggs.aggs.map(agg => {
+      const newAggs = state.data.aggs!.aggs.map(agg => {
         if (agg.id === aggId) {
           agg.type = value;
 
@@ -70,14 +80,17 @@ const createEditorStateReducer = ({
 
       return {
         ...state,
-        aggs: createAggConfigs(state.aggs.indexPattern, newAggs),
+        data: {
+          ...state.data,
+          aggs: createAggConfigs(state.data.indexPattern!, newAggs),
+        },
       };
     }
 
     case EditorStateActionTypes.SET_AGG_PARAM_VALUE: {
       const { aggId, paramName, value } = action.payload;
 
-      const newAggs = state.aggs.aggs.map(agg => {
+      const newAggs = state.data.aggs!.aggs.map(agg => {
         if (agg.id === aggId) {
           const parsedAgg = agg.toJSON();
 
@@ -95,7 +108,10 @@ const createEditorStateReducer = ({
 
       return {
         ...state,
-        aggs: createAggConfigs(state.aggs.indexPattern, newAggs),
+        data: {
+          ...state.data,
+          aggs: createAggConfigs(state.data.indexPattern!, newAggs),
+        },
       };
     }
 
@@ -113,7 +129,7 @@ const createEditorStateReducer = ({
 
     case EditorStateActionTypes.REMOVE_AGG: {
       let isMetric = false;
-      const newAggs = state.aggs.aggs.filter(({ id, schema }) => {
+      const newAggs = state.data.aggs!.aggs.filter(({ id, schema }) => {
         if (id === action.payload.aggId) {
           const schemaDef = action.payload.schemas.find(s => s.name === schema);
           if (schemaDef && schemaDef.group === AggGroupNames.Metrics) {
@@ -136,26 +152,36 @@ const createEditorStateReducer = ({
 
       return {
         ...state,
-        aggs: createAggConfigs(state.aggs.indexPattern, newAggs),
+        data: {
+          ...state.data,
+          aggs: createAggConfigs(state.data.indexPattern!, newAggs),
+        },
       };
     }
 
     case EditorStateActionTypes.REORDER_AGGS: {
       const { sourceAgg, destinationAgg } = action.payload;
-      const destinationIndex = state.aggs.aggs.indexOf(destinationAgg);
-      const newAggs = [...state.aggs.aggs];
-      newAggs.splice(destinationIndex, 0, newAggs.splice(state.aggs.aggs.indexOf(sourceAgg), 1)[0]);
+      const destinationIndex = state.data.aggs!.aggs.indexOf(destinationAgg);
+      const newAggs = [...state.data.aggs!.aggs];
+      newAggs.splice(
+        destinationIndex,
+        0,
+        newAggs.splice(state.data.aggs!.aggs.indexOf(sourceAgg), 1)[0]
+      );
 
       return {
         ...state,
-        aggs: createAggConfigs(state.aggs.indexPattern, newAggs),
+        data: {
+          ...state.data,
+          aggs: createAggConfigs(state.data.indexPattern!, newAggs),
+        },
       };
     }
 
     case EditorStateActionTypes.TOGGLE_ENABLED_AGG: {
       const { aggId, enabled } = action.payload;
 
-      const newAggs = state.aggs.aggs.map(agg => {
+      const newAggs = state.data.aggs!.aggs.map(agg => {
         if (agg.id === aggId) {
           const parsedAgg = agg.toJSON();
 
@@ -170,7 +196,10 @@ const createEditorStateReducer = ({
 
       return {
         ...state,
-        aggs: createAggConfigs(state.aggs.indexPattern, newAggs),
+        data: {
+          ...state.data,
+          aggs: createAggConfigs(state.data.indexPattern!, newAggs),
+        },
       };
     }
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/default_editor.tsx b/src/legacy/core_plugins/vis_default_editor/public/default_editor.tsx
index fa3213d244e7e..b504dfd6a55e9 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/default_editor.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/default_editor.tsx
@@ -20,10 +20,6 @@
 import React, { useEffect, useRef, useState, useCallback } from 'react';
 
 import { EditorRenderProps } from '../../kibana/public/visualize/np_ready/types';
-import {
-  VisualizeEmbeddableContract as VisualizeEmbeddable,
-  VisualizeEmbeddableFactoryContract as VisualizeEmbeddableFactory,
-} from '../../visualizations/public/';
 import { PanelsContainer, Panel } from '../../../../plugins/kibana_react/public';
 
 import './vis_type_agg_filter';
@@ -32,68 +28,44 @@ import { DefaultEditorControllerState } from './default_editor_controller';
 import { getInitialWidth } from './editor_size';
 
 function DefaultEditor({
-  embeddable,
-  savedObj,
+  vis,
   uiState,
   timeRange,
   filters,
-  appState,
   optionTabs,
   query,
+  embeddableHandler,
+  eventEmitter,
   linked,
+  savedSearch,
 }: DefaultEditorControllerState & Omit<EditorRenderProps, 'data' | 'core'>) {
   const visRef = useRef<HTMLDivElement>(null);
-  const visHandler = useRef<VisualizeEmbeddable | null>(null);
   const [isCollapsed, setIsCollapsed] = useState(false);
-  const [factory, setFactory] = useState<VisualizeEmbeddableFactory | null>(null);
-  const { vis, savedSearch } = savedObj;
 
   const onClickCollapse = useCallback(() => {
     setIsCollapsed(value => !value);
   }, []);
 
   useEffect(() => {
-    async function visualize() {
-      if (!visRef.current || (!visHandler.current && factory)) {
-        return;
-      }
-
-      if (!visHandler.current) {
-        const embeddableFactory = embeddable.getEmbeddableFactory(
-          'visualization'
-        ) as VisualizeEmbeddableFactory;
-        setFactory(embeddableFactory);
-
-        visHandler.current = (await embeddableFactory.createFromObject(savedObj, {
-          // should be look through createFromObject interface again because of "id" param
-          id: '',
-          uiState,
-          appState,
-          timeRange,
-          filters,
-          query,
-        })) as VisualizeEmbeddable;
-
-        visHandler.current.render(visRef.current);
-      } else {
-        visHandler.current.updateInput({
-          timeRange,
-          filters,
-          query,
-        });
-      }
+    if (!visRef.current) {
+      return;
     }
 
-    visualize();
-  }, [uiState, savedObj, timeRange, filters, appState, query, factory, embeddable]);
+    embeddableHandler.render(visRef.current);
+    setTimeout(() => {
+      eventEmitter.emit('apply');
+    });
+
+    return () => embeddableHandler.destroy();
+  }, [embeddableHandler, eventEmitter]);
 
   useEffect(() => {
-    return () => {
-      if (visHandler.current) {
-        visHandler.current.destroy();
-      }
-    };
-  }, []);
+    embeddableHandler.updateInput({
+      timeRange,
+      filters,
+      query,
+    });
+  }, [embeddableHandler, timeRange, filters, query]);
 
   const editorInitialWidth = getInitialWidth(vis.type.editorConfig.defaultSize);
 
@@ -120,6 +92,7 @@ function DefaultEditor({
           uiState={uiState}
           isLinkedSearch={linked}
           savedSearch={savedSearch}
+          eventEmitter={eventEmitter}
         />
       </Panel>
     </PanelsContainer>
diff --git a/src/legacy/core_plugins/vis_default_editor/public/default_editor_controller.tsx b/src/legacy/core_plugins/vis_default_editor/public/default_editor_controller.tsx
index db910604eddd1..13fcabd799959 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/default_editor_controller.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/default_editor_controller.tsx
@@ -21,18 +21,22 @@ import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { i18n } from '@kbn/i18n';
 import { I18nProvider } from '@kbn/i18n/react';
+import { EventEmitter } from 'events';
 
 import { EditorRenderProps } from 'src/legacy/core_plugins/kibana/public/visualize/np_ready/types';
-import { VisSavedObject } from 'src/legacy/core_plugins/visualizations/public/';
+import { Vis } from 'src/legacy/core_plugins/visualizations/public/';
 import { Storage } from '../../../../plugins/kibana_utils/public';
 import { KibanaContextProvider } from '../../../../plugins/kibana_react/public';
 import { DefaultEditor } from './default_editor';
 import { DefaultEditorDataTab, OptionTab } from './components/sidebar';
+import { VisualizeEmbeddable } from '../../visualizations/public/np_ready/public/embeddable';
 
 const localStorage = new Storage(window.localStorage);
 
 export interface DefaultEditorControllerState {
-  savedObj: VisSavedObject;
+  vis: Vis;
+  eventEmitter: EventEmitter;
+  embeddableHandler: VisualizeEmbeddable;
   optionTabs: OptionTab[];
 }
 
@@ -40,9 +44,9 @@ class DefaultEditorController {
   private el: HTMLElement;
   private state: DefaultEditorControllerState;
 
-  constructor(el: HTMLElement, savedObj: VisSavedObject) {
+  constructor(el: HTMLElement, vis: Vis, eventEmitter: EventEmitter, embeddableHandler: any) {
     this.el = el;
-    const { type: visType } = savedObj.vis;
+    const { type: visType } = vis;
 
     const optionTabs = [
       ...(visType.schemas.buckets || visType.schemas.metrics
@@ -71,8 +75,10 @@ class DefaultEditorController {
     ];
 
     this.state = {
-      savedObj,
+      vis,
       optionTabs,
+      eventEmitter,
+      embeddableHandler,
     };
   }
 
diff --git a/src/legacy/core_plugins/vis_default_editor/public/vis_options_props.tsx b/src/legacy/core_plugins/vis_default_editor/public/vis_options_props.tsx
index 2e8f20946c73a..3239e871a2465 100644
--- a/src/legacy/core_plugins/vis_default_editor/public/vis_options_props.tsx
+++ b/src/legacy/core_plugins/vis_default_editor/public/vis_options_props.tsx
@@ -17,8 +17,8 @@
  * under the License.
  */
 
+import { PersistedState } from 'src/plugins/visualizations/public';
 import { IAggConfigs } from 'src/plugins/data/public';
-import { PersistedState } from '../../../../plugins/visualizations/public';
 import { Vis } from '../../visualizations/public';
 
 export interface VisOptionsProps<VisParamType = unknown> {
diff --git a/src/legacy/core_plugins/vis_type_markdown/public/markdown_vis_controller.test.tsx b/src/legacy/core_plugins/vis_type_markdown/public/markdown_vis_controller.test.tsx
index 5bcb2961c42de..103879cb6e6df 100644
--- a/src/legacy/core_plugins/vis_type_markdown/public/markdown_vis_controller.test.tsx
+++ b/src/legacy/core_plugins/vis_type_markdown/public/markdown_vis_controller.test.tsx
@@ -21,11 +21,6 @@ import React from 'react';
 import { render, mount } from 'enzyme';
 import { MarkdownVisWrapper } from './markdown_vis_controller';
 
-// We need Markdown to do these tests, so mock data plugin
-jest.mock('../../data/public/legacy', () => {
-  return {};
-});
-
 describe('markdown vis controller', () => {
   it('should set html from markdown params', () => {
     const vis = {
diff --git a/src/legacy/core_plugins/vis_type_metric/public/components/metric_vis_component.test.tsx b/src/legacy/core_plugins/vis_type_metric/public/components/metric_vis_component.test.tsx
index 6a466c9cd0211..7ba4fe017522d 100644
--- a/src/legacy/core_plugins/vis_type_metric/public/components/metric_vis_component.test.tsx
+++ b/src/legacy/core_plugins/vis_type_metric/public/components/metric_vis_component.test.tsx
@@ -20,12 +20,12 @@
 import React from 'react';
 import { shallow } from 'enzyme';
 
-import { Vis } from 'src/legacy/core_plugins/visualizations/public';
 import { MetricVisComponent, MetricVisComponentProps } from './metric_vis_component';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { npStart } from 'ui/new_platform';
 import { fieldFormats } from '../../../../../plugins/data/public';
 import { identity } from 'lodash';
+import { ExprVis } from '../../../visualizations/public/np_ready/public/expressions/vis';
 
 jest.mock('ui/new_platform');
 
@@ -37,7 +37,7 @@ const baseVisData = {
 } as any;
 
 describe('MetricVisComponent', function() {
-  const vis: Vis = {
+  const vis: ExprVis = {
     params: {
       metric: {
         colorSchema: 'Green to Red',
@@ -57,7 +57,7 @@ describe('MetricVisComponent', function() {
   const getComponent = (propOverrides: Partial<Props> = {} as Partial<Props>) => {
     const props: Props = {
       vis,
-      visParams: vis.params,
+      visParams: vis.params as any,
       visData: baseVisData,
       renderComplete: jest.fn(),
       ...propOverrides,
diff --git a/src/legacy/core_plugins/vis_type_metric/public/components/metric_vis_component.tsx b/src/legacy/core_plugins/vis_type_metric/public/components/metric_vis_component.tsx
index a93bb618da31f..175458497a05e 100644
--- a/src/legacy/core_plugins/vis_type_metric/public/components/metric_vis_component.tsx
+++ b/src/legacy/core_plugins/vis_type_metric/public/components/metric_vis_component.tsx
@@ -27,12 +27,13 @@ import { FieldFormatsContentType, IFieldFormat } from '../../../../../plugins/da
 import { KibanaDatatable } from '../../../../../plugins/expressions/public';
 import { getHeatmapColors } from '../../../../../plugins/charts/public';
 import { VisParams, MetricVisMetric } from '../types';
-import { SchemaConfig, Vis } from '../../../visualizations/public';
+import { SchemaConfig } from '../../../visualizations/public';
+import { ExprVis } from '../../../visualizations/public/np_ready/public/expressions/vis';
 
 export interface MetricVisComponentProps {
   visParams: VisParams;
   visData: Input;
-  vis: Vis;
+  vis: ExprVis;
   renderComplete: () => void;
 }
 
diff --git a/src/legacy/core_plugins/vis_type_metric/public/metric_vis_type.test.ts b/src/legacy/core_plugins/vis_type_metric/public/metric_vis_type.test.ts
index cce5864aa50a1..c0bfa47bff502 100644
--- a/src/legacy/core_plugins/vis_type_metric/public/metric_vis_type.test.ts
+++ b/src/legacy/core_plugins/vis_type_metric/public/metric_vis_type.test.ts
@@ -61,11 +61,22 @@ describe('metric_vis - createMetricVisTypeDefinition', () => {
       labelTemplate: 'ip[{{value}}]',
     });
 
+    const searchSource = {
+      getField: (name: string) => {
+        if (name === 'index') {
+          return stubIndexPattern;
+        }
+      },
+    };
+
     // TODO: remove when Vis is converted to typescript. Only importing Vis as type
     // @ts-ignore
-    vis = visualizationsStart.createVis(stubIndexPattern, {
+    vis = visualizationsStart.createVis('metric', {
       type: 'metric',
-      aggs: [{ id: '1', type: 'top_hits', schema: 'metric', params: { field: 'ip' } }],
+      data: {
+        searchSource,
+        aggs: [{ id: '1', type: 'top_hits', schema: 'metric', params: { field: 'ip' } }],
+      },
     });
 
     vis.params.dimensions = {
diff --git a/src/legacy/core_plugins/vis_type_table/public/agg_table/__tests__/agg_table.js b/src/legacy/core_plugins/vis_type_table/public/agg_table/__tests__/agg_table.js
index 8edef2ea16353..211b79e915038 100644
--- a/src/legacy/core_plugins/vis_type_table/public/agg_table/__tests__/agg_table.js
+++ b/src/legacy/core_plugins/vis_type_table/public/agg_table/__tests__/agg_table.js
@@ -50,57 +50,73 @@ describe('Table Vis - AggTable Directive', function() {
   const tabifiedData = {};
 
   const init = () => {
-    const vis1 = visualizationsStart.createVis(indexPattern, 'table');
-    tabifiedData.metricOnly = tabifyAggResponse(vis1.aggs, metricOnly);
+    const searchSource = {
+      getField: name => {
+        if (name === 'index') {
+          return indexPattern;
+        }
+      },
+    };
+    const vis1 = visualizationsStart.createVis('table', {
+      type: 'table',
+      data: { searchSource, aggs: [] },
+    });
+    tabifiedData.metricOnly = tabifyAggResponse(vis1.data.aggs, metricOnly);
 
-    const vis2 = visualizationsStart.createVis(indexPattern, {
+    const vis2 = visualizationsStart.createVis('table', {
       type: 'table',
       params: {
         showMetricsAtAllLevels: true,
       },
-      aggs: [
-        { type: 'avg', schema: 'metric', params: { field: 'bytes' } },
-        { type: 'terms', schema: 'bucket', params: { field: 'extension' } },
-        { type: 'terms', schema: 'bucket', params: { field: 'geo.src' } },
-        { type: 'terms', schema: 'bucket', params: { field: 'machine.os' } },
-      ],
+      data: {
+        aggs: [
+          { type: 'avg', schema: 'metric', params: { field: 'bytes' } },
+          { type: 'terms', schema: 'bucket', params: { field: 'extension' } },
+          { type: 'terms', schema: 'bucket', params: { field: 'geo.src' } },
+          { type: 'terms', schema: 'bucket', params: { field: 'machine.os' } },
+        ],
+        searchSource,
+      },
     });
-    vis2.aggs.aggs.forEach(function(agg, i) {
+    vis2.data.aggs.aggs.forEach(function(agg, i) {
       agg.id = 'agg_' + (i + 1);
     });
-    tabifiedData.threeTermBuckets = tabifyAggResponse(vis2.aggs, threeTermBuckets, {
+    tabifiedData.threeTermBuckets = tabifyAggResponse(vis2.data.aggs, threeTermBuckets, {
       metricsAtAllLevels: true,
     });
 
-    const vis3 = visualizationsStart.createVis(indexPattern, {
+    const vis3 = visualizationsStart.createVis('table', {
       type: 'table',
-      aggs: [
-        { type: 'avg', schema: 'metric', params: { field: 'bytes' } },
-        { type: 'min', schema: 'metric', params: { field: '@timestamp' } },
-        { type: 'terms', schema: 'bucket', params: { field: 'extension' } },
-        {
-          type: 'date_histogram',
-          schema: 'bucket',
-          params: { field: '@timestamp', interval: 'd' },
-        },
-        {
-          type: 'derivative',
-          schema: 'metric',
-          params: { metricAgg: 'custom', customMetric: { id: '5-orderAgg', type: 'count' } },
-        },
-        {
-          type: 'top_hits',
-          schema: 'metric',
-          params: { field: 'bytes', aggregate: { val: 'min' }, size: 1 },
-        },
-      ],
+      data: {
+        aggs: [
+          { type: 'avg', schema: 'metric', params: { field: 'bytes' } },
+          { type: 'min', schema: 'metric', params: { field: '@timestamp' } },
+          { type: 'terms', schema: 'bucket', params: { field: 'extension' } },
+          {
+            type: 'date_histogram',
+            schema: 'bucket',
+            params: { field: '@timestamp', interval: 'd' },
+          },
+          {
+            type: 'derivative',
+            schema: 'metric',
+            params: { metricAgg: 'custom', customMetric: { id: '5-orderAgg', type: 'count' } },
+          },
+          {
+            type: 'top_hits',
+            schema: 'metric',
+            params: { field: 'bytes', aggregate: { val: 'min' }, size: 1 },
+          },
+        ],
+        searchSource,
+      },
     });
-    vis3.aggs.aggs.forEach(function(agg, i) {
+    vis3.data.aggs.aggs.forEach(function(agg, i) {
       agg.id = 'agg_' + (i + 1);
     });
 
     tabifiedData.oneTermOneHistogramBucketWithTwoMetricsOneTopHitOneDerivative = tabifyAggResponse(
-      vis3.aggs,
+      vis3.data.aggs,
       oneTermOneHistogramBucketWithTwoMetricsOneTopHitOneDerivative
     );
   };
diff --git a/src/legacy/core_plugins/vis_type_table/public/agg_table/__tests__/agg_table_group.js b/src/legacy/core_plugins/vis_type_table/public/agg_table/__tests__/agg_table_group.js
index 89900d2144030..77f817e44ba79 100644
--- a/src/legacy/core_plugins/vis_type_table/public/agg_table/__tests__/agg_table_group.js
+++ b/src/legacy/core_plugins/vis_type_table/public/agg_table/__tests__/agg_table_group.js
@@ -38,22 +38,35 @@ describe('Table Vis - AggTableGroup Directive', function() {
   const tabifiedData = {};
 
   const init = () => {
-    const vis1 = visualizationsStart.createVis(indexPattern, 'table');
-    tabifiedData.metricOnly = tabifyAggResponse(vis1.aggs, metricOnly);
+    const searchSource = {
+      getField: name => {
+        if (name === 'index') {
+          return indexPattern;
+        }
+      },
+    };
+    const vis1 = visualizationsStart.createVis('table', {
+      type: 'table',
+      data: { searchSource, aggs: [] },
+    });
+    tabifiedData.metricOnly = tabifyAggResponse(vis1.data.aggs, metricOnly);
 
-    const vis2 = visualizationsStart.createVis(indexPattern, {
+    const vis2 = visualizationsStart.createVis('pie', {
       type: 'pie',
-      aggs: [
-        { type: 'avg', schema: 'metric', params: { field: 'bytes' } },
-        { type: 'terms', schema: 'split', params: { field: 'extension' } },
-        { type: 'terms', schema: 'segment', params: { field: 'geo.src' } },
-        { type: 'terms', schema: 'segment', params: { field: 'machine.os' } },
-      ],
+      data: {
+        aggs: [
+          { type: 'avg', schema: 'metric', params: { field: 'bytes' } },
+          { type: 'terms', schema: 'split', params: { field: 'extension' } },
+          { type: 'terms', schema: 'segment', params: { field: 'geo.src' } },
+          { type: 'terms', schema: 'segment', params: { field: 'machine.os' } },
+        ],
+        searchSource,
+      },
     });
-    vis2.aggs.aggs.forEach(function(agg, i) {
+    vis2.data.aggs.aggs.forEach(function(agg, i) {
       agg.id = 'agg_' + (i + 1);
     });
-    tabifiedData.threeTermBuckets = tabifyAggResponse(vis2.aggs, threeTermBuckets);
+    tabifiedData.threeTermBuckets = tabifyAggResponse(vis2.data.aggs, threeTermBuckets);
   };
 
   const initLocalAngular = () => {
diff --git a/src/legacy/core_plugins/vis_type_table/public/table_vis_controller.test.ts b/src/legacy/core_plugins/vis_type_table/public/table_vis_controller.test.ts
index 327a47093f535..ad56607e9296c 100644
--- a/src/legacy/core_plugins/vis_type_table/public/table_vis_controller.test.ts
+++ b/src/legacy/core_plugins/vis_type_table/public/table_vis_controller.test.ts
@@ -118,20 +118,22 @@ describe('Table Vis - Controller', () => {
     return ({
       type: tableVisTypeDefinition,
       params: Object.assign({}, tableVisTypeDefinition.visConfig.defaults, params),
-      aggs: createAggConfigs(stubIndexPattern, [
-        { type: 'count', schema: 'metric' },
-        {
-          type: 'range',
-          schema: 'bucket',
-          params: {
-            field: 'bytes',
-            ranges: [
-              { from: 0, to: 1000 },
-              { from: 1000, to: 2000 },
-            ],
+      data: {
+        aggs: createAggConfigs(stubIndexPattern, [
+          { type: 'count', schema: 'metric' },
+          {
+            type: 'range',
+            schema: 'bucket',
+            params: {
+              field: 'bytes',
+              ranges: [
+                { from: 0, to: 1000 },
+                { from: 1000, to: 2000 },
+              ],
+            },
           },
-        },
-      ]),
+        ]),
+      },
     } as unknown) as Vis;
   }
 
@@ -151,11 +153,11 @@ describe('Table Vis - Controller', () => {
 
   // basically a parameterized beforeEach
   function initController(vis: Vis) {
-    vis.aggs.aggs.forEach((agg: IAggConfig, i: number) => {
+    vis.data.aggs!.aggs.forEach((agg: IAggConfig, i: number) => {
       agg.id = 'agg_' + (i + 1);
     });
 
-    tabifiedResponse = tabifyAggResponse(vis.aggs, oneRangeBucket);
+    tabifiedResponse = tabifyAggResponse(vis.data.aggs!, oneRangeBucket);
     $rootScope.vis = vis;
     $rootScope.visParams = vis.params;
     $rootScope.uiState = {
diff --git a/src/legacy/core_plugins/vis_type_table/public/vis_controller.ts b/src/legacy/core_plugins/vis_type_table/public/vis_controller.ts
index 2d27a99bdd8af..2feaad9f4e6b6 100644
--- a/src/legacy/core_plugins/vis_type_table/public/vis_controller.ts
+++ b/src/legacy/core_plugins/vis_type_table/public/vis_controller.ts
@@ -19,12 +19,12 @@
 
 import angular, { IModule, auto, IRootScopeService, IScope, ICompileService } from 'angular';
 import $ from 'jquery';
-import { isEqual } from 'lodash';
 
-import { Vis, VisParams } from '../../visualizations/public';
+import { VisParams } from '../../visualizations/public';
 import { npStart } from './legacy_imports';
 import { getAngularModule } from './get_inner_angular';
 import { initTableVisLegacyModule } from './table_vis_legacy_module';
+import { ExprVis } from '../../visualizations/public/np_ready/public/expressions/vis';
 
 const innerAngularName = 'kibana/table_vis';
 
@@ -32,12 +32,12 @@ export class TableVisualizationController {
   private tableVisModule: IModule | undefined;
   private injector: auto.IInjectorService | undefined;
   el: JQuery<Element>;
-  vis: Vis;
+  vis: ExprVis;
   $rootScope: IRootScopeService | null = null;
   $scope: (IScope & { [key: string]: any }) | undefined;
   $compile: ICompileService | undefined;
 
-  constructor(domeElement: Element, vis: Vis) {
+  constructor(domeElement: Element, vis: ExprVis) {
     this.el = $(domeElement);
     this.vis = vis;
   }
@@ -60,7 +60,7 @@ export class TableVisualizationController {
     }
   }
 
-  async render(esResponse: object, visParams: VisParams, status: { [key: string]: boolean }) {
+  async render(esResponse: object, visParams: VisParams) {
     this.initLocalAngular();
 
     return new Promise(async (resolve, reject) => {
@@ -77,15 +77,10 @@ export class TableVisualizationController {
         this.$scope.visState = { params: visParams };
         this.$scope.esResponse = esResponse;
 
-        if (!isEqual(this.$scope.visParams, visParams)) {
-          this.vis.emit('updateEditorStateParams', visParams);
-        }
-
         this.$scope.visParams = visParams;
         this.$scope.renderComplete = resolve;
         this.$scope.renderFailed = reject;
         this.$scope.resize = Date.now();
-        this.$scope.updateStatus = status;
         this.$scope.$apply();
       };
 
@@ -93,7 +88,7 @@ export class TableVisualizationController {
         this.$scope = this.$rootScope.$new();
         this.$scope.uiState = this.vis.getUiState();
         updateScope();
-        this.el.find('div').append(this.$compile(this.vis.type.visConfig.template)(this.$scope));
+        this.el.find('div').append(this.$compile(this.vis.type!.visConfig.template)(this.$scope));
         this.$scope.$apply();
       } else {
         updateScope();
diff --git a/src/legacy/core_plugins/vis_type_tagcloud/public/components/__tests__/tag_cloud_visualization.js b/src/legacy/core_plugins/vis_type_tagcloud/public/components/__tests__/tag_cloud_visualization.js
index 3091b3340cd6d..6f54744a2f508 100644
--- a/src/legacy/core_plugins/vis_type_tagcloud/public/components/__tests__/tag_cloud_visualization.js
+++ b/src/legacy/core_plugins/vis_type_tagcloud/public/components/__tests__/tag_cloud_visualization.js
@@ -19,7 +19,6 @@
 
 import expect from '@kbn/expect';
 import ngMock from 'ng_mock';
-import LogstashIndexPatternStubProvider from 'fixtures/stubbed_logstash_index_pattern';
 import { start as visualizationsStart } from '../../../../../core_plugins/visualizations/public/np_ready/public/legacy';
 import { ImageComparator } from 'test_utils/image_comparator';
 import { createTagCloudVisualization } from '../tag_cloud_visualization';
@@ -36,7 +35,6 @@ const PIXEL_DIFF = 64;
 
 describe('TagCloudVisualizationTest', function() {
   let domNode;
-  let indexPattern;
   let vis;
   let imageComparator;
 
@@ -66,22 +64,18 @@ describe('TagCloudVisualizationTest', function() {
   });
 
   beforeEach(ngMock.module('kibana'));
-  beforeEach(
-    ngMock.inject(Private => {
-      indexPattern = Private(LogstashIndexPatternStubProvider);
-    })
-  );
 
   describe('TagCloudVisualization - basics', function() {
     beforeEach(async function() {
       setupDOM('512px', '512px');
       imageComparator = new ImageComparator();
-      vis = visualizationsStart.createVis(indexPattern, {
+      vis = visualizationsStart.createVis('tagcloud', {
         type: 'tagcloud',
         params: {
           bucket: { accessor: 0, format: {} },
           metric: { accessor: 0, format: {} },
         },
+        data: {},
       });
     });
 
diff --git a/src/legacy/core_plugins/vis_type_tagcloud/public/components/tag_cloud_visualization.js b/src/legacy/core_plugins/vis_type_tagcloud/public/components/tag_cloud_visualization.js
index 114643c9a74e0..04f447bf78d50 100644
--- a/src/legacy/core_plugins/vis_type_tagcloud/public/components/tag_cloud_visualization.js
+++ b/src/legacy/core_plugins/vis_type_tagcloud/public/components/tag_cloud_visualization.js
@@ -79,17 +79,10 @@ export function createTagCloudVisualization({ colors }) {
       render(<Label ref={this._label} />, this._labelNode);
     }
 
-    async render(data, visParams, status) {
-      if (!(status.resize || status.data || status.params)) return;
-
-      if (status.params || status.data) {
-        this._updateParams(visParams);
-        this._updateData(data);
-      }
-
-      if (status.resize) {
-        this._resize();
-      }
+    async render(data, visParams) {
+      this._updateParams(visParams);
+      this._updateData(data);
+      this._resize();
 
       await this._renderComplete$.pipe(take(1)).toPromise();
 
diff --git a/src/legacy/core_plugins/vis_type_tagcloud/public/tag_cloud_type.ts b/src/legacy/core_plugins/vis_type_tagcloud/public/tag_cloud_type.ts
index 9a522fe6e648e..5a8cc3004a315 100644
--- a/src/legacy/core_plugins/vis_type_tagcloud/public/tag_cloud_type.ts
+++ b/src/legacy/core_plugins/vis_type_tagcloud/public/tag_cloud_type.ts
@@ -20,7 +20,6 @@
 import { i18n } from '@kbn/i18n';
 
 import { Schemas } from '../../vis_default_editor/public';
-import { Status } from '../../visualizations/public';
 
 import { TagCloudOptions } from './components/tag_cloud_options';
 
@@ -44,7 +43,6 @@ export const createTagCloudVisTypeDefinition = (deps: TagCloudVisDependencies) =
       showLabel: true,
     },
   },
-  requiresUpdateStatus: [Status.PARAMS, Status.RESIZE, Status.DATA],
   visualization: createTagCloudVisualization(deps),
   editorConfig: {
     collections: {
diff --git a/src/legacy/core_plugins/vis_type_timelion/index.ts b/src/legacy/core_plugins/vis_type_timelion/index.ts
index 4664bebb4f38a..6c1e3f452959e 100644
--- a/src/legacy/core_plugins/vis_type_timelion/index.ts
+++ b/src/legacy/core_plugins/vis_type_timelion/index.ts
@@ -25,7 +25,7 @@ import { LegacyPluginApi, LegacyPluginInitializer } from '../../../../src/legacy
 const timelionVisPluginInitializer: LegacyPluginInitializer = ({ Plugin }: LegacyPluginApi) =>
   new Plugin({
     id: 'timelion_vis',
-    require: ['kibana', 'elasticsearch', 'visualizations', 'data'],
+    require: ['kibana', 'elasticsearch', 'visualizations'],
     publicDir: resolve(__dirname, 'public'),
     uiExports: {
       styleSheetPaths: resolve(__dirname, 'public/index.scss'),
diff --git a/src/legacy/core_plugins/vis_type_timelion/public/components/timelion_vis.tsx b/src/legacy/core_plugins/vis_type_timelion/public/components/timelion_vis.tsx
index 9e11fd5d3f45c..f55d1602ea342 100644
--- a/src/legacy/core_plugins/vis_type_timelion/public/components/timelion_vis.tsx
+++ b/src/legacy/core_plugins/vis_type_timelion/public/components/timelion_vis.tsx
@@ -20,16 +20,16 @@
 import React from 'react';
 
 import { IUiSettingsClient } from 'kibana/public';
-import { Vis } from 'src/legacy/core_plugins/visualizations/public';
 import { ChartComponent } from './chart';
 import { VisParams } from '../timelion_vis_fn';
 import { TimelionSuccessResponse } from '../helpers/timelion_request_handler';
+import { ExprVis } from '../../../visualizations/public/np_ready/public/expressions/vis';
 
 export interface TimelionVisComponentProp {
   config: IUiSettingsClient;
   renderComplete(): void;
   updateStatus: object;
-  vis: Vis;
+  vis: ExprVis;
   visData: TimelionSuccessResponse;
   visParams: VisParams;
 }
diff --git a/src/legacy/ui/public/vis/lib/timezone.js b/src/legacy/core_plugins/vis_type_timelion/public/helpers/get_timezone.ts
similarity index 70%
rename from src/legacy/ui/public/vis/lib/timezone.js
rename to src/legacy/core_plugins/vis_type_timelion/public/helpers/get_timezone.ts
index a526ca55f9c86..f1e8fc56901e1 100644
--- a/src/legacy/ui/public/vis/lib/timezone.js
+++ b/src/legacy/core_plugins/vis_type_timelion/public/helpers/get_timezone.ts
@@ -18,15 +18,14 @@
  */
 
 import moment from 'moment-timezone';
+import { IUiSettingsClient } from 'kibana/public';
 
-export function timezoneProvider(config) {
-  return function() {
-    if (config.isDefault('dateFormat:tz')) {
-      const detectedTimezone = moment.tz.guess();
-      if (detectedTimezone) return detectedTimezone;
-      else return moment().format('Z');
-    } else {
-      return config.get('dateFormat:tz', 'Browser');
-    }
-  };
+export function getTimezone(config: IUiSettingsClient) {
+  if (config.isDefault('dateFormat:tz')) {
+    const detectedTimezone = moment.tz.guess();
+    if (detectedTimezone) return detectedTimezone;
+    else return moment().format('Z');
+  } else {
+    return config.get('dateFormat:tz', 'Browser');
+  }
 }
diff --git a/src/legacy/core_plugins/vis_type_timelion/public/helpers/timelion_request_handler.ts b/src/legacy/core_plugins/vis_type_timelion/public/helpers/timelion_request_handler.ts
index 603c911438f2a..47bfed6340e93 100644
--- a/src/legacy/core_plugins/vis_type_timelion/public/helpers/timelion_request_handler.ts
+++ b/src/legacy/core_plugins/vis_type_timelion/public/helpers/timelion_request_handler.ts
@@ -21,8 +21,8 @@ import { i18n } from '@kbn/i18n';
 import { KIBANA_CONTEXT_NAME } from 'src/plugins/expressions/public';
 import { VisParams } from 'src/legacy/core_plugins/visualizations/public';
 import { TimeRange, Filter, esQuery, Query } from '../../../../../plugins/data/public';
-import { timezoneProvider } from '../legacy_imports';
 import { TimelionVisDependencies } from '../plugin';
+import { getTimezone } from './get_timezone';
 
 interface Stats {
   cacheCount: number;
@@ -66,7 +66,7 @@ export function getTimelionRequestHandler({
   http,
   timefilter,
 }: TimelionVisDependencies) {
-  const timezone = timezoneProvider(uiSettings)();
+  const timezone = getTimezone(uiSettings);
 
   return async function({
     timeRange,
diff --git a/src/legacy/core_plugins/vis_type_timelion/public/index.ts b/src/legacy/core_plugins/vis_type_timelion/public/index.ts
index 98cc35877094e..6292e2ad3eb08 100644
--- a/src/legacy/core_plugins/vis_type_timelion/public/index.ts
+++ b/src/legacy/core_plugins/vis_type_timelion/public/index.ts
@@ -23,3 +23,5 @@ import { TimelionVisPlugin as Plugin } from './plugin';
 export function plugin(initializerContext: PluginInitializerContext) {
   return new Plugin(initializerContext);
 }
+
+export { getTimezone } from './helpers/get_timezone';
diff --git a/src/legacy/core_plugins/vis_type_timelion/public/legacy_imports.ts b/src/legacy/core_plugins/vis_type_timelion/public/legacy_imports.ts
index a00240ee06828..e7612b288fb24 100644
--- a/src/legacy/core_plugins/vis_type_timelion/public/legacy_imports.ts
+++ b/src/legacy/core_plugins/vis_type_timelion/public/legacy_imports.ts
@@ -19,6 +19,3 @@
 
 export { npSetup, npStart } from 'ui/new_platform';
 export { PluginsStart } from 'ui/new_platform/new_platform';
-
-// @ts-ignore
-export { timezoneProvider } from 'ui/vis/lib/timezone';
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/components/aggs/percentile_ui.js b/src/legacy/core_plugins/vis_type_timeseries/public/components/aggs/percentile_ui.js
index b931c8084a61e..f94c2f609da8f 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/components/aggs/percentile_ui.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/components/aggs/percentile_ui.js
@@ -135,6 +135,8 @@ class PercentilesUi extends Component {
           <EuiFlexItem style={optionsStyle} grow={false}>
             <EuiFieldNumber
               id={htmlId('fillTo')}
+              min={0}
+              max={100}
               step={1}
               onChange={this.handleTextChange(model, 'percentile')}
               value={Number(model.percentile)}
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/components/panel_config/gauge.test.js b/src/legacy/core_plugins/vis_type_timeseries/public/components/panel_config/gauge.test.js
index d92dafadb68bc..4509b669b0505 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/components/panel_config/gauge.test.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/components/panel_config/gauge.test.js
@@ -20,12 +20,6 @@
 import React from 'react';
 import { shallowWithIntl } from 'test_utils/enzyme_helpers';
 
-jest.mock('plugins/data', () => {
-  return {
-    QueryStringInput: () => <div className="queryStringInput" />,
-  };
-});
-
 jest.mock('../lib/get_default_query_language', () => ({
   getDefaultQueryLanguage: () => 'kuery',
 }));
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_editor.js b/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_editor.js
index ff2546f75c51a..b4845696fc8c0 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_editor.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_editor.js
@@ -65,7 +65,7 @@ export class VisEditor extends Component {
   }
 
   get uiState() {
-    return this.props.vis.getUiState();
+    return this.props.vis.uiState;
   }
 
   getConfig = (...args) => {
@@ -73,17 +73,15 @@ export class VisEditor extends Component {
   };
 
   handleUiState = (field, value) => {
-    this.props.vis.uiStateVal(field, value);
+    this.props.vis.uiState.set(field, value);
   };
 
   updateVisState = debounce(() => {
     this.props.vis.params = this.state.model;
-    this.props.vis.updateState();
-    // This check should be redundant, since this method should only be called when we're in editor
-    // mode where there's also an appState passed into us.
-    if (this.props.appState) {
-      this.props.appState.save();
-    }
+    this.props.eventEmitter.emit('updateVis');
+    this.props.eventEmitter.emit('dirtyStateChange', {
+      isDirty: false,
+    });
   }, VIS_STATE_DEBOUNCE_DELAY);
 
   isValidKueryQuery = filterQuery => {
@@ -184,7 +182,8 @@ export class VisEditor extends Component {
               dirty={this.state.dirty}
               autoApply={this.state.autoApply}
               model={model}
-              savedObj={this.props.savedObj}
+              embeddableHandler={this.props.embeddableHandler}
+              vis={this.props.vis}
               timeRange={this.props.timeRange}
               uiState={this.uiState}
               onCommit={this.handleCommit}
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_editor_visualization.js b/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_editor_visualization.js
index c45a4d68e8aad..fbd17d99be9bf 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_editor_visualization.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_editor_visualization.js
@@ -29,7 +29,6 @@ import {
   AUTO_INTERVAL,
 } from './lib/get_interval';
 import { PANEL_TYPES } from '../../../../../plugins/vis_type_timeseries/common/panel_types';
-import { start as embeddables } from '../../../embeddable_api/public/np_ready/public/legacy';
 
 const MIN_CHART_HEIGHT = 300;
 
@@ -70,15 +69,9 @@ class VisEditorVisualizationUI extends Component {
       return;
     }
 
-    const { timeRange, savedObj, onDataChange } = this.props;
+    const { onDataChange, embeddableHandler } = this.props;
 
-    this._handler = await embeddables
-      .getEmbeddableFactory('visualization')
-      .createFromObject(savedObj, {
-        vis: {},
-        timeRange: timeRange,
-        filters: [],
-      });
+    this._handler = embeddableHandler;
     await this._handler.render(this._visEl.current);
 
     this._subscription = this._handler.handler.data$.subscribe(data => {
@@ -285,7 +278,7 @@ VisEditorVisualizationUI.propTypes = {
   onCommit: PropTypes.func,
   uiState: PropTypes.object,
   onToggleAutoApply: PropTypes.func,
-  savedObj: PropTypes.object,
+  embeddableHandler: PropTypes.object,
   timeRange: PropTypes.object,
   dirty: PropTypes.bool,
   autoApply: PropTypes.bool,
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_types/gauge/series.test.js b/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_types/gauge/series.test.js
index 4efd5bb65451c..65bf7561e3866 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_types/gauge/series.test.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_types/gauge/series.test.js
@@ -20,12 +20,6 @@ import React from 'react';
 import { GaugeSeries } from './series';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 
-jest.mock('plugins/data', () => {
-  return {
-    QueryStringInput: () => <div className="queryStringInput" />,
-  };
-});
-
 const defaultProps = {
   disableAdd: true,
   disableDelete: true,
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_types/metric/series.test.js b/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_types/metric/series.test.js
index 299e7c12f931a..94a12266df3b3 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_types/metric/series.test.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/components/vis_types/metric/series.test.js
@@ -21,12 +21,6 @@ import React from 'react';
 import { MetricSeries } from './series';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 
-jest.mock('plugins/data', () => {
-  return {
-    QueryStringInput: () => <div className="queryStringInput" />,
-  };
-});
-
 const defaultProps = {
   disableAdd: false,
   disableDelete: true,
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/editor_controller.js b/src/legacy/core_plugins/vis_type_timeseries/public/editor_controller.js
index 4d029553145da..16a6348712065 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/editor_controller.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/editor_controller.js
@@ -23,12 +23,15 @@ import { fetchIndexPatternFields } from './lib/fetch_fields';
 import { getSavedObjectsClient, getUISettings, getI18n } from './services';
 
 export class EditorController {
-  constructor(el, savedObj) {
+  constructor(el, vis, eventEmitter, embeddableHandler) {
     this.el = el;
 
+    this.embeddableHandler = embeddableHandler;
+    this.eventEmitter = eventEmitter;
+
     this.state = {
-      savedObj: savedObj,
-      vis: savedObj.vis,
+      fields: [],
+      vis: vis,
       isLoaded: false,
     };
   }
@@ -47,7 +50,7 @@ export class EditorController {
 
     this.state.vis.params.default_index_pattern = title;
     this.state.vis.params.default_timefield = timeFieldName;
-    this.state.vis.fields = await fetchIndexPatternFields(this.state.vis);
+    this.state.fields = await fetchIndexPatternFields(this.state.vis);
 
     this.state.isLoaded = true;
   };
@@ -67,13 +70,14 @@ export class EditorController {
         <Component
           config={getUISettings()}
           vis={this.state.vis}
-          visFields={this.state.vis.fields}
+          visFields={this.state.fields}
           visParams={this.state.vis.params}
-          savedObj={this.state.savedObj}
           timeRange={params.timeRange}
           renderComplete={() => {}}
           isEditorMode={true}
           appState={params.appState}
+          embeddableHandler={this.embeddableHandler}
+          eventEmitter={this.eventEmitter}
         />
       </I18nContext>,
       this.el
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/lib/get_timezone.ts b/src/legacy/core_plugins/vis_type_timeseries/public/lib/get_timezone.ts
new file mode 100644
index 0000000000000..f1e8fc56901e1
--- /dev/null
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/lib/get_timezone.ts
@@ -0,0 +1,31 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import moment from 'moment-timezone';
+import { IUiSettingsClient } from 'kibana/public';
+
+export function getTimezone(config: IUiSettingsClient) {
+  if (config.isDefault('dateFormat:tz')) {
+    const detectedTimezone = moment.tz.guess();
+    if (detectedTimezone) return detectedTimezone;
+    else return moment().format('Z');
+  } else {
+    return config.get('dateFormat:tz', 'Browser');
+  }
+}
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/request_handler.js b/src/legacy/core_plugins/vis_type_timeseries/public/request_handler.js
index 032ef335314d9..2cac1567a6eb7 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/request_handler.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/request_handler.js
@@ -18,7 +18,7 @@
  */
 
 import { validateInterval } from './lib/validate_interval';
-import { timezoneProvider } from './legacy_imports';
+import { getTimezone } from './lib/get_timezone';
 import { getUISettings, getDataStart, getCoreStart } from './services';
 
 export const metricsRequestHandler = async ({
@@ -30,7 +30,7 @@ export const metricsRequestHandler = async ({
   savedObjectId,
 }) => {
   const config = getUISettings();
-  const timezone = timezoneProvider(config)();
+  const timezone = getTimezone(config);
   const uiStateObj = uiState.get(visParams.type, {});
   const parsedTimeRange = getDataStart().query.timefilter.timefilter.calculateBounds(timeRange);
   const scaledDataFormat = config.get('dateFormat:scaled');
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/constants/chart.js b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/constants/chart.js
index 2e7eae438de12..d5ecbaa2ade06 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/constants/chart.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/constants/chart.js
@@ -32,6 +32,7 @@ export const GRID_LINE_CONFIG = {
 export const X_ACCESSOR_INDEX = 0;
 export const STACK_ACCESSORS = [0];
 export const Y_ACCESSOR_INDEXES = [1];
+export const Y0_ACCESSOR_INDEXES = [2];
 
 export const STACKED_OPTIONS = {
   NONE: 'none',
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/decorators/area_decorator.js b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/decorators/area_decorator.js
index 923024ff690a4..0afe773266a61 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/decorators/area_decorator.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/decorators/area_decorator.js
@@ -21,7 +21,7 @@ import React from 'react';
 import { ScaleType, AreaSeries } from '@elastic/charts';
 import { getAreaStyles } from '../utils/series_styles';
 import { ChartsEntities } from '../model/charts';
-import { X_ACCESSOR_INDEX, Y_ACCESSOR_INDEXES } from '../../../constants';
+import { X_ACCESSOR_INDEX, Y_ACCESSOR_INDEXES, Y0_ACCESSOR_INDEXES } from '../../../constants';
 
 export function AreaSeriesDecorator({
   seriesId,
@@ -40,6 +40,8 @@ export function AreaSeriesDecorator({
   enableHistogramMode,
   useDefaultGroupDomain,
   sortIndex,
+  y1AccessorFormat,
+  y0AccessorFormat,
 }) {
   const id = seriesId;
   const groupId = seriesGroupId;
@@ -54,6 +56,9 @@ export function AreaSeriesDecorator({
     hideInLegend,
     xAccessor: X_ACCESSOR_INDEX,
     yAccessors: Y_ACCESSOR_INDEXES,
+    y0Accessors: lines.mode === 'band' ? Y0_ACCESSOR_INDEXES : undefined,
+    y1AccessorFormat,
+    y0AccessorFormat,
     stackAccessors,
     stackAsPercentage,
     xScaleType,
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/decorators/bar_decorator.js b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/decorators/bar_decorator.js
index 6d2cd7b8dd935..c979920caac6d 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/decorators/bar_decorator.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/decorators/bar_decorator.js
@@ -21,7 +21,7 @@ import React from 'react';
 import { ScaleType, BarSeries } from '@elastic/charts';
 import { getBarStyles } from '../utils/series_styles';
 import { ChartsEntities } from '../model/charts';
-import { X_ACCESSOR_INDEX, Y_ACCESSOR_INDEXES } from '../../../constants';
+import { X_ACCESSOR_INDEX, Y_ACCESSOR_INDEXES, Y0_ACCESSOR_INDEXES } from '../../../constants';
 
 export function BarSeriesDecorator({
   seriesId,
@@ -39,6 +39,8 @@ export function BarSeriesDecorator({
   enableHistogramMode,
   useDefaultGroupDomain,
   sortIndex,
+  y1AccessorFormat,
+  y0AccessorFormat,
 }) {
   const id = seriesId;
   const groupId = seriesGroupId;
@@ -53,6 +55,9 @@ export function BarSeriesDecorator({
     hideInLegend,
     xAccessor: X_ACCESSOR_INDEX,
     yAccessors: Y_ACCESSOR_INDEXES,
+    y0Accessors: bars.mode === 'band' ? Y0_ACCESSOR_INDEXES : undefined,
+    y1AccessorFormat,
+    y0AccessorFormat,
     stackAccessors,
     stackAsPercentage,
     xScaleType,
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/index.js b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/index.js
index 5673f560214c7..3ce3aae2649e1 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/index.js
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/index.js
@@ -31,8 +31,7 @@ import {
   TooltipType,
 } from '@elastic/charts';
 import { EuiIcon } from '@elastic/eui';
-
-import { timezoneProvider } from '../../../legacy_imports';
+import { getTimezone } from '../../../lib/get_timezone';
 import { eventBus, ACTIVE_CURSOR } from '../../lib/active_cursor';
 import { getUISettings } from '../../../services';
 import { GRID_LINE_CONFIG, ICON_TYPES_MAP, STACKED_OPTIONS } from '../../constants';
@@ -87,7 +86,7 @@ export const TimeSeries = ({
 
   const tooltipFormatter = decorateFormatter(xAxisFormatter);
   const uiSettings = getUISettings();
-  const timeZone = timezoneProvider(uiSettings)();
+  const timeZone = getTimezone(uiSettings);
   const hasBarChart = series.some(({ bars }) => bars.show);
 
   // compute the theme based on the bg color
@@ -156,6 +155,8 @@ export const TimeSeries = ({
             stack,
             points,
             useDefaultGroupDomain,
+            y1AccessorFormat,
+            y0AccessorFormat,
           },
           sortIndex
         ) => {
@@ -182,6 +183,8 @@ export const TimeSeries = ({
                 enableHistogramMode={enableHistogramMode}
                 useDefaultGroupDomain={useDefaultGroupDomain}
                 sortIndex={sortIndex}
+                y1AccessorFormat={y1AccessorFormat}
+                y0AccessorFormat={y0AccessorFormat}
               />
             );
           }
@@ -206,6 +209,8 @@ export const TimeSeries = ({
                 enableHistogramMode={enableHistogramMode}
                 useDefaultGroupDomain={useDefaultGroupDomain}
                 sortIndex={sortIndex}
+                y1AccessorFormat={y1AccessorFormat}
+                y0AccessorFormat={y0AccessorFormat}
               />
             );
           }
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/utils/theme.ts b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/utils/theme.ts
index a25d5e1ce1d35..2694732aa381d 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/utils/theme.ts
+++ b/src/legacy/core_plugins/vis_type_timeseries/public/visualizations/views/timeseries/utils/theme.ts
@@ -16,6 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+// @ts-ignore
 import colorJS from 'color';
 import { Theme, LIGHT_THEME, DARK_THEME } from '@elastic/charts';
 
diff --git a/src/legacy/core_plugins/vis_type_vega/public/__tests__/vega_visualization.js b/src/legacy/core_plugins/vis_type_vega/public/__tests__/vega_visualization.js
index 5befc09b24544..0db3e6cefa724 100644
--- a/src/legacy/core_plugins/vis_type_vega/public/__tests__/vega_visualization.js
+++ b/src/legacy/core_plugins/vis_type_vega/public/__tests__/vega_visualization.js
@@ -22,7 +22,6 @@ import expect from '@kbn/expect';
 import ngMock from 'ng_mock';
 import $ from 'jquery';
 import { createVegaVisualization } from '../vega_visualization';
-import LogstashIndexPatternStubProvider from 'fixtures/stubbed_logstash_index_pattern';
 import { ImageComparator } from 'test_utils/image_comparator';
 
 import vegaliteGraph from '!!raw-loader!./vegalite_graph.hjson';
@@ -57,7 +56,6 @@ const PIXEL_DIFF = 30;
 describe('VegaVisualizations', () => {
   let domNode;
   let VegaVisualization;
-  let indexPattern;
   let vis;
   let imageComparator;
   let vegaVisualizationDependencies;
@@ -71,7 +69,7 @@ describe('VegaVisualizations', () => {
 
   beforeEach(ngMock.module('kibana'));
   beforeEach(
-    ngMock.inject((Private, $injector) => {
+    ngMock.inject($injector => {
       vegaVisualizationDependencies = {
         serviceSettings: $injector.get('serviceSettings'),
         core: {
@@ -99,7 +97,6 @@ describe('VegaVisualizations', () => {
       }
 
       VegaVisualization = createVegaVisualization(vegaVisualizationDependencies);
-      indexPattern = Private(LogstashIndexPatternStubProvider);
     })
   );
 
@@ -108,7 +105,7 @@ describe('VegaVisualizations', () => {
       setupDOM('512px', '512px');
       imageComparator = new ImageComparator();
 
-      vis = visualizationsStart.createVis(indexPattern, { type: 'vega' });
+      vis = visualizationsStart.createVis('vega', { type: 'vega' });
     });
 
     afterEach(function() {
diff --git a/src/legacy/core_plugins/vis_type_vega/public/vega_type.ts b/src/legacy/core_plugins/vis_type_vega/public/vega_type.ts
index 78f9c170ab62d..b0ec90d2c378f 100644
--- a/src/legacy/core_plugins/vis_type_vega/public/vega_type.ts
+++ b/src/legacy/core_plugins/vis_type_vega/public/vega_type.ts
@@ -19,7 +19,6 @@
 
 import { i18n } from '@kbn/i18n';
 // @ts-ignore
-import { Status } from '../../visualizations/public';
 import { DefaultEditorSize } from '../../vis_default_editor/public';
 import { VegaVisualizationDependencies } from './plugin';
 import { VegaVisEditor } from './components';
@@ -51,7 +50,6 @@ export const createVegaTypeDefinition = (dependencies: VegaVisualizationDependen
     },
     visualization,
     requestHandler,
-    requiresUpdateStatus: [Status.DATA, Status.RESIZE],
     responseHandler: 'none',
     options: {
       showIndexSelection: false,
diff --git a/src/legacy/core_plugins/vis_type_vega/public/vega_visualization.js b/src/legacy/core_plugins/vis_type_vega/public/vega_visualization.js
index 3d48eeaaf3f94..96835ef3b10bc 100644
--- a/src/legacy/core_plugins/vis_type_vega/public/vega_visualization.js
+++ b/src/legacy/core_plugins/vis_type_vega/public/vega_visualization.js
@@ -69,7 +69,7 @@ export const createVegaVisualization = ({ serviceSettings }) =>
      * @param {*} status
      * @returns {Promise<void>}
      */
-    async render(visData, visParams, status) {
+    async render(visData) {
       const { toasts } = getNotifications();
 
       if (!visData && !this._vegaView) {
@@ -82,7 +82,7 @@ export const createVegaVisualization = ({ serviceSettings }) =>
       }
 
       try {
-        await this._render(visData, status);
+        await this._render(visData);
       } catch (error) {
         if (this._vegaView) {
           this._vegaView.onError(error);
@@ -96,8 +96,8 @@ export const createVegaVisualization = ({ serviceSettings }) =>
       }
     }
 
-    async _render(vegaParser, status) {
-      if (vegaParser && (status.data || !this._vegaView)) {
+    async _render(vegaParser) {
+      if (vegaParser) {
         // New data received, rebuild the graph
         if (this._vegaView) {
           await this._vegaView.destroy();
@@ -121,9 +121,6 @@ export const createVegaVisualization = ({ serviceSettings }) =>
           this._vegaView = new VegaView(vegaViewParams);
         }
         await this._vegaView.init();
-      } else if (status.resize) {
-        // the graph has been resized
-        await this._vegaView.resize();
       }
     }
 
diff --git a/src/legacy/core_plugins/vis_type_vislib/index.ts b/src/legacy/core_plugins/vis_type_vislib/index.ts
index 74c8f3f96e669..1f75aea31ba0b 100644
--- a/src/legacy/core_plugins/vis_type_vislib/index.ts
+++ b/src/legacy/core_plugins/vis_type_vislib/index.ts
@@ -25,7 +25,7 @@ import { LegacyPluginApi, LegacyPluginInitializer } from '../../types';
 const visTypeVislibPluginInitializer: LegacyPluginInitializer = ({ Plugin }: LegacyPluginApi) =>
   new Plugin({
     id: 'vis_type_vislib',
-    require: ['kibana', 'elasticsearch', 'visualizations', 'interpreter', 'data'],
+    require: ['kibana', 'elasticsearch', 'visualizations', 'interpreter'],
     publicDir: resolve(__dirname, 'public'),
     styleSheetPaths: resolve(__dirname, 'public/index.scss'),
     uiExports: {
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/index.test.tsx.snap b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/index.test.tsx.snap
index 80ed3b6a7ebff..442bc826d51fc 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/index.test.tsx.snap
+++ b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/__snapshots__/index.test.tsx.snap
@@ -54,7 +54,7 @@ exports[`MetricsAxisOptions component should init with the default set of props
     }
     vis={
       Object {
-        "setVisType": [MockFunction],
+        "setState": [MockFunction],
         "type": Object {
           "schemas": Object {
             "metrics": Array [
@@ -126,7 +126,7 @@ exports[`MetricsAxisOptions component should init with the default set of props
     }
     vis={
       Object {
-        "setVisType": [MockFunction],
+        "setState": [MockFunction],
         "type": Object {
           "schemas": Object {
             "metrics": Array [
@@ -169,7 +169,7 @@ exports[`MetricsAxisOptions component should init with the default set of props
     setCategoryAxis={[Function]}
     vis={
       Object {
-        "setVisType": [MockFunction],
+        "setState": [MockFunction],
         "type": Object {
           "schemas": Object {
             "metrics": Array [
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.test.tsx b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.test.tsx
index 032dd10cf11d2..a3f150e718817 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.test.tsx
+++ b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.test.tsx
@@ -94,7 +94,7 @@ describe('MetricsAxisOptions component', () => {
           type: ChartTypes.AREA,
           schemas: { metrics: [{ name: 'metric' }] },
         },
-        setVisType: jest.fn(),
+        setState: jest.fn(),
       },
       stateParams: {
         valueAxes: [axis],
@@ -145,7 +145,7 @@ describe('MetricsAxisOptions component', () => {
         },
       });
 
-      expect(defaultProps.vis.setVisType).toHaveBeenLastCalledWith(ChartTypes.LINE);
+      expect(defaultProps.vis.setState).toHaveBeenLastCalledWith({ type: ChartTypes.LINE });
     });
 
     it('should set histogram visType when multiple seriesParam', () => {
@@ -159,7 +159,7 @@ describe('MetricsAxisOptions component', () => {
         },
       });
 
-      expect(defaultProps.vis.setVisType).toHaveBeenLastCalledWith(ChartTypes.HISTOGRAM);
+      expect(defaultProps.vis.setState).toHaveBeenLastCalledWith({ type: ChartTypes.HISTOGRAM });
     });
   });
 
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.tsx b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.tsx
index a6f4a967d9c76..c7b4562b1087e 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.tsx
+++ b/src/legacy/core_plugins/vis_type_vislib/public/components/options/metrics_axes/index.tsx
@@ -299,7 +299,7 @@ function MetricsAxisOptions(props: ValidationVisOptionsProps<BasicVislibParams>)
   }, [stateParams.seriesParams]);
 
   useEffect(() => {
-    vis.setVisType(visType);
+    vis.setState({ type: visType } as any);
   }, [vis, visType]);
 
   return isTabSelected ? (
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/components/options/point_series/point_series.tsx b/src/legacy/core_plugins/vis_type_vislib/public/components/options/point_series/point_series.tsx
index 229c4922145e8..b9872ab94bd0b 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/components/options/point_series/point_series.tsx
+++ b/src/legacy/core_plugins/vis_type_vislib/public/components/options/point_series/point_series.tsx
@@ -44,7 +44,9 @@ function PointSeriesOptions(props: ValidationVisOptionsProps<BasicVislibParams>)
 
         <BasicOptions {...props} />
 
-        {vis.hasSchemaAgg('segment', 'date_histogram') ? (
+        {vis.data.aggs!.aggs.some(
+          agg => agg.schema === 'segment' && agg.type.name === 'date_histogram'
+        ) ? (
           <SwitchOption
             label={i18n.translate('visTypeVislib.editors.pointSeries.currentTimeMarkerLabel', {
               defaultMessage: 'Current time marker',
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/vis_controller.tsx b/src/legacy/core_plugins/vis_type_vislib/public/vis_controller.tsx
index 580e47195aada..010b61a0900b0 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/vis_controller.tsx
+++ b/src/legacy/core_plugins/vis_type_vislib/public/vis_controller.tsx
@@ -26,7 +26,8 @@ import { Positions } from './utils/collections';
 import { VisTypeVislibDependencies } from './plugin';
 import { mountReactNode } from '../../../../core/public/utils';
 import { VisLegend, CUSTOM_LEGEND_VIS_TYPES } from './vislib/components/legend';
-import { VisParams, Vis } from '../../visualizations/public';
+import { VisParams } from '../../visualizations/public';
+import { ExprVis } from '../../visualizations/public/np_ready/public/expressions/vis';
 
 const legendClassName = {
   top: 'visLib--legend-top',
@@ -45,7 +46,7 @@ export const createVislibVisController = (deps: VisTypeVislibDependencies) => {
     legendEl: HTMLDivElement;
     vislibVis: any;
 
-    constructor(public el: Element, public vis: Vis) {
+    constructor(public el: Element, public vis: ExprVis) {
       this.el = el;
       this.vis = vis;
       this.unmount = null;
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/vislib/__tests__/visualizations/pie_chart.js b/src/legacy/core_plugins/vis_type_vislib/public/vislib/__tests__/visualizations/pie_chart.js
index 43e3b987f1962..21f4e60e4bc6e 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/vislib/__tests__/visualizations/pie_chart.js
+++ b/src/legacy/core_plugins/vis_type_vislib/public/vislib/__tests__/visualizations/pie_chart.js
@@ -133,21 +133,30 @@ describe('No global chart settings', function() {
     responseHandler = vislibSlicesResponseHandler;
 
     let id1 = 1;
-    stubVis1 = visualizationsStart.createVis(indexPattern, {
+    stubVis1 = visualizationsStart.createVis('pie', {
       type: 'pie',
-      aggs: rowAgg,
+      data: {
+        aggs: rowAgg,
+        searchSource: {
+          getField: name => {
+            if (name === 'index') {
+              return indexPattern;
+            }
+          },
+        },
+      },
     });
 
     stubVis1.isHierarchical = () => true;
 
     // We need to set the aggs to a known value.
-    _.each(stubVis1.aggs.aggs, function(agg) {
+    _.each(stubVis1.data.aggs.aggs, function(agg) {
       agg.id = 'agg_' + id1++;
     });
   });
 
   beforeEach(async () => {
-    const table1 = tabifyAggResponse(stubVis1.aggs, threeTermBuckets, {
+    const table1 = tabifyAggResponse(stubVis1.data.aggs, threeTermBuckets, {
       metricsAtAllLevels: true,
     });
     data1 = await responseHandler(table1, rowAggDimensions);
@@ -222,19 +231,28 @@ describe('Vislib PieChart Class Test Suite', function() {
         responseHandler = vislibSlicesResponseHandler;
 
         let id = 1;
-        stubVis = visualizationsStart.createVis(indexPattern, {
+        stubVis = visualizationsStart.createVis('pie', {
           type: 'pie',
-          aggs: dataAgg,
+          data: {
+            aggs: dataAgg,
+            searchSource: {
+              getField: name => {
+                if (name === 'index') {
+                  return indexPattern;
+                }
+              },
+            },
+          },
         });
 
         // We need to set the aggs to a known value.
-        _.each(stubVis.aggs.aggs, function(agg) {
+        _.each(stubVis.data.aggs.aggs, function(agg) {
           agg.id = 'agg_' + id++;
         });
       });
 
       beforeEach(async () => {
-        const table = tabifyAggResponse(stubVis.aggs, threeTermBuckets, {
+        const table = tabifyAggResponse(stubVis.data.aggs, threeTermBuckets, {
           metricsAtAllLevels: true,
         });
         data = await responseHandler(table, dataDimensions);
diff --git a/src/legacy/core_plugins/vis_type_vislib/public/vislib/components/legend/legend.tsx b/src/legacy/core_plugins/vis_type_vislib/public/vislib/components/legend/legend.tsx
index d82941b7b8cee..afd974d6d9b40 100644
--- a/src/legacy/core_plugins/vis_type_vislib/public/vislib/components/legend/legend.tsx
+++ b/src/legacy/core_plugins/vis_type_vislib/public/vislib/components/legend/legend.tsx
@@ -23,22 +23,11 @@ import { compact, uniq, map, every, isUndefined } from 'lodash';
 import { i18n } from '@kbn/i18n';
 import { EuiPopoverProps, EuiIcon, keyCodes, htmlIdGenerator } from '@elastic/eui';
 
-import { IAggConfig } from '../../../../../../../plugins/data/public';
+import { createFiltersFromEvent } from '../../../legacy_imports';
 import { CUSTOM_LEGEND_VIS_TYPES, LegendItem } from './models';
 import { VisLegendItem } from './legend_item';
 import { getPieNames } from './pie_utils';
 
-import { Vis } from '../../../../../visualizations/public';
-import { createFiltersFromEvent, tabifyGetColumns } from '../../../legacy_imports';
-
-const getTableAggs = (vis: Vis): IAggConfig[] => {
-  if (!vis.aggs || !vis.aggs.getResponseAggs) {
-    return [];
-  }
-  const columns = tabifyGetColumns(vis.aggs.getResponseAggs(), !vis.isHierarchical());
-  return columns.map(c => c.aggConfig);
-};
-
 export interface VisLegendProps {
   vis: any;
   vislibVis: any;
@@ -50,7 +39,6 @@ export interface VisLegendProps {
 export interface VisLegendState {
   open: boolean;
   labels: any[];
-  tableAggs: any[];
   filterableLabels: Set<string>;
   selectedLabel: string | null;
 }
@@ -66,7 +54,6 @@ export class VisLegend extends PureComponent<VisLegendProps, VisLegendState> {
     this.state = {
       open,
       labels: [],
-      tableAggs: [],
       filterableLabels: new Set(),
       selectedLabel: null,
     };
@@ -200,7 +187,6 @@ export class VisLegend extends PureComponent<VisLegendProps, VisLegendState> {
       this.getColor = this.props.vislibVis.visConfig.data.getColorFunc();
     }
 
-    this.setState({ tableAggs: getTableAggs(this.props.vis) });
     this.setLabels(this.props.visData, vislibVis.visConfigArgs.type);
   };
 
diff --git a/src/legacy/core_plugins/vis_type_xy/index.ts b/src/legacy/core_plugins/vis_type_xy/index.ts
index 975399f891503..58d2e425eef40 100644
--- a/src/legacy/core_plugins/vis_type_xy/index.ts
+++ b/src/legacy/core_plugins/vis_type_xy/index.ts
@@ -31,7 +31,7 @@ export interface ConfigSchema {
 const visTypeXyPluginInitializer: LegacyPluginInitializer = ({ Plugin }: LegacyPluginApi) =>
   new Plugin({
     id: 'visTypeXy',
-    require: ['kibana', 'elasticsearch', 'visualizations', 'interpreter', 'data'],
+    require: ['kibana', 'elasticsearch', 'visualizations', 'interpreter'],
     publicDir: resolve(__dirname, 'public'),
     uiExports: {
       hacks: [resolve(__dirname, 'public/legacy')],
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization.test.js b/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization.test.js
index 4773fa482e62d..f2844e3aab113 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization.test.js
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization.test.js
@@ -55,7 +55,7 @@ describe('<Visualization/>', () => {
 
   beforeEach(() => {
     vis = {
-      _setUiState: function(uiState) {
+      setUiState: function(uiState) {
         this.uiState = uiState;
       },
       getUiState: function() {
@@ -79,15 +79,6 @@ describe('<Visualization/>', () => {
     expect(wrapper.text()).toBe('No results found');
   });
 
-  it('should display error message when there is a request error that should be shown and no data', () => {
-    const errorVis = { ...vis, requestError: { message: 'Request error' }, showRequestError: true };
-    const data = null;
-    const wrapper = render(
-      <Visualization vis={errorVis} visData={data} listenOnChange={true} uiState={uiState} />
-    );
-    expect(wrapper.text()).toBe('Request error');
-  });
-
   it('should render chart when data is present', () => {
     const wrapper = render(
       <Visualization vis={vis} visData={visData} uiState={uiState} listenOnChange={true} />
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization.tsx
index 33830c45848e4..5296de365daec 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization.tsx
@@ -23,10 +23,9 @@ import { PersistedState } from '../../../../../../../plugins/visualizations/publ
 import { memoizeLast } from '../legacy/memoize';
 import { VisualizationChart } from './visualization_chart';
 import { VisualizationNoResults } from './visualization_noresults';
-import { VisualizationRequestError } from './visualization_requesterror';
-import { Vis } from '..';
+import { ExprVis } from '../expressions/vis';
 
-function shouldShowNoResultsMessage(vis: Vis, visData: any): boolean {
+function shouldShowNoResultsMessage(vis: ExprVis, visData: any): boolean {
   const requiresSearch = get(vis, 'type.requiresSearch');
   const rows: object[] | undefined = get(visData, 'rows');
   const isZeroHits = get(visData, 'hits') === 0 || (rows && !rows.length);
@@ -35,17 +34,11 @@ function shouldShowNoResultsMessage(vis: Vis, visData: any): boolean {
   return Boolean(requiresSearch && isZeroHits && shouldShowMessage);
 }
 
-function shouldShowRequestErrorMessage(vis: Vis, visData: any): boolean {
-  const requestError = get(vis, 'requestError');
-  const showRequestError = get(vis, 'showRequestError');
-  return Boolean(!visData && requestError && showRequestError);
-}
-
 interface VisualizationProps {
   listenOnChange: boolean;
   onInit?: () => void;
   uiState: PersistedState;
-  vis: Vis;
+  vis: ExprVis;
   visData: any;
   visParams: any;
 }
@@ -56,20 +49,17 @@ export class Visualization extends React.Component<VisualizationProps> {
   constructor(props: VisualizationProps) {
     super(props);
 
-    props.vis._setUiState(props.uiState);
+    props.vis.setUiState(props.uiState);
   }
 
   public render() {
     const { vis, visData, visParams, onInit, uiState, listenOnChange } = this.props;
 
     const noResults = this.showNoResultsMessage(vis, visData);
-    const requestError = shouldShowRequestErrorMessage(vis, visData);
 
     return (
       <div className="visualization">
-        {requestError ? (
-          <VisualizationRequestError onInit={onInit} error={vis.requestError} />
-        ) : noResults ? (
+        {noResults ? (
           <VisualizationNoResults onInit={onInit} />
         ) : (
           <VisualizationChart
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization_chart.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization_chart.tsx
index 7b1a18e8066a7..fcfbc8445952c 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization_chart.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/components/visualization_chart.tsx
@@ -21,14 +21,14 @@ import React from 'react';
 import * as Rx from 'rxjs';
 import { debounceTime, filter, share, switchMap } from 'rxjs/operators';
 import { PersistedState } from '../../../../../../../plugins/visualizations/public';
-import { Vis, VisualizationController } from '../vis';
-import { getUpdateStatus } from '../legacy/update_status';
+import { VisualizationController } from '../types';
 import { ResizeChecker } from '../../../../../../../plugins/kibana_utils/public';
+import { ExprVis } from '../expressions/vis';
 
 interface VisualizationChartProps {
   onInit?: () => void;
   uiState: PersistedState;
-  vis: Vis;
+  vis: ExprVis;
   visData: any;
   visParams: any;
   listenOnChange: boolean;
@@ -40,10 +40,9 @@ class VisualizationChart extends React.Component<VisualizationChartProps> {
   private chartDiv = React.createRef<HTMLDivElement>();
   private containerDiv = React.createRef<HTMLDivElement>();
   private renderSubject: Rx.Subject<{
-    vis: Vis;
+    vis: ExprVis;
     visParams: any;
     visData: any;
-    container: HTMLElement;
   }>;
   private renderSubscription: Rx.Subscription;
 
@@ -54,11 +53,9 @@ class VisualizationChart extends React.Component<VisualizationChartProps> {
     const render$ = this.renderSubject.asObservable().pipe(share());
 
     const success$ = render$.pipe(
-      filter(
-        ({ vis, visData, container }) => vis && container && (!vis.type.requiresSearch || visData)
-      ),
+      filter(({ vis, visData }) => vis && (!vis.type.requiresSearch || visData)),
       debounceTime(100),
-      switchMap(async ({ vis, visData, visParams, container }) => {
+      switchMap(async ({ vis, visData, visParams }) => {
         if (!this.visualization) {
           // This should never happen, since we only should trigger another rendering
           // after this component has mounted and thus the visualization implementation
@@ -66,15 +63,11 @@ class VisualizationChart extends React.Component<VisualizationChartProps> {
           throw new Error('Visualization implementation was not initialized on first render.');
         }
 
-        vis.size = [container.clientWidth, container.clientHeight];
-        const status = getUpdateStatus(vis.type.requiresUpdateStatus, this, this.props);
-        return this.visualization.render(visData, visParams, status);
+        return this.visualization.render(visData, visParams);
       })
     );
 
-    const requestError$ = render$.pipe(filter(({ vis }) => vis.requestError));
-
-    this.renderSubscription = Rx.merge(success$, requestError$).subscribe(() => {
+    this.renderSubscription = success$.subscribe(() => {
       if (this.props.onInit) {
         this.props.onInit();
       }
@@ -145,7 +138,6 @@ class VisualizationChart extends React.Component<VisualizationChartProps> {
         vis: this.props.vis,
         visData: this.props.visData,
         visParams: this.props.visParams,
-        container: this.containerDiv.current,
       });
     }
   }
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/get_index_pattern.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/get_index_pattern.ts
index 51d839275fd27..05ce68221eaf0 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/get_index_pattern.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/get_index_pattern.ts
@@ -28,18 +28,18 @@ import { getUISettings, getSavedObjects } from '../services';
 export async function getIndexPattern(
   savedVis: VisSavedObject
 ): Promise<IIndexPattern | undefined> {
-  if (savedVis.vis.type.name !== 'metrics') {
-    return savedVis.vis.indexPattern;
+  if (savedVis.visState.type !== 'metrics') {
+    return savedVis.searchSource!.getField('index');
   }
 
   const savedObjectsClient = getSavedObjects().client;
   const defaultIndex = getUISettings().get('defaultIndex');
 
-  if (savedVis.vis.params.index_pattern) {
+  if (savedVis.visState.params.index_pattern) {
     const indexPatternObjects = await savedObjectsClient.find<IndexPatternAttributes>({
       type: 'index-pattern',
       fields: ['title', 'fields'],
-      search: `"${savedVis.vis.params.index_pattern}"`,
+      search: `"${savedVis.visState.params.index_pattern}"`,
       searchFields: ['title'],
     });
     const [indexPattern] = indexPatternObjects.savedObjects.map(indexPatterns.getFromSavedObject);
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/visualize_embeddable.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/visualize_embeddable.ts
index c45e6832dc836..342824bade3dd 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/visualize_embeddable.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/visualize_embeddable.ts
@@ -45,13 +45,12 @@ import { PersistedState } from '../../../../../../../plugins/visualizations/publ
 import { buildPipeline } from '../legacy/build_pipeline';
 import { Vis } from '../vis';
 import { getExpressions, getUiActions } from '../services';
-import { VisSavedObject } from '../types';
 import { VIS_EVENT_TO_TRIGGER } from './events';
 
 const getKeys = <T extends {}>(o: T): Array<keyof T> => Object.keys(o) as Array<keyof T>;
 
 export interface VisualizeEmbeddableConfiguration {
-  savedVisualization: VisSavedObject;
+  vis: Vis;
   indexPatterns?: IIndexPattern[];
   editUrl: string;
   editable: boolean;
@@ -73,7 +72,6 @@ export interface VisualizeInput extends EmbeddableInput {
 export interface VisualizeOutput extends EmbeddableOutput {
   editUrl: string;
   indexPatterns?: IIndexPattern[];
-  savedObjectId: string;
   visTypeName: string;
 }
 
@@ -81,9 +79,6 @@ type ExpressionLoader = InstanceType<ExpressionsStart['ExpressionLoader']>;
 
 export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOutput> {
   private handler?: ExpressionLoader;
-  private savedVisualization: VisSavedObject;
-  private appState: { save(): void } | undefined;
-  private uiState: PersistedState;
   private timefilter: TimefilterContract;
   private timeRange?: TimeRange;
   private query?: Query;
@@ -99,49 +94,24 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
 
   constructor(
     timefilter: TimefilterContract,
-    {
-      savedVisualization,
-      editUrl,
-      indexPatterns,
-      editable,
-      appState,
-      uiState,
-    }: VisualizeEmbeddableConfiguration,
+    { vis, editUrl, indexPatterns, editable }: VisualizeEmbeddableConfiguration,
     initialInput: VisualizeInput,
     parent?: Container
   ) {
     super(
       initialInput,
       {
-        defaultTitle: savedVisualization.title,
+        defaultTitle: vis.title,
         editUrl,
         indexPatterns,
         editable,
-        savedObjectId: savedVisualization.id!,
-        visTypeName: savedVisualization.vis.type.name,
+        visTypeName: vis.type.name,
       },
       parent
     );
     this.timefilter = timefilter;
-    this.appState = appState;
-    this.savedVisualization = savedVisualization;
-    this.vis = this.savedVisualization.vis;
-
-    this.vis.on('update', this.handleVisUpdate);
-    this.vis.on('reload', this.reload);
-
-    if (uiState) {
-      this.uiState = uiState;
-    } else {
-      const parsedUiState = savedVisualization.uiStateJSON
-        ? JSON.parse(savedVisualization.uiStateJSON)
-        : {};
-      this.uiState = new PersistedState(parsedUiState);
-
-      this.uiState.on('change', this.uiStateChangeHandler);
-    }
-
-    this.vis._setUiState(this.uiState);
+    this.vis = vis;
+    this.vis.uiState.on('change', this.uiStateChangeHandler);
 
     this.autoRefreshFetchSubscription = timefilter
       .getAutoRefreshFetch$()
@@ -155,7 +125,7 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
   }
 
   public getVisualizationDescription() {
-    return this.savedVisualization.description;
+    return this.vis.description;
   }
 
   public getInspectorAdapters = () => {
@@ -184,16 +154,16 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
       if (!_.isEqual(visCustomizations, this.visCustomizations)) {
         this.visCustomizations = visCustomizations;
         // Turn this off or the uiStateChangeHandler will fire for every modification.
-        this.uiState.off('change', this.uiStateChangeHandler);
-        this.uiState.clearAllKeys();
-        this.uiState.set('vis', visCustomizations);
+        this.vis.uiState.off('change', this.uiStateChangeHandler);
+        this.vis.uiState.clearAllKeys();
+        this.vis.uiState.set('vis', visCustomizations);
         getKeys(visCustomizations).forEach(key => {
-          this.uiState.set(key, visCustomizations[key]);
+          this.vis.uiState.set(key, visCustomizations[key]);
         });
-        this.uiState.on('change', this.uiStateChangeHandler);
+        this.vis.uiState.on('change', this.uiStateChangeHandler);
       }
-    } else if (!this.appState) {
-      this.uiState.clearAllKeys();
+    } else if (this.parent) {
+      this.vis.uiState.clearAllKeys();
     }
   }
 
@@ -227,8 +197,8 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
       }
     }
 
-    if (this.savedVisualization.description && this.domNode) {
-      this.domNode.setAttribute('data-description', this.savedVisualization.description);
+    if (this.vis.description && this.domNode) {
+      this.domNode.setAttribute('data-description', this.vis.description);
     }
 
     if (this.handler && dirty) {
@@ -236,6 +206,22 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
     }
   }
 
+  // this is a hack to make editor still work, will be removed once we clean up editor
+  // @ts-ignore
+  hasInspector = () => {
+    const visTypesWithoutInspector = [
+      'markdown',
+      'input_control_vis',
+      'metrics',
+      'vega',
+      'timelion',
+    ];
+    if (visTypesWithoutInspector.includes(this.vis.type.name)) {
+      return false;
+    }
+    return this.getInspectorAdapters();
+  };
+
   /**
    *
    * @param {Element} domNode
@@ -245,26 +231,6 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
 
     this.transferCustomizationsToUiState();
 
-    this.savedVisualization.vis._setUiState(this.uiState);
-    this.uiState = this.savedVisualization.vis.getUiState();
-
-    // this is a hack to make editor still work, will be removed once we clean up editor
-    this.vis.hasInspector = () => {
-      const visTypesWithoutInspector = [
-        'markdown',
-        'input_control_vis',
-        'metrics',
-        'vega',
-        'timelion',
-      ];
-      if (visTypesWithoutInspector.includes(this.vis.type.name)) {
-        return false;
-      }
-      return this.getInspectorAdapters();
-    };
-
-    this.vis.openInspector = this.openInspector;
-
     const div = document.createElement('div');
     div.className = `visualize panel-content panel-content--fullWidth`;
     domNode.appendChild(div);
@@ -277,12 +243,12 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
       this.handler.events$.subscribe(async event => {
         // maps hack, remove once esaggs function is cleaned up and ready to accept variables
         if (event.name === 'bounds') {
-          const agg = this.vis.getAggConfig().aggs.find((a: any) => {
+          const agg = this.vis.data.aggs!.aggs.find((a: any) => {
             return get(a, 'type.dslName') === 'geohash_grid';
           });
           if (
-            agg.params.precision !== event.data.precision ||
-            !_.isEqual(agg.params.boundingBox, event.data.boundingBox)
+            (agg && agg.params.precision !== event.data.precision) ||
+            (agg && !_.isEqual(agg.params.boundingBox, event.data.boundingBox))
           ) {
             agg.params.boundingBox = event.data.boundingBox;
             agg.params.precision = event.data.precision;
@@ -296,7 +262,7 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
             event.name === 'brush' ? VIS_EVENT_TO_TRIGGER.brush : VIS_EVENT_TO_TRIGGER.filter;
           const context: EmbeddableVisTriggerContext = {
             embeddable: this,
-            timeFieldName: this.vis.indexPattern.timeFieldName,
+            timeFieldName: this.vis.data.indexPattern!.timeFieldName!,
             data: event.data,
           };
           getUiActions()
@@ -308,8 +274,8 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
 
     div.setAttribute('data-title', this.output.title || '');
 
-    if (this.savedVisualization.description) {
-      div.setAttribute('data-description', this.savedVisualization.description);
+    if (this.vis.description) {
+      div.setAttribute('data-description', this.vis.description);
     }
 
     div.setAttribute('data-test-subj', 'visualizationLoader');
@@ -339,10 +305,8 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
   public destroy() {
     super.destroy();
     this.subscriptions.forEach(s => s.unsubscribe());
-    this.uiState.off('change', this.uiStateChangeHandler);
-    this.savedVisualization.vis.removeListener('reload', this.reload);
-    this.savedVisualization.vis.removeListener('update', this.handleVisUpdate);
-    this.savedVisualization.destroy();
+    this.vis.uiState.off('change', this.uiStateChangeHandler);
+
     if (this.handler) {
       this.handler.destroy();
       this.handler.getElement().remove();
@@ -361,35 +325,25 @@ export class VisualizeEmbeddable extends Embeddable<VisualizeInput, VisualizeOut
         query: this.input.query,
         filters: this.input.filters,
       },
-      uiState: this.uiState,
+      uiState: this.vis.uiState,
     };
     this.expression = await buildPipeline(this.vis, {
-      searchSource: this.savedVisualization.searchSource,
       timefilter: this.timefilter,
       timeRange: this.timeRange,
-      savedObjectId: this.savedVisualization.id,
     });
 
-    this.vis.filters = { timeRange: this.timeRange };
-
     if (this.handler) {
       this.handler.update(this.expression, expressionParams);
     }
-
-    this.vis.emit('apply');
   }
 
   private handleVisUpdate = async () => {
-    if (this.appState) {
-      this.appState.save();
-    }
-
     this.updateHandler();
   };
 
   private uiStateChangeHandler = () => {
     this.updateInput({
-      ...this.uiState.toJSON(),
+      ...this.vis.uiState.toJSON(),
     });
   };
 
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/visualize_embeddable_factory.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/visualize_embeddable_factory.tsx
index 1cd97115ee10e..911f5530e97e3 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/visualize_embeddable_factory.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/embeddable/visualize_embeddable_factory.tsx
@@ -26,9 +26,8 @@ import {
   ErrorEmbeddable,
 } from '../../../../../../../plugins/embeddable/public';
 import { DisabledLabEmbeddable } from './disabled_lab_embeddable';
-import { getIndexPattern } from './get_index_pattern';
 import { VisualizeEmbeddable, VisualizeInput, VisualizeOutput } from './visualize_embeddable';
-import { VisSavedObject } from '../types';
+import { Vis } from '../types';
 import { VISUALIZE_EMBEDDABLE_TYPE } from './constants';
 import {
   getCapabilities,
@@ -39,6 +38,7 @@ import {
   getTimeFilter,
 } from '../services';
 import { showNewVisModal } from '../wizard';
+import { convertToSerializedVis } from '../saved_visualizations/_saved_vis';
 
 interface VisualizationAttributes extends SavedObjectAttributes {
   visState: string;
@@ -94,31 +94,31 @@ export class VisualizeEmbeddableFactory extends EmbeddableFactory<
   }
 
   public async createFromObject(
-    savedObject: VisSavedObject,
+    vis: Vis,
     input: Partial<VisualizeInput> & { id: string },
     parent?: Container
   ): Promise<VisualizeEmbeddable | ErrorEmbeddable | DisabledLabEmbeddable> {
     const savedVisualizations = getSavedVisualizationsLoader();
 
     try {
-      const visId = savedObject.id as string;
+      const visId = vis.id as string;
 
       const editUrl = visId
         ? getHttp().basePath.prepend(`/app/kibana${savedVisualizations.urlFor(visId)}`)
         : '';
       const isLabsEnabled = getUISettings().get<boolean>('visualize:enableLabs');
 
-      if (!isLabsEnabled && savedObject.vis.type.stage === 'experimental') {
-        return new DisabledLabEmbeddable(savedObject.title, input);
+      if (!isLabsEnabled && vis.type.stage === 'experimental') {
+        return new DisabledLabEmbeddable(vis.title, input);
       }
 
-      const indexPattern = await getIndexPattern(savedObject);
+      const indexPattern = vis.data.indexPattern;
       const indexPatterns = indexPattern ? [indexPattern] : [];
       const editable = await this.isEditable();
       return new VisualizeEmbeddable(
         getTimeFilter(),
         {
-          savedVisualization: savedObject,
+          vis,
           indexPatterns,
           editUrl,
           editable,
@@ -143,7 +143,8 @@ export class VisualizeEmbeddableFactory extends EmbeddableFactory<
 
     try {
       const savedObject = await savedVisualizations.get(savedObjectId);
-      return this.createFromObject(savedObject, input, parent);
+      const vis = new Vis(savedObject.visState.type, await convertToSerializedVis(savedObject));
+      return this.createFromObject(vis, input, parent);
     } catch (e) {
       console.error(e); // eslint-disable-line no-console
       return new ErrorEmbeddable(e, input, parent);
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/vis.js b/src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/vis.ts
similarity index 67%
rename from src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/vis.js
rename to src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/vis.ts
index a891140677d60..3b0458a6c8dcc 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/vis.js
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/vis.ts
@@ -32,25 +32,47 @@ import _ from 'lodash';
 import { PersistedState } from '../../../../../../../plugins/visualizations/public';
 
 import { getTypes } from '../services';
+import { VisType } from '../vis_types';
+import { VisParams } from '../types';
 
-export class Vis extends EventEmitter {
-  constructor(visState = { type: 'histogram' }) {
+export interface ExprVisState {
+  title?: string;
+  type: VisType | string;
+  params?: VisParams;
+}
+
+export interface ExprVisAPIEvents {
+  filter: (data: any) => void;
+  brush: (data: any) => void;
+}
+
+export interface ExprVisAPI {
+  events: ExprVisAPIEvents;
+}
+
+export class ExprVis extends EventEmitter {
+  public title: string = '';
+  public type: VisType;
+  public params: VisParams = {};
+  public sessionState: Record<string, any> = {};
+  public API: ExprVisAPI;
+  public eventsSubject: any;
+  private uiState: PersistedState;
+
+  constructor(visState: ExprVisState = { type: 'histogram' }) {
     super();
 
-    this._setUiState(new PersistedState());
+    this.type = this.getType(visState.type);
+    this.uiState = new PersistedState();
     this.setState(visState);
 
-    // Session state is for storing information that is transitory, and will not be saved with the visualization.
-    // For instance, map bounds, which depends on the view port, browser window size, etc.
-    this.sessionState = {};
-
     this.API = {
       events: {
-        filter: data => {
+        filter: (data: any) => {
           if (!this.eventsSubject) return;
           this.eventsSubject.next({ name: 'filterBucket', data });
         },
-        brush: data => {
+        brush: (data: any) => {
           if (!this.eventsSubject) return;
           this.eventsSubject.next({ name: 'brush', data });
         },
@@ -58,18 +80,22 @@ export class Vis extends EventEmitter {
     };
   }
 
-  setState(state) {
-    this.title = state.title || '';
-    const type = state.type || this.type;
+  private getType(type: string | VisType) {
     if (_.isString(type)) {
-      this.type = getTypes().get(type);
+      return getTypes().get(type);
       if (!this.type) {
         throw new Error(`Invalid type "${type}"`);
       }
     } else {
-      this.type = type;
+      return type;
     }
+  }
 
+  setState(state: ExprVisState) {
+    this.title = state.title || '';
+    if (state.type) {
+      this.type = this.getType(state.type);
+    }
     this.params = _.defaultsDeep(
       {},
       _.cloneDeep(state.params || {}),
@@ -77,10 +103,6 @@ export class Vis extends EventEmitter {
     );
   }
 
-  setCurrentState(state) {
-    this.setState(state);
-  }
-
   getState() {
     return {
       title: this.title,
@@ -106,34 +128,27 @@ export class Vis extends EventEmitter {
   }
 
   hasUiState() {
-    return !!this.__uiState;
+    return !!this.uiState;
   }
 
-  /***
-   * this should not be used outside of visualize
-   * @param uiState
-   * @private
-   */
-  _setUiState(uiState) {
-    if (uiState instanceof PersistedState) {
-      this.__uiState = uiState;
-    }
+  getUiState() {
+    return this.uiState;
   }
 
-  getUiState() {
-    return this.__uiState;
+  setUiState(state: PersistedState) {
+    this.uiState = state;
   }
 
   /**
    * Currently this is only used to extract map-specific information
    * (e.g. mapZoom, mapCenter).
    */
-  uiStateVal(key, val) {
+  uiStateVal(key: string, val: any) {
     if (this.hasUiState()) {
       if (_.isUndefined(val)) {
-        return this.__uiState.get(key);
+        return this.uiState.get(key);
       }
-      return this.__uiState.set(key, val);
+      return this.uiState.set(key, val);
     }
     return val;
   }
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/visualization_renderer.tsx b/src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/visualization_renderer.tsx
index 02a31447d23c1..0fd81c753da24 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/visualization_renderer.tsx
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/expressions/visualization_renderer.tsx
@@ -20,8 +20,9 @@
 import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 // @ts-ignore
-import { Vis } from './vis';
+import { ExprVis } from './vis';
 import { Visualization } from '../components';
+import { VisParams } from '../types';
 
 export const visualization = () => ({
   name: 'visualization',
@@ -31,9 +32,9 @@ export const visualization = () => ({
     const { visData, visConfig, params } = config;
     const visType = config.visType || visConfig.type;
 
-    const vis = new Vis({
-      type: visType,
-      params: visConfig,
+    const vis = new ExprVis({
+      type: visType as string,
+      params: visConfig as VisParams,
     });
 
     vis.eventsSubject = { next: handlers.event };
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/index.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/index.ts
index b59eb2277411c..078cc4a3f4035 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/index.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/index.ts
@@ -39,12 +39,11 @@ export { VisualizationsSetup, VisualizationsStart };
 /** @public types */
 export { VisTypeAlias, VisType } from './vis_types';
 export { VisSavedObject } from './types';
-export { Vis, VisParams, VisState } from './vis';
+export { Vis, VisParams, SerializedVis, SerializedVisData, VisData } from './vis';
 import { VisualizeEmbeddableFactory, VisualizeEmbeddable } from './embeddable';
 export type VisualizeEmbeddableFactoryContract = PublicContract<VisualizeEmbeddableFactory>;
 export type VisualizeEmbeddableContract = PublicContract<VisualizeEmbeddable>;
 export { TypesService } from './vis_types/types_service';
-export { Status } from './legacy/update_status'; // should remove
 export { VISUALIZE_EMBEDDABLE_TYPE, VisualizeInput } from './embeddable';
 export { SchemaConfig } from './legacy/build_pipeline';
 
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.test.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.test.ts
index 9446069182e19..d5c532b53a53e 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.test.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.test.ts
@@ -27,7 +27,7 @@ import {
   Schemas,
 } from './build_pipeline';
 import { Vis } from '..';
-import { searchSourceMock, dataPluginMock } from '../../../../../../../plugins/data/public/mocks';
+import { dataPluginMock } from '../../../../../../../plugins/data/public/mocks';
 import { IAggConfig } from '../../../../../../../plugins/data/public';
 
 jest.mock('ui/new_platform');
@@ -78,19 +78,11 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
   });
 
   describe('buildPipelineVisFunction', () => {
-    let visStateDef: ReturnType<Vis['getCurrentState']>;
     let schemaConfig: SchemaConfig;
     let schemasDef: Schemas;
     let uiState: any;
 
     beforeEach(() => {
-      visStateDef = {
-        title: 'title',
-        // @ts-ignore
-        type: 'type',
-        params: {},
-      } as ReturnType<Vis['getCurrentState']>;
-
       schemaConfig = {
         accessor: 0,
         label: '',
@@ -105,66 +97,53 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
 
     it('handles vega function', () => {
       const vis = {
-        ...visStateDef,
         params: { spec: 'this is a test' },
       };
-      const actual = buildPipelineVisFunction.vega(vis, schemasDef, uiState);
+      const actual = buildPipelineVisFunction.vega(vis.params, schemasDef, uiState);
       expect(actual).toMatchSnapshot();
     });
 
     it('handles input_control_vis function', () => {
-      const visState = {
-        ...visStateDef,
-        params: {
-          some: 'nested',
-          data: { here: true },
-        },
+      const params = {
+        some: 'nested',
+        data: { here: true },
       };
-      const actual = buildPipelineVisFunction.input_control_vis(visState, schemasDef, uiState);
+      const actual = buildPipelineVisFunction.input_control_vis(params, schemasDef, uiState);
       expect(actual).toMatchSnapshot();
     });
 
     it('handles metrics/tsvb function', () => {
-      const visState = { ...visStateDef, params: { foo: 'bar' } };
-      const actual = buildPipelineVisFunction.metrics(visState, schemasDef, uiState);
+      const params = { foo: 'bar' };
+      const actual = buildPipelineVisFunction.metrics(params, schemasDef, uiState);
       expect(actual).toMatchSnapshot();
     });
 
     it('handles timelion function', () => {
-      const visState = {
-        ...visStateDef,
-        params: { expression: 'foo', interval: 'bar' },
-      };
-      const actual = buildPipelineVisFunction.timelion(visState, schemasDef, uiState);
+      const params = { expression: 'foo', interval: 'bar' };
+      const actual = buildPipelineVisFunction.timelion(params, schemasDef, uiState);
       expect(actual).toMatchSnapshot();
     });
 
     it('handles markdown function', () => {
-      const visState = {
-        ...visStateDef,
-        params: {
-          markdown: '## hello _markdown_',
-          fontSize: 12,
-          openLinksInNewTab: true,
-          foo: 'bar',
-        },
+      const params = {
+        markdown: '## hello _markdown_',
+        fontSize: 12,
+        openLinksInNewTab: true,
+        foo: 'bar',
       };
-      const actual = buildPipelineVisFunction.markdown(visState, schemasDef, uiState);
+      const actual = buildPipelineVisFunction.markdown(params, schemasDef, uiState);
       expect(actual).toMatchSnapshot();
     });
 
     it('handles undefined markdown function', () => {
-      const visState = {
-        ...visStateDef,
-        params: { fontSize: 12, openLinksInNewTab: true, foo: 'bar' },
-      };
-      const actual = buildPipelineVisFunction.markdown(visState, schemasDef, uiState);
+      const params = { fontSize: 12, openLinksInNewTab: true, foo: 'bar' };
+      const actual = buildPipelineVisFunction.markdown(params, schemasDef, uiState);
       expect(actual).toMatchSnapshot();
     });
 
     describe('handles table function', () => {
       it('without splits or buckets', () => {
-        const visState = { ...visStateDef, params: { foo: 'bar' } };
+        const params = { foo: 'bar' };
         const schemas = {
           ...schemasDef,
           metric: [
@@ -172,22 +151,22 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
             { ...schemaConfig, accessor: 1 },
           ],
         };
-        const actual = buildPipelineVisFunction.table(visState, schemas, uiState);
+        const actual = buildPipelineVisFunction.table(params, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
 
       it('with splits', () => {
-        const visState = { ...visStateDef, params: { foo: 'bar' } };
+        const params = { foo: 'bar' };
         const schemas = {
           ...schemasDef,
           split_row: [1, 2],
         };
-        const actual = buildPipelineVisFunction.table(visState, schemas, uiState);
+        const actual = buildPipelineVisFunction.table(params, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
 
       it('with splits and buckets', () => {
-        const visState = { ...visStateDef, params: { foo: 'bar' } };
+        const params = { foo: 'bar' };
         const schemas = {
           ...schemasDef,
           metric: [
@@ -197,17 +176,14 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
           split_row: [2, 4],
           bucket: [3],
         };
-        const actual = buildPipelineVisFunction.table(visState, schemas, uiState);
+        const actual = buildPipelineVisFunction.table(params, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
 
       it('with showPartialRows=true and showMetricsAtAllLevels=true', () => {
-        const visState = {
-          ...visStateDef,
-          params: {
-            showMetricsAtAllLevels: true,
-            showPartialRows: true,
-          },
+        const params = {
+          showMetricsAtAllLevels: true,
+          showPartialRows: true,
         };
         const schemas = {
           ...schemasDef,
@@ -219,17 +195,14 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
           ],
           bucket: [0, 3],
         };
-        const actual = buildPipelineVisFunction.table(visState, schemas, uiState);
+        const actual = buildPipelineVisFunction.table(params, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
 
       it('with showPartialRows=true and showMetricsAtAllLevels=false', () => {
-        const visState = {
-          ...visStateDef,
-          params: {
-            showMetricsAtAllLevels: false,
-            showPartialRows: true,
-          },
+        const params = {
+          showMetricsAtAllLevels: false,
+          showPartialRows: true,
         };
         const schemas = {
           ...schemasDef,
@@ -241,14 +214,14 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
           ],
           bucket: [0, 3],
         };
-        const actual = buildPipelineVisFunction.table(visState, schemas, uiState);
+        const actual = buildPipelineVisFunction.table(params, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
     });
 
     describe('handles metric function', () => {
       it('without buckets', () => {
-        const visState = { ...visStateDef, params: { metric: {} } };
+        const params = { metric: {} };
         const schemas = {
           ...schemasDef,
           metric: [
@@ -256,12 +229,12 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
             { ...schemaConfig, accessor: 1 },
           ],
         };
-        const actual = buildPipelineVisFunction.metric(visState, schemas, uiState);
+        const actual = buildPipelineVisFunction.metric(params, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
 
       it('with buckets', () => {
-        const visState = { ...visStateDef, params: { metric: {} } };
+        const params = { metric: {} };
         const schemas = {
           ...schemasDef,
           metric: [
@@ -270,21 +243,21 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
           ],
           group: [{ accessor: 2 }],
         };
-        const actual = buildPipelineVisFunction.metric(visState, schemas, uiState);
+        const actual = buildPipelineVisFunction.metric(params, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
 
       it('with percentage mode should have percentage format', () => {
-        const visState = { ...visStateDef, params: { metric: { percentageMode: true } } };
+        const params = { metric: { percentageMode: true } };
         const schemas = { ...schemasDef };
-        const actual = buildPipelineVisFunction.metric(visState, schemas, uiState);
+        const actual = buildPipelineVisFunction.metric(params, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
     });
 
     describe('handles tagcloud function', () => {
       it('without buckets', () => {
-        const actual = buildPipelineVisFunction.tagcloud(visStateDef, schemasDef, uiState);
+        const actual = buildPipelineVisFunction.tagcloud({}, schemasDef, uiState);
         expect(actual).toMatchSnapshot();
       });
 
@@ -293,21 +266,21 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
           ...schemasDef,
           segment: [{ accessor: 1 }],
         };
-        const actual = buildPipelineVisFunction.tagcloud(visStateDef, schemas, uiState);
+        const actual = buildPipelineVisFunction.tagcloud({}, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
 
       it('with boolean param showLabel', () => {
-        const visState = { ...visStateDef, params: { showLabel: false } };
-        const actual = buildPipelineVisFunction.tagcloud(visState, schemasDef, uiState);
+        const params = { showLabel: false };
+        const actual = buildPipelineVisFunction.tagcloud(params, schemasDef, uiState);
         expect(actual).toMatchSnapshot();
       });
     });
 
     describe('handles region_map function', () => {
       it('without buckets', () => {
-        const visState = { ...visStateDef, params: { metric: {} } };
-        const actual = buildPipelineVisFunction.region_map(visState, schemasDef, uiState);
+        const params = { metric: {} };
+        const actual = buildPipelineVisFunction.region_map(params, schemasDef, uiState);
         expect(actual).toMatchSnapshot();
       });
 
@@ -316,19 +289,19 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
           ...schemasDef,
           segment: [1, 2],
         };
-        const actual = buildPipelineVisFunction.region_map(visStateDef, schemas, uiState);
+        const actual = buildPipelineVisFunction.region_map({}, schemas, uiState);
         expect(actual).toMatchSnapshot();
       });
     });
 
     it('handles tile_map function', () => {
-      const visState = { ...visStateDef, params: { metric: {} } };
+      const params = { metric: {} };
       const schemas = {
         ...schemasDef,
         segment: [1, 2],
         geo_centroid: [3, 4],
       };
-      const actual = buildPipelineVisFunction.tile_map(visState, schemas, uiState);
+      const actual = buildPipelineVisFunction.tile_map(params, schemas, uiState);
       expect(actual).toMatchSnapshot();
     });
 
@@ -337,7 +310,7 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
         ...schemasDef,
         segment: [1, 2],
       };
-      const actual = buildPipelineVisFunction.pie(visStateDef, schemas, uiState);
+      const actual = buildPipelineVisFunction.pie({}, schemas, uiState);
       expect(actual).toMatchSnapshot();
     });
   });
@@ -347,11 +320,16 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
 
     it('calls toExpression on vis_type if it exists', async () => {
       const vis = ({
-        getCurrentState: () => {},
-        getUiState: () => null,
+        getState: () => {},
         isHierarchical: () => false,
-        aggs: {
-          getResponseAggs: () => [],
+        data: {
+          aggs: {
+            getResponseAggs: () => [],
+          },
+          searchSource: {
+            getField: jest.fn(),
+            getParent: jest.fn(),
+          },
         },
         // @ts-ignore
         type: {
@@ -359,7 +337,6 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
         },
       } as unknown) as Vis;
       const expression = await buildPipeline(vis, {
-        searchSource: searchSourceMock,
         timefilter: dataStart.query.timefilter.timefilter,
       });
       expect(expression).toMatchSnapshot();
@@ -370,7 +347,6 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
     const dataStart = dataPluginMock.createStartContract();
 
     let aggs: IAggConfig[];
-    let visState: any;
     let vis: Vis;
     let params: any;
 
@@ -397,7 +373,11 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
 
     describe('test y dimension format for histogram chart', () => {
       beforeEach(() => {
-        visState = {
+        vis = {
+          // @ts-ignore
+          type: {
+            name: 'histogram',
+          },
           params: {
             seriesParams: [
               {
@@ -414,24 +394,16 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
               },
             ],
           },
-        };
-
-        vis = {
-          // @ts-ignore
-          type: {
-            name: 'histogram',
-          },
-          aggs: {
-            getResponseAggs: () => {
-              return aggs;
-            },
+          data: {
+            aggs: {
+              getResponseAggs: () => {
+                return aggs;
+              },
+            } as any,
           },
           isHierarchical: () => {
             return false;
           },
-          getCurrentState: () => {
-            return visState;
-          },
         };
       });
 
@@ -443,7 +415,7 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
       });
 
       it('with one numeric metric in percentage mode', async () => {
-        visState.params.valueAxes[0].scale.mode = 'percentage';
+        vis.params.valueAxes[0].scale.mode = 'percentage';
         const dimensions = await buildVislibDimensions(vis, params);
         const expected = { id: 'percent' };
         const actual = dimensions.y[0].format;
@@ -454,33 +426,31 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
         const aggConfig = aggs[0];
         aggs = [{ ...aggConfig } as IAggConfig, { ...aggConfig, id: '5' } as IAggConfig];
 
-        visState = {
-          params: {
-            seriesParams: [
-              {
-                data: { id: '0' },
-                valueAxis: 'axis-y-1',
-              },
-              {
-                data: { id: '5' },
-                valueAxis: 'axis-y-2',
-              },
-            ],
-            valueAxes: [
-              {
-                id: 'axis-y-1',
-                scale: {
-                  mode: 'normal',
-                },
+        vis.params = {
+          seriesParams: [
+            {
+              data: { id: '0' },
+              valueAxis: 'axis-y-1',
+            },
+            {
+              data: { id: '5' },
+              valueAxis: 'axis-y-2',
+            },
+          ],
+          valueAxes: [
+            {
+              id: 'axis-y-1',
+              scale: {
+                mode: 'normal',
               },
-              {
-                id: 'axis-y-2',
-                scale: {
-                  mode: 'percentage',
-                },
+            },
+            {
+              id: 'axis-y-2',
+              scale: {
+                mode: 'percentage',
               },
-            ],
-          },
+            },
+          ],
         };
 
         const dimensions = await buildVislibDimensions(vis, params);
@@ -493,29 +463,27 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
 
     describe('test y dimension format for gauge chart', () => {
       beforeEach(() => {
-        visState = { params: { gauge: {} } };
-
         vis = {
           // @ts-ignore
           type: {
             name: 'gauge',
           },
-          aggs: {
-            getResponseAggs: () => {
-              return aggs;
-            },
+          params: { gauge: {} },
+          data: {
+            aggs: {
+              getResponseAggs: () => {
+                return aggs;
+              },
+            } as any,
           },
           isHierarchical: () => {
             return false;
           },
-          getCurrentState: () => {
-            return visState;
-          },
         };
       });
 
       it('with percentageMode = false', async () => {
-        visState.params.gauge.percentageMode = false;
+        vis.params.gauge.percentageMode = false;
         const dimensions = await buildVislibDimensions(vis, params);
         const expected = { id: 'number' };
         const actual = dimensions.y[0].format;
@@ -523,7 +491,7 @@ describe('visualize loader pipeline helpers: build pipeline', () => {
       });
 
       it('with percentageMode = true', async () => {
-        visState.params.gauge.percentageMode = true;
+        vis.params.gauge.percentageMode = true;
         const dimensions = await buildVislibDimensions(vis, params);
         const expected = { id: 'percent' };
         const actual = dimensions.y[0].format;
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.ts
index de974e6e969ef..ea15cd9201fd7 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/build_pipeline.ts
@@ -21,14 +21,13 @@ import { get } from 'lodash';
 import moment from 'moment';
 import { SerializedFieldFormat } from '../../../../../../../plugins/expressions/public';
 import {
-  fieldFormats,
   IAggConfig,
-  ISearchSource,
+  fieldFormats,
   search,
   TimefilterContract,
 } from '../../../../../../../plugins/data/public';
-const { isDateHistogramBucketAggConfig } = search.aggs;
 import { Vis, VisParams } from '../types';
+const { isDateHistogramBucketAggConfig } = search.aggs;
 
 interface SchemaConfigParams {
   precision?: number;
@@ -59,7 +58,7 @@ export interface Schemas {
 }
 
 type buildVisFunction = (
-  visState: ReturnType<Vis['getCurrentState']>,
+  params: VisParams,
   schemas: Schemas,
   uiState: any,
   meta?: { savedObjectId?: string }
@@ -139,7 +138,12 @@ const getSchemas = (
   const schemas: Schemas = {
     metric: [],
   };
-  const responseAggs = vis.aggs.getResponseAggs().filter((agg: IAggConfig) => agg.enabled);
+
+  if (!vis.data.aggs) {
+    return schemas;
+  }
+
+  const responseAggs = vis.data.aggs.getResponseAggs().filter((agg: IAggConfig) => agg.enabled);
   const isHierarchical = vis.isHierarchical();
   const metrics = responseAggs.filter((agg: IAggConfig) => agg.type.type === 'metrics');
   responseAggs.forEach((agg: IAggConfig) => {
@@ -228,9 +232,8 @@ export const prepareDimension = (variable: string, data: any) => {
 };
 
 const adjustVislibDimensionFormmaters = (vis: Vis, dimensions: { y: any[] }): void => {
-  const visState = vis.getCurrentState();
-  const visConfig = visState.params;
-  const responseAggs = vis.aggs.getResponseAggs().filter((agg: IAggConfig) => agg.enabled);
+  const visConfig = vis.params;
+  const responseAggs = vis.data.aggs!.getResponseAggs().filter((agg: IAggConfig) => agg.enabled);
 
   (dimensions.y || []).forEach(yDimension => {
     const yAgg = responseAggs[yDimension.accessor];
@@ -252,27 +255,26 @@ const adjustVislibDimensionFormmaters = (vis: Vis, dimensions: { y: any[] }): vo
 };
 
 export const buildPipelineVisFunction: BuildPipelineVisFunction = {
-  vega: visState => {
-    return `vega ${prepareString('spec', visState.params.spec)}`;
+  vega: params => {
+    return `vega ${prepareString('spec', params.spec)}`;
   },
-  input_control_vis: visState => {
-    return `input_control_vis ${prepareJson('visConfig', visState.params)}`;
+  input_control_vis: params => {
+    return `input_control_vis ${prepareJson('visConfig', params)}`;
   },
-  metrics: (visState, schemas, uiState = {}, meta) => {
-    const paramsJson = prepareJson('params', visState.params);
+  metrics: (params, schemas, uiState = {}) => {
+    const paramsJson = prepareJson('params', params);
     const uiStateJson = prepareJson('uiState', uiState);
-    const savedObjectIdParam = prepareString('savedObjectId', meta?.savedObjectId);
 
-    const params = [paramsJson, uiStateJson, savedObjectIdParam].filter(param => Boolean(param));
-    return `tsvb ${params.join(' ')}`;
+    const paramsArray = [paramsJson, uiStateJson].filter(param => Boolean(param));
+    return `tsvb ${paramsArray.join(' ')}`;
   },
-  timelion: visState => {
-    const expression = prepareString('expression', visState.params.expression);
-    const interval = prepareString('interval', visState.params.interval);
+  timelion: params => {
+    const expression = prepareString('expression', params.expression);
+    const interval = prepareString('interval', params.interval);
     return `timelion_vis ${expression}${interval}`;
   },
-  markdown: visState => {
-    const { markdown, fontSize, openLinksInNewTab } = visState.params;
+  markdown: params => {
+    const { markdown, fontSize, openLinksInNewTab } = params;
     let escapedMarkdown = '';
     if (typeof markdown === 'string' || markdown instanceof String) {
       escapedMarkdown = escapeString(markdown.toString());
@@ -282,14 +284,14 @@ export const buildPipelineVisFunction: BuildPipelineVisFunction = {
     expr += prepareValue('openLinksInNewTab', openLinksInNewTab);
     return expr;
   },
-  table: (visState, schemas) => {
+  table: (params, schemas) => {
     const visConfig = {
-      ...visState.params,
-      ...buildVisConfig.table(schemas, visState.params),
+      ...params,
+      ...buildVisConfig.table(schemas, params),
     };
     return `kibana_table ${prepareJson('visConfig', visConfig)}`;
   },
-  metric: (visState, schemas) => {
+  metric: (params, schemas) => {
     const {
       percentageMode,
       useRanges,
@@ -299,11 +301,11 @@ export const buildPipelineVisFunction: BuildPipelineVisFunction = {
       labels,
       invertColors,
       style,
-    } = visState.params.metric;
+    } = params.metric;
     const { metrics, bucket } = buildVisConfig.metric(schemas).dimensions;
 
     // fix formatter for percentage mode
-    if (get(visState.params, 'metric.percentageMode') === true) {
+    if (get(params, 'metric.percentageMode') === true) {
       metrics.forEach((metric: SchemaConfig) => {
         metric.format = { id: 'percent' };
       });
@@ -335,8 +337,8 @@ export const buildPipelineVisFunction: BuildPipelineVisFunction = {
 
     return expr;
   },
-  tagcloud: (visState, schemas) => {
-    const { scale, orientation, minFontSize, maxFontSize, showLabel } = visState.params;
+  tagcloud: (params, schemas) => {
+    const { scale, orientation, minFontSize, maxFontSize, showLabel } = params;
     const { metric, bucket } = buildVisConfig.tagcloud(schemas);
     let expr = `tagcloud metric={visdimension ${metric.accessor}} `;
     expr += prepareValue('scale', scale);
@@ -348,23 +350,23 @@ export const buildPipelineVisFunction: BuildPipelineVisFunction = {
 
     return expr;
   },
-  region_map: (visState, schemas) => {
+  region_map: (params, schemas) => {
     const visConfig = {
-      ...visState.params,
+      ...params,
       ...buildVisConfig.region_map(schemas),
     };
     return `regionmap ${prepareJson('visConfig', visConfig)}`;
   },
-  tile_map: (visState, schemas) => {
+  tile_map: (params, schemas) => {
     const visConfig = {
-      ...visState.params,
+      ...params,
       ...buildVisConfig.tile_map(schemas),
     };
     return `tilemap ${prepareJson('visConfig', visConfig)}`;
   },
-  pie: (visState, schemas) => {
+  pie: (params, schemas) => {
     const visConfig = {
-      ...visState.params,
+      ...params,
       ...buildVisConfig.pie(schemas),
     };
     return `kibana_pie ${prepareJson('visConfig', visConfig)}`;
@@ -440,7 +442,6 @@ const buildVisConfig: BuildVisConfigFunction = {
 export const buildVislibDimensions = async (
   vis: any,
   params: {
-    searchSource: any;
     timefilter: TimefilterContract;
     timeRange?: any;
     abortSignal?: AbortSignal;
@@ -460,7 +461,7 @@ export const buildVislibDimensions = async (
     splitColumn: schemas.split_column,
   };
   if (schemas.segment) {
-    const xAgg = vis.aggs.getResponseAggs()[dimensions.x.accessor];
+    const xAgg = vis.data.aggs.getResponseAggs()[dimensions.x.accessor];
     if (xAgg.type.name === 'date_histogram') {
       dimensions.x.params.date = true;
       const { esUnit, esValue } = xAgg.buckets.getInterval();
@@ -472,7 +473,7 @@ export const buildVislibDimensions = async (
     } else if (xAgg.type.name === 'histogram') {
       const intervalParam = xAgg.type.paramByName('interval');
       const output = { params: {} as any };
-      await intervalParam.modifyAggConfigOnSearchRequestStart(xAgg, params.searchSource, {
+      await intervalParam.modifyAggConfigOnSearchRequestStart(xAgg, vis.data.searchSource, {
         abortSignal: params.abortSignal,
       });
       intervalParam.write(xAgg, output);
@@ -487,18 +488,14 @@ export const buildVislibDimensions = async (
 export const buildPipeline = async (
   vis: Vis,
   params: {
-    searchSource: ISearchSource;
     timefilter: TimefilterContract;
     timeRange?: any;
-    savedObjectId?: string;
   }
 ) => {
-  const { searchSource } = params;
-  const { indexPattern } = vis;
-  const query = searchSource.getField('query');
-  const filters = searchSource.getField('filter');
-  const visState = vis.getCurrentState();
-  const uiState = vis.getUiState();
+  const { indexPattern, searchSource } = vis.data;
+  const query = searchSource!.getField('query');
+  const filters = searchSource!.getField('filter');
+  const { uiState } = vis;
 
   // context
   let pipeline = `kibana | kibana_context `;
@@ -508,18 +505,18 @@ export const buildPipeline = async (
   if (filters) {
     pipeline += prepareJson('filters', filters);
   }
-  if (vis.savedSearchId) {
-    pipeline += prepareString('savedSearchId', vis.savedSearchId);
+  if (vis.data.savedSearchId) {
+    pipeline += prepareString('savedSearchId', vis.data.savedSearchId);
   }
   pipeline += '| ';
 
   // request handler
   if (vis.type.requestHandler === 'courier') {
     pipeline += `esaggs
-    ${prepareString('index', indexPattern.id)}
+    ${prepareString('index', indexPattern!.id)}
     metricsAtAllLevels=${vis.isHierarchical()}
     partialRows=${vis.type.requiresPartialRows || vis.params.showPartialRows || false}
-    ${prepareJson('aggConfigs', visState.aggs)} | `;
+    ${prepareJson('aggConfigs', vis.data.aggs!.aggs)} | `;
   }
 
   const schemas = getSchemas(vis, {
@@ -527,18 +524,16 @@ export const buildPipeline = async (
     timefilter: params.timefilter,
   });
   if (buildPipelineVisFunction[vis.type.name]) {
-    pipeline += buildPipelineVisFunction[vis.type.name](visState, schemas, uiState, {
-      savedObjectId: params.savedObjectId,
-    });
+    pipeline += buildPipelineVisFunction[vis.type.name](vis.params, schemas, uiState);
   } else if (vislibCharts.includes(vis.type.name)) {
-    const visConfig = visState.params;
+    const visConfig = { ...vis.params };
     visConfig.dimensions = await buildVislibDimensions(vis, params);
 
-    pipeline += `vislib type='${vis.type.name}' ${prepareJson('visConfig', visState.params)}`;
+    pipeline += `vislib type='${vis.type.name}' ${prepareJson('visConfig', visConfig)}`;
   } else if (vis.type.toExpression) {
     pipeline += await vis.type.toExpression(vis, params);
   } else {
-    const visConfig = visState.params;
+    const visConfig = { ...vis.params };
     visConfig.dimensions = schemas;
     pipeline += `visualization type='${vis.type.name}'
     ${prepareJson('visConfig', visConfig)}
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/update_status.test.js b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/update_status.test.js
deleted file mode 100644
index c63a8cd48e625..0000000000000
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/update_status.test.js
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { getUpdateStatus, Status } from './update_status';
-
-// Parts of the tests in this file are generated more dynamically, based on the
-// values inside the Status object.Make sure this object has one function per entry
-// in Status, that actually change on the passed $scope, what needs to be changed
-// so that we expect the getUpdateStatus function to actually detect a change.
-const changeFunctions = {
-  [Status.AGGS]: $scope => ($scope.vis.aggs = { foo: 'new' }),
-  [Status.DATA]: $scope => ($scope.visData = { foo: 'new' }),
-  [Status.PARAMS]: $scope => ($scope.vis.params = { foo: 'new' }),
-  [Status.RESIZE]: $scope => ($scope.vis.size = [50, 50]),
-  [Status.TIME]: $scope => ($scope.vis.filters.timeRange = { from: 'now-7d', to: 'now' }),
-  [Status.UI_STATE]: $scope => ($scope.uiState = { foo: 'new' }),
-};
-
-describe('getUpdateStatus', () => {
-  function getScope() {
-    return {
-      vis: {
-        aggs: {},
-        size: [100, 100],
-        params: {},
-        filters: {},
-      },
-      uiState: {},
-      visData: {},
-    };
-  }
-
-  function initStatusCheckerAndChangeProperty(type, requiresUpdateStatus) {
-    const $scope = getScope();
-    // Call the getUpdateStatus function initially, so it can store it's current state
-    getUpdateStatus(requiresUpdateStatus, $scope, $scope);
-
-    // Get the change function for that specific change type
-    const changeFn = changeFunctions[type];
-    if (!changeFn) {
-      throw new Error(`Please implement the test change function for ${type}.`);
-    }
-
-    // Call that change function to manipulate the scope so it changed.
-    changeFn($scope);
-
-    return getUpdateStatus(requiresUpdateStatus, $scope, $scope);
-  }
-
-  it('should be a function', () => {
-    expect(typeof getUpdateStatus).toBe('function');
-  });
-
-  Object.entries(Status).forEach(([typeKey, typeValue]) => {
-    // This block automatically creates very simple tests for each of the Status
-    // keys, so we have simple tests per changed property.
-    // If it makes sense to test more specific behavior of a specific change detection
-    // please add additional tests for that.
-
-    it(`should detect changes for Status.${typeKey}`, () => {
-      // Check whether the required change type is not correctly determined
-      const status = initStatusCheckerAndChangeProperty(typeValue, [typeValue]);
-      expect(status[typeValue]).toBe(true);
-    });
-
-    it(`should not detect changes in other properties when changing Status.${typeKey}`, () => {
-      // Only change typeKey, but track changes for all status changes
-      const status = initStatusCheckerAndChangeProperty(typeValue, Object.values(Status));
-      Object.values(Status)
-        // Filter out the actual changed property so we only test for all other properties
-        .filter(stat => stat !== typeValue)
-        .forEach(otherProp => {
-          expect(status[otherProp]).toBeFalsy();
-        });
-    });
-
-    it(`should not detect changes if not requested for Status.${typeKey}`, () => {
-      const allOtherStatusProperties = Object.values(Status).filter(stat => stat !== typeValue);
-      // Change only the typeKey property, but do not listen for changes on it
-      // listen on all other status changes instead.
-      const status = initStatusCheckerAndChangeProperty(typeValue, allOtherStatusProperties);
-      // The typeValue check should be falsy, since we did not request tracking it.
-      expect(status[typeValue]).toBeFalsy();
-    });
-  });
-});
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/update_status.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/update_status.ts
deleted file mode 100644
index 92a9ce8366f4f..0000000000000
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/legacy/update_status.ts
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { PersistedState } from '../../../../../../../plugins/visualizations/public';
-import { calculateObjectHash } from '../../../../../../../plugins/kibana_utils/common';
-import { Vis } from '../vis';
-
-enum Status {
-  AGGS = 'aggs',
-  DATA = 'data',
-  PARAMS = 'params',
-  RESIZE = 'resize',
-  TIME = 'time',
-  UI_STATE = 'uiState',
-}
-
-/**
- * Checks whether the hash of a specific key in the given oldStatus has changed
- * compared to the new valueHash passed.
- */
-function hasHashChanged<T extends string>(
-  valueHash: string,
-  oldStatus: { [key in T]?: string },
-  name: T
-): boolean {
-  const oldHash = oldStatus[name];
-  return oldHash !== valueHash;
-}
-
-interface Size {
-  width: number;
-  height: number;
-}
-
-function hasSizeChanged(size: Size, oldSize?: Size): boolean {
-  if (!oldSize) {
-    return true;
-  }
-  return oldSize.width !== size.width || oldSize.height !== size.height;
-}
-
-function getUpdateStatus<T extends Status>(
-  requiresUpdateStatus: T[] = [],
-  obj: any,
-  param: { vis: Vis; visData: any; uiState: PersistedState }
-): { [reqStats in T]: boolean } {
-  const status = {} as { [reqStats in Status]: boolean };
-
-  // If the vis type doesn't need update status, skip all calculations
-  if (requiresUpdateStatus.length === 0) {
-    return status;
-  }
-
-  if (!obj._oldStatus) {
-    obj._oldStatus = {};
-  }
-
-  for (const requiredStatus of requiresUpdateStatus) {
-    let hash;
-    // Calculate all required status updates for this visualization
-    switch (requiredStatus) {
-      case Status.AGGS:
-        hash = calculateObjectHash(param.vis.aggs);
-        status.aggs = hasHashChanged(hash, obj._oldStatus, 'aggs');
-        obj._oldStatus.aggs = hash;
-        break;
-      case Status.DATA:
-        hash = calculateObjectHash(param.visData);
-        status.data = hasHashChanged(hash, obj._oldStatus, 'data');
-        obj._oldStatus.data = hash;
-        break;
-      case Status.PARAMS:
-        hash = calculateObjectHash(param.vis.params);
-        status.params = hasHashChanged(hash, obj._oldStatus, 'param');
-        obj._oldStatus.param = hash;
-        break;
-      case Status.RESIZE:
-        const width: number = param.vis.size ? param.vis.size[0] : 0;
-        const height: number = param.vis.size ? param.vis.size[1] : 0;
-        const size = { width, height };
-        status.resize = hasSizeChanged(size, obj._oldStatus.resize);
-        obj._oldStatus.resize = size;
-        break;
-      case Status.TIME:
-        const timeRange = param.vis.filters && param.vis.filters.timeRange;
-        hash = calculateObjectHash(timeRange);
-        status.time = hasHashChanged(hash, obj._oldStatus, 'time');
-        obj._oldStatus.time = hash;
-        break;
-      case Status.UI_STATE:
-        hash = calculateObjectHash(param.uiState);
-        status.uiState = hasHashChanged(hash, obj._oldStatus, 'uiState');
-        obj._oldStatus.uiState = hash;
-        break;
-    }
-  }
-
-  return status;
-}
-
-export { getUpdateStatus, Status };
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts
index 4ee727e46f4d6..17f777e4e80e1 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/mocks.ts
@@ -41,6 +41,8 @@ const createStartContract = (): VisualizationsStart => ({
   savedVisualizationsLoader: {} as any,
   showNewVisModal: jest.fn(),
   createVis: jest.fn(),
+  convertFromSerializedVis: jest.fn(),
+  convertToSerializedVis: jest.fn(),
 });
 
 const createInstance = async () => {
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts
index 953caecefb974..3ade6cee0d4d2 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/plugin.ts
@@ -39,6 +39,8 @@ import {
   setSavedVisualizationsLoader,
   setTimeFilter,
   setAggs,
+  setChrome,
+  setOverlays,
 } from './services';
 import { VISUALIZE_EMBEDDABLE_TYPE, VisualizeEmbeddableFactory } from './embeddable';
 import { ExpressionsSetup, ExpressionsStart } from '../../../../../../plugins/expressions/public';
@@ -48,14 +50,16 @@ import { visualization as visualizationRenderer } from './expressions/visualizat
 import {
   DataPublicPluginSetup,
   DataPublicPluginStart,
-  IIndexPattern,
 } from '../../../../../../plugins/data/public';
 import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/public';
 import { createSavedVisLoader, SavedVisualizationsLoader } from './saved_visualizations';
-import { VisImpl } from './vis_impl';
+import { SerializedVis, Vis } from './vis';
 import { showNewVisModal } from './wizard';
 import { UiActionsStart } from '../../../../../../plugins/ui_actions/public';
-import { VisState } from './types';
+import {
+  convertFromSerializedVis,
+  convertToSerializedVis,
+} from './saved_visualizations/_saved_vis';
 
 /**
  * Interface for this plugin's returned setup/start contracts.
@@ -67,7 +71,9 @@ export type VisualizationsSetup = TypesSetup;
 
 export interface VisualizationsStart extends TypesStart {
   savedVisualizationsLoader: SavedVisualizationsLoader;
-  createVis: (indexPattern: IIndexPattern, visState?: VisState) => VisImpl;
+  createVis: (visType: string, visState?: SerializedVis) => Vis;
+  convertToSerializedVis: typeof convertToSerializedVis;
+  convertFromSerializedVis: typeof convertFromSerializedVis;
   showNewVisModal: typeof showNewVisModal;
 }
 
@@ -138,6 +144,8 @@ export class VisualizationsPlugin
     setUiActions(uiActions);
     setTimeFilter(data.query.timefilter.timefilter);
     setAggs(data.search.aggs);
+    setOverlays(core.overlays);
+    setChrome(core.chrome);
     const savedVisualizationsLoader = createSavedVisLoader({
       savedObjectsClient: core.savedObjects.client,
       indexPatterns: data.indexPatterns,
@@ -155,8 +163,9 @@ export class VisualizationsPlugin
        * @param {IIndexPattern} indexPattern - index pattern to use
        * @param {VisState} visState - visualization configuration
        */
-      createVis: (indexPattern: IIndexPattern, visState?: VisState) =>
-        new VisImpl(indexPattern, visState),
+      createVis: (visType: string, visState?: SerializedVis) => new Vis(visType, visState),
+      convertToSerializedVis,
+      convertFromSerializedVis,
       savedVisualizationsLoader,
     };
   }
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/saved_visualizations/_saved_vis.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/saved_visualizations/_saved_vis.ts
index e381a01edef8b..c9906428ccb31 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/saved_visualizations/_saved_vis.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/saved_visualizations/_saved_vis.ts
@@ -32,65 +32,74 @@ import {
 // @ts-ignore
 import { updateOldState } from '../legacy/vis_update_state';
 import { extractReferences, injectReferences } from './saved_visualization_references';
-import { IIndexPattern } from '../../../../../../../plugins/data/public';
-import { VisSavedObject } from '../types';
-import { VisImpl } from '../vis_impl';
+import {
+  IIndexPattern,
+  ISearchSource,
+  SearchSource,
+} from '../../../../../../../plugins/data/public';
+import { ISavedVis, SerializedVis } from '../types';
 import { createSavedSearchesLoader } from '../../../../../../../plugins/discover/public';
-
-async function _afterEsResp(savedVis: VisSavedObject, services: any) {
-  await _getLinkedSavedSearch(savedVis, services);
-  savedVis.searchSource!.setField('size', 0);
-  savedVis.vis = savedVis.vis ? _updateVis(savedVis) : await _createVis(savedVis);
-  return savedVis;
-}
-
-async function _getLinkedSavedSearch(savedVis: VisSavedObject, services: any) {
-  const linkedSearch = !!savedVis.savedSearchId;
-  const current = savedVis.savedSearch;
-
-  if (linkedSearch && current && current.id === savedVis.savedSearchId) {
-    return;
-  }
-
-  if (savedVis.savedSearch) {
-    savedVis.searchSource!.setParent(savedVis.savedSearch.searchSource.getParent());
-    savedVis.savedSearch.destroy();
-    delete savedVis.savedSearch;
-  }
-  const savedSearches = createSavedSearchesLoader(services);
-
-  if (linkedSearch) {
-    savedVis.savedSearch = await savedSearches.get(savedVis.savedSearchId!);
-    savedVis.searchSource!.setParent(savedVis.savedSearch!.searchSource);
-  }
-}
-
-async function _createVis(savedVis: VisSavedObject) {
-  savedVis.visState = updateOldState(savedVis.visState);
-
-  // visState doesn't yet exist when importing a visualization, so we can't
-  // assume that exists at this point. If it does exist, then we're not
-  // importing a visualization, so we want to sync the title.
-  if (savedVis.visState) {
-    savedVis.visState.title = savedVis.title;
-  }
-
-  savedVis.vis = new VisImpl(savedVis.searchSource!.getField('index')!, savedVis.visState);
-
-  savedVis.vis!.savedSearchId = savedVis.savedSearchId;
-
-  return savedVis.vis;
-}
-
-function _updateVis(savedVis: VisSavedObject) {
-  if (savedVis.vis && savedVis.searchSource) {
-    savedVis.vis.indexPattern = savedVis.searchSource.getField('index');
-    savedVis.visState.title = savedVis.title;
-    savedVis.vis.setState(savedVis.visState);
-    savedVis.vis.savedSearchId = savedVis.savedSearchId;
+import { getChrome, getOverlays, getIndexPatterns, getSavedObjects } from '../services';
+
+export const convertToSerializedVis = async (savedVis: ISavedVis): Promise<SerializedVis> => {
+  const { visState } = savedVis;
+  const searchSource =
+    savedVis.searchSource && (await getSearchSource(savedVis.searchSource, savedVis.savedSearchId));
+
+  const indexPattern =
+    searchSource && searchSource.getField('index') ? searchSource.getField('index')!.id : undefined;
+
+  const aggs = indexPattern ? visState.aggs || [] : visState.aggs;
+
+  return {
+    id: savedVis.id,
+    title: savedVis.title,
+    type: visState.type,
+    description: savedVis.description,
+    params: visState.params,
+    uiState: JSON.parse(savedVis.uiStateJSON || '{}'),
+    data: {
+      indexPattern,
+      aggs,
+      searchSource,
+      savedSearchId: savedVis.savedSearchId,
+    },
+  };
+};
+
+export const convertFromSerializedVis = (vis: SerializedVis): ISavedVis => {
+  return {
+    id: vis.id,
+    title: vis.title,
+    description: vis.description,
+    visState: {
+      type: vis.type,
+      aggs: vis.data.aggs,
+      params: vis.params,
+    },
+    uiStateJSON: JSON.stringify(vis.uiState),
+    searchSource: vis.data.searchSource!,
+    savedSearchId: vis.data.savedSearchId,
+  };
+};
+
+const getSearchSource = async (inputSearchSource: ISearchSource, savedSearchId?: string) => {
+  const searchSource = inputSearchSource.createCopy
+    ? inputSearchSource.createCopy()
+    : new SearchSource({ ...(inputSearchSource as any).fields });
+  if (savedSearchId) {
+    const savedSearch = await createSavedSearchesLoader({
+      savedObjectsClient: getSavedObjects().client,
+      indexPatterns: getIndexPatterns(),
+      chrome: getChrome(),
+      overlays: getOverlays(),
+    }).get(savedSearchId);
+
+    searchSource.setParent(savedSearch.searchSource);
   }
-  return savedVis.vis;
-}
+  searchSource!.setField('size', 0);
+  return searchSource;
+};
 
 export function createSavedVisClass(services: SavedObjectKibanaServices) {
   const SavedObjectClass = createSavedObjectClass(services);
@@ -131,8 +140,16 @@ export function createSavedVisClass(services: SavedObjectKibanaServices) {
           savedSearchId: opts.savedSearchId,
           version: 1,
         },
-        afterESResp: (savedObject: SavedObject) => {
-          return _afterEsResp(savedObject as VisSavedObject, services) as Promise<SavedObject>;
+        afterESResp: async (savedObject: SavedObject) => {
+          const savedVis = (savedObject as any) as ISavedVis;
+          savedVis.visState = await updateOldState(savedVis.visState);
+          if (savedVis.savedSearchId && savedVis.searchSource) {
+            savedObject.searchSource = await getSearchSource(
+              savedVis.searchSource,
+              savedVis.savedSearchId
+            );
+          }
+          return (savedVis as any) as SavedObject;
         },
       });
       this.showInRecentlyAccessed = true;
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/saved_visualizations/saved_visualization_references.test.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/saved_visualizations/saved_visualization_references.test.ts
index 98af6d99025c2..2e3a4f0f58b27 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/saved_visualizations/saved_visualization_references.test.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/saved_visualizations/saved_visualization_references.test.ts
@@ -18,7 +18,7 @@
  */
 
 import { extractReferences, injectReferences } from './saved_visualization_references';
-import { VisSavedObject, VisState } from '../types';
+import { VisSavedObject, SavedVisState } from '../types';
 
 describe('extractReferences', () => {
   test('extracts nothing if savedSearchId is empty', () => {
@@ -140,7 +140,7 @@ Object {
             },
           ],
         },
-      } as unknown) as VisState,
+      } as unknown) as SavedVisState,
     } as VisSavedObject;
     const references = [
       {
@@ -201,7 +201,7 @@ Object {
             },
           ],
         },
-      } as unknown) as VisState,
+      } as unknown) as SavedVisState,
     } as VisSavedObject;
     expect(() => injectReferences(context, [])).toThrowErrorMatchingInlineSnapshot(
       `"Could not find index pattern reference \\"control_0_index_pattern\\""`
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/services.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/services.ts
index b2eebe8b5b57d..23cdeae7d15ff 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/services.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/services.ts
@@ -18,10 +18,13 @@
  */
 
 import {
+  ApplicationStart,
   Capabilities,
+  ChromeStart,
   HttpStart,
   I18nStart,
   IUiSettingsClient,
+  OverlayStart,
   SavedObjectsStart,
 } from '../../../../../../core/public';
 import { TypesStart } from './vis_types';
@@ -76,3 +79,9 @@ export const [getSavedVisualizationsLoader, setSavedVisualizationsLoader] = crea
 export const [getAggs, setAggs] = createGetterSetter<DataPublicPluginStart['search']['aggs']>(
   'AggConfigs'
 );
+
+export const [getOverlays, setOverlays] = createGetterSetter<OverlayStart>('Overlays');
+
+export const [getChrome, setChrome] = createGetterSetter<ChromeStart>('Chrome');
+
+export const [getApplication, setApplication] = createGetterSetter<ApplicationStart>('Application');
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/types.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/types.ts
index d8e3ccdeb065e..8f93a179af3bc 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/types.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/types.ts
@@ -18,21 +18,33 @@
  */
 
 import { SavedObject } from '../../../../../../plugins/saved_objects/public';
-import { Vis, VisState, VisParams, VisualizationController } from './vis';
-import { ISearchSource } from '../../../../../../plugins/data/public/';
-import { SavedSearch } from '../../../../../../plugins/discover/public';
+import { ISearchSource, AggConfigOptions } from '../../../../../../plugins/data/public';
+import { SerializedVis, Vis, VisParams } from './vis';
 
-export { Vis, VisState, VisParams, VisualizationController };
+export { Vis, SerializedVis, VisParams };
 
-export interface VisSavedObject extends SavedObject {
-  vis: Vis;
-  description?: string;
-  searchSource: ISearchSource;
+export interface VisualizationController {
+  render(visData: any, visParams: any): Promise<void>;
+  destroy(): void;
+  isLoaded?(): Promise<void> | void;
+}
+
+export interface SavedVisState {
+  type: string;
+  params: VisParams;
+  aggs: AggConfigOptions[];
+}
+
+export interface ISavedVis {
+  id: string;
   title: string;
+  description?: string;
+  visState: SavedVisState;
+  searchSource?: ISearchSource;
   uiStateJSON?: string;
-  destroy: () => void;
   savedSearchRefName?: string;
   savedSearchId?: string;
-  savedSearch?: SavedSearch;
-  visState: VisState;
 }
+
+// @ts-ignore-next-line
+export interface VisSavedObject extends SavedObject, ISavedVis {}
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.ts
index eb262966a4a22..0ba936c9f6567 100644
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.ts
+++ b/src/legacy/core_plugins/visualizations/public/np_ready/public/vis.ts
@@ -17,47 +17,182 @@
  * under the License.
  */
 
+/**
+ * @name Vis
+ *
+ * @description This class consists of aggs, params, listeners, title, and type.
+ *  - Aggs: Instances of IAggConfig.
+ *  - Params: The settings in the Options tab.
+ *
+ * Not to be confused with vislib/vis.js.
+ */
+
+import { isFunction, defaults, cloneDeep } from 'lodash';
+import { PersistedState } from '../../../../../../../src/plugins/visualizations/public';
+// @ts-ignore
+import { updateVisualizationConfig } from './legacy/vis_update';
+import { getTypes, getAggs } from './services';
 import { VisType } from './vis_types';
-import { Status } from './legacy/update_status';
-import { IAggConfigs } from '../../../../../../plugins/data/public';
-
-export interface Vis {
-  type: VisType;
-  getCurrentState: (
-    includeDisabled?: boolean
-  ) => {
-    title: string;
-    type: string;
-    params: VisParams;
-    aggs: Array<{ [key: string]: any }>;
-  };
-
-  /**
-   * If a visualization based on the saved search,
-   * the id is necessary for building an expression function in src/plugins/expressions/common/expression_functions/specs/kibana_context.ts
-   */
+import {
+  IAggConfigs,
+  IndexPattern,
+  ISearchSource,
+  AggConfigOptions,
+} from '../../../../../../plugins/data/public';
+
+export interface SerializedVisData {
+  expression?: string;
+  aggs: AggConfigOptions[];
+  indexPattern?: string;
+  searchSource?: ISearchSource;
   savedSearchId?: string;
+}
 
-  // Since we haven't typed everything here yet, we basically "any" the rest
-  // of that interface. This should be removed as soon as this type definition
-  // has been completed. But that way we at least have typing for a couple of
-  // properties on that type.
-  [key: string]: any;
+export interface SerializedVis {
+  id: string;
+  title: string;
+  description?: string;
+  type: string;
+  params: VisParams;
+  uiState?: any;
+  data: SerializedVisData;
+}
+
+export interface VisData {
+  ast?: string;
+  aggs?: IAggConfigs;
+  indexPattern?: IndexPattern;
+  searchSource?: ISearchSource;
+  savedSearchId?: string;
 }
 
 export interface VisParams {
   [key: string]: any;
 }
 
-export interface VisState {
-  title: string;
-  type: VisType;
-  params: VisParams;
-  aggs: IAggConfigs;
-}
+export class Vis {
+  public readonly type: VisType;
+  public readonly id: string;
+  public title: string = '';
+  public description: string = '';
+  public params: VisParams = {};
+  // Session state is for storing information that is transitory, and will not be saved with the visualization.
+  // For instance, map bounds, which depends on the view port, browser window size, etc.
+  public sessionState: Record<string, any> = {};
+  public data: VisData = {};
+
+  public readonly uiState: PersistedState;
+
+  constructor(visType: string, visState: SerializedVis = {} as any) {
+    this.type = this.getType(visType);
+    this.params = this.getParams(visState.params);
+    this.uiState = new PersistedState(visState.uiState);
+    this.id = visState.id;
+
+    this.setState(visState || {});
+  }
+
+  private getType(visType: string) {
+    const type = getTypes().get(visType);
+    if (!type) {
+      throw new Error(`Invalid type "${visType}"`);
+    }
+    return type;
+  }
+
+  private getParams(params: VisParams) {
+    return defaults({}, cloneDeep(params || {}), cloneDeep(this.type.visConfig.defaults || {}));
+  }
+
+  setState(state: SerializedVis) {
+    let typeChanged = false;
+    if (state.type && this.type.name !== state.type) {
+      // @ts-ignore
+      this.type = this.getType(state.type);
+      typeChanged = true;
+    }
+    if (state.title !== undefined) {
+      this.title = state.title;
+    }
+    if (state.description !== undefined) {
+      this.description = state.description;
+    }
+    if (state.params || typeChanged) {
+      this.params = this.getParams(state.params);
+    }
+
+    // move to migration script
+    updateVisualizationConfig(state.params, this.params);
+
+    if (state.data && state.data.searchSource) {
+      this.data.searchSource = state.data.searchSource!;
+      this.data.indexPattern = this.data.searchSource.getField('index');
+    }
+    if (state.data && state.data.savedSearchId) {
+      this.data.savedSearchId = state.data.savedSearchId;
+    }
+    if (state.data && state.data.aggs) {
+      let configStates = state.data.aggs;
+      configStates = this.initializeDefaultsFromSchemas(configStates, this.type.schemas.all || []);
+      if (!this.data.indexPattern) {
+        if (state.data.aggs.length) {
+          throw new Error('trying to initialize aggs without index pattern');
+        }
+        return;
+      }
+      this.data.aggs = getAggs().createAggConfigs(this.data.indexPattern, configStates);
+    }
+  }
+
+  clone() {
+    return new Vis(this.type.name, this.serialize());
+  }
+
+  serialize(): SerializedVis {
+    const aggs = this.data.aggs ? this.data.aggs.aggs.map(agg => agg.toJSON()) : [];
+    const indexPattern = this.data.searchSource && this.data.searchSource.getField('index');
+    return {
+      id: this.id,
+      title: this.title,
+      type: this.type.name,
+      params: cloneDeep(this.params) as any,
+      uiState: this.uiState.toJSON(),
+      data: {
+        aggs: aggs as any,
+        indexPattern: indexPattern ? indexPattern.id : undefined,
+        searchSource: this.data.searchSource!.createCopy(),
+        savedSearchId: this.data.savedSearchId,
+      },
+    };
+  }
+
+  toAST() {
+    return this.type.toAST(this.params);
+  }
+
+  // deprecated
+  isHierarchical() {
+    if (isFunction(this.type.hierarchicalData)) {
+      return !!this.type.hierarchicalData(this);
+    } else {
+      return !!this.type.hierarchicalData;
+    }
+  }
 
-export interface VisualizationController {
-  render(visData: any, visParams: any, update: { [key in Status]: boolean }): Promise<void>;
-  destroy(): void;
-  isLoaded?(): Promise<void> | void;
+  private initializeDefaultsFromSchemas(configStates: AggConfigOptions[], schemas: any) {
+    // Set the defaults for any schema which has them. If the defaults
+    // for some reason has more then the max only set the max number
+    // of defaults (not sure why a someone define more...
+    // but whatever). Also if a schema.name is already set then don't
+    // set anything.
+    const newConfigs = [...configStates];
+    schemas
+      .filter((schema: any) => Array.isArray(schema.defaults) && schema.defaults.length > 0)
+      .filter((schema: any) => !configStates.find(agg => agg.schema && agg.schema === schema.name))
+      .forEach((schema: any) => {
+        const defaultSchemaConfig = schema.defaults.slice(0, schema.max);
+        defaultSchemaConfig.forEach((d: any) => newConfigs.push(d));
+      });
+    return newConfigs;
+  }
 }
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis_impl.d.ts b/src/legacy/core_plugins/visualizations/public/np_ready/public/vis_impl.d.ts
deleted file mode 100644
index 0e759c3d9872c..0000000000000
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis_impl.d.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-import { Vis, VisState, VisParams } from './vis';
-import { VisType } from './vis_types';
-import { IAggConfig, IIndexPattern } from '../../../../../../plugins/data/public';
-import { Schema } from '../../../../vis_default_editor/public';
-
-type InitVisStateType =
-  | Partial<VisState>
-  | Partial<Omit<VisState, 'type'> & { type: string }>
-  | string;
-
-export type VisImplConstructor = new (
-  indexPattern: IIndexPattern,
-  visState?: InitVisStateType
-) => VisImpl;
-
-export declare class VisImpl implements Vis {
-  constructor(indexPattern: IIndexPattern, visState?: InitVisStateType);
-
-  type: VisType;
-  getCurrentState: (
-    includeDisabled?: boolean
-  ) => {
-    title: string;
-    type: string;
-    params: VisParams;
-    aggs: Array<{ [key: string]: any }>;
-  };
-
-  private initializeDefaultsFromSchemas(configStates: IAggConfig[], schemas: Schema[]);
-
-  // Since we haven't typed everything here yet, we basically "any" the rest
-  // of that interface. This should be removed as soon as this type definition
-  // has been completed. But that way we at least have typing for a couple of
-  // properties on that type.
-  [key: string]: any;
-}
diff --git a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis_impl.js b/src/legacy/core_plugins/visualizations/public/np_ready/public/vis_impl.js
deleted file mode 100644
index abd8f351ae94d..0000000000000
--- a/src/legacy/core_plugins/visualizations/public/np_ready/public/vis_impl.js
+++ /dev/null
@@ -1,223 +0,0 @@
-/*
- * Licensed to Elasticsearch B.V. under one or more contributor
- * license agreements. See the NOTICE file distributed with
- * this work for additional information regarding copyright
- * ownership. Elasticsearch B.V. licenses this file to you under
- * the Apache License, Version 2.0 (the "License"); you may
- * not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *    http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied.  See the License for the
- * specific language governing permissions and limitations
- * under the License.
- */
-
-/**
- * @name Vis
- *
- * @description This class consists of aggs, params, listeners, title, and type.
- *  - Aggs: Instances of IAggConfig.
- *  - Params: The settings in the Options tab.
- *
- * Not to be confused with vislib/vis.js.
- */
-
-import { EventEmitter } from 'events';
-import _ from 'lodash';
-import { PersistedState } from '../../../../../../../src/plugins/visualizations/public';
-import { updateVisualizationConfig } from './legacy/vis_update';
-import { getTypes, getAggs } from './services';
-
-class VisImpl extends EventEmitter {
-  constructor(indexPattern, visState) {
-    super();
-    visState = visState || {};
-
-    if (_.isString(visState)) {
-      visState = {
-        type: visState,
-      };
-    }
-
-    this.indexPattern = indexPattern;
-    this._setUiState(new PersistedState());
-    this.setCurrentState(visState);
-    this.setState(this.getCurrentState(), false);
-
-    // Session state is for storing information that is transitory, and will not be saved with the visualization.
-    // For instance, map bounds, which depends on the view port, browser window size, etc.
-    this.sessionState = {};
-
-    this.API = {
-      events: {
-        filter: data => this.eventsSubject.next({ name: 'filterBucket', data }),
-        brush: data => this.eventsSubject.next({ name: 'brush', data }),
-      },
-    };
-  }
-
-  initializeDefaultsFromSchemas(configStates, schemas) {
-    // Set the defaults for any schema which has them. If the defaults
-    // for some reason has more then the max only set the max number
-    // of defaults (not sure why a someone define more...
-    // but whatever). Also if a schema.name is already set then don't
-    // set anything.
-    const newConfigs = [...configStates];
-    schemas
-      .filter(schema => Array.isArray(schema.defaults) && schema.defaults.length > 0)
-      .filter(schema => !configStates.find(agg => agg.schema && agg.schema === schema.name))
-      .forEach(schema => {
-        const defaults = schema.defaults.slice(0, schema.max);
-        defaults.forEach(d => newConfigs.push(d));
-      });
-    return newConfigs;
-  }
-
-  setCurrentState(state) {
-    this.title = state.title || '';
-    const type = state.type || this.type;
-    if (_.isString(type)) {
-      this.type = getTypes().get(type);
-      if (!this.type) {
-        throw new Error(`Invalid type "${type}"`);
-      }
-    } else {
-      this.type = type;
-    }
-
-    this.params = _.defaults(
-      {},
-      _.cloneDeep(state.params || {}),
-      _.cloneDeep(this.type.visConfig.defaults || {})
-    );
-
-    updateVisualizationConfig(state.params, this.params);
-
-    if (state.aggs || !this.aggs) {
-      let configStates = state.aggs ? state.aggs.aggs || state.aggs : [];
-      configStates = this.initializeDefaultsFromSchemas(configStates, this.type.schemas.all || []);
-      this.aggs = getAggs().createAggConfigs(this.indexPattern, configStates);
-    }
-  }
-
-  setState(state, updateCurrentState = true) {
-    this._state = _.cloneDeep(state);
-    if (updateCurrentState) {
-      this.setCurrentState(this._state);
-    }
-  }
-
-  setVisType(type) {
-    this.type.type = type;
-  }
-
-  updateState() {
-    this.setState(this.getCurrentState(true));
-    this.emit('update');
-  }
-
-  forceReload() {
-    this.emit('reload');
-  }
-
-  getCurrentState(includeDisabled) {
-    return {
-      title: this.title,
-      type: this.type.name,
-      params: _.cloneDeep(this.params),
-      aggs: this.aggs.aggs
-        .map(agg => agg.toJSON())
-        .filter(agg => includeDisabled || agg.enabled)
-        .filter(Boolean),
-    };
-  }
-
-  copyCurrentState(includeDisabled = false) {
-    const state = this.getCurrentState(includeDisabled);
-    state.aggs = getAggs().createAggConfigs(
-      this.indexPattern,
-      state.aggs.aggs || state.aggs,
-      this.type.schemas.all
-    );
-    return state;
-  }
-
-  getStateInternal(includeDisabled) {
-    return {
-      title: this._state.title,
-      type: this._state.type,
-      params: this._state.params,
-      aggs: this._state.aggs.filter(agg => includeDisabled || agg.enabled),
-    };
-  }
-
-  getEnabledState() {
-    return this.getStateInternal(false);
-  }
-
-  getAggConfig() {
-    return this.aggs.clone({ enabledOnly: true });
-  }
-
-  getState() {
-    return this.getStateInternal(true);
-  }
-
-  isHierarchical() {
-    if (_.isFunction(this.type.hierarchicalData)) {
-      return !!this.type.hierarchicalData(this);
-    } else {
-      return !!this.type.hierarchicalData;
-    }
-  }
-
-  hasSchemaAgg(schemaName, aggTypeName) {
-    const aggs = this.aggs.bySchemaName(schemaName) || [];
-    return aggs.some(function(agg) {
-      if (!agg.type || !agg.type.name) return false;
-      return agg.type.name === aggTypeName;
-    });
-  }
-
-  hasUiState() {
-    return !!this.__uiState;
-  }
-
-  /***
-   * this should not be used outside of visualize
-   * @param uiState
-   * @private
-   */
-  _setUiState(uiState) {
-    if (uiState instanceof PersistedState) {
-      this.__uiState = uiState;
-    }
-  }
-
-  getUiState() {
-    return this.__uiState;
-  }
-
-  /**
-   * Currently this is only used to extract map-specific information
-   * (e.g. mapZoom, mapCenter).
-   */
-  uiStateVal(key, val) {
-    if (this.hasUiState()) {
-      if (_.isUndefined(val)) {
-        return this.__uiState.get(key);
-      }
-      return this.__uiState.set(key, val);
-    }
-    return val;
-  }
-}
-
-VisImpl.prototype.type = 'histogram';
-
-export { VisImpl };
diff --git a/src/legacy/server/config/schema.js b/src/legacy/server/config/schema.js
index 2721280658c51..558c362a5b062 100644
--- a/src/legacy/server/config/schema.js
+++ b/src/legacy/server/config/schema.js
@@ -136,8 +136,8 @@ export default () =>
           .keys({
             enabled: Joi.boolean().default(false),
             everyBytes: Joi.number()
-              // > 100KB
-              .greater(102399)
+              // > 1MB
+              .greater(1048576)
               // < 1GB
               .less(1073741825)
               // 10MB
diff --git a/src/legacy/core_plugins/data/public/setup.ts b/src/legacy/server/i18n/constants.ts
similarity index 80%
rename from src/legacy/core_plugins/data/public/setup.ts
rename to src/legacy/server/i18n/constants.ts
index a99a2a4d06efe..96fa420d4c6e1 100644
--- a/src/legacy/core_plugins/data/public/setup.ts
+++ b/src/legacy/server/i18n/constants.ts
@@ -17,7 +17,9 @@
  * under the License.
  */
 
-import { setup } from './legacy';
+export const I18N_RC = '.i18nrc.json';
 
-// for backwards compatibility with 7.3
-export const data = setup;
+/**
+ * The type name used within the Monitoring index to publish localization stats.
+ */
+export const KIBANA_LOCALIZATION_STATS_TYPE = 'localization';
diff --git a/src/legacy/server/i18n/get_translations_path.js b/src/legacy/server/i18n/get_translations_path.ts
similarity index 72%
rename from src/legacy/server/i18n/get_translations_path.js
rename to src/legacy/server/i18n/get_translations_path.ts
index 95de6c7560660..ac7c61dcf8543 100644
--- a/src/legacy/server/i18n/get_translations_path.js
+++ b/src/legacy/server/i18n/get_translations_path.ts
@@ -24,20 +24,26 @@ import globby from 'globby';
 
 const readFileAsync = promisify(readFile);
 
-export async function getTranslationPaths({ cwd, glob }) {
+interface I18NRCFileStructure {
+  translations?: string[];
+}
+
+export async function getTranslationPaths({ cwd, glob }: { cwd: string; glob: string }) {
   const entries = await globby(glob, { cwd });
-  const translationPaths = [];
+  const translationPaths: string[] = [];
 
   for (const entry of entries) {
     const entryFullPath = resolve(cwd, entry);
     const pluginBasePath = dirname(entryFullPath);
     try {
       const content = await readFileAsync(entryFullPath, 'utf8');
-      const { translations } = JSON.parse(content);
-      translations.forEach(translation => {
-        const translationFullPath = resolve(pluginBasePath, translation);
-        translationPaths.push(translationFullPath);
-      });
+      const { translations } = JSON.parse(content) as I18NRCFileStructure;
+      if (translations && translations.length) {
+        translations.forEach(translation => {
+          const translationFullPath = resolve(pluginBasePath, translation);
+          translationPaths.push(translationFullPath);
+        });
+      }
     } catch (err) {
       throw new Error(`Failed to parse .i18nrc.json file at ${entryFullPath}`);
     }
diff --git a/src/legacy/server/i18n/index.js b/src/legacy/server/i18n/index.ts
similarity index 62%
rename from src/legacy/server/i18n/index.js
rename to src/legacy/server/i18n/index.ts
index e7fa5d5f6a5c0..9902aaa1e8914 100644
--- a/src/legacy/server/i18n/index.js
+++ b/src/legacy/server/i18n/index.ts
@@ -19,30 +19,35 @@
 
 import { i18n, i18nLoader } from '@kbn/i18n';
 import { basename } from 'path';
+import { Server } from 'hapi';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { fromRoot } from '../../../core/server/utils';
 import { getTranslationPaths } from './get_translations_path';
 import { I18N_RC } from './constants';
+import KbnServer, { KibanaConfig } from '../kbn_server';
+import { registerLocalizationUsageCollector } from './localization';
 
-export async function i18nMixin(kbnServer, server, config) {
-  const locale = config.get('i18n.locale');
+export async function i18nMixin(kbnServer: KbnServer, server: Server, config: KibanaConfig) {
+  const locale = config.get('i18n.locale') as string;
 
   const translationPaths = await Promise.all([
     getTranslationPaths({
       cwd: fromRoot('.'),
       glob: I18N_RC,
     }),
-    ...config.get('plugins.paths').map(cwd => getTranslationPaths({ cwd, glob: I18N_RC })),
-    ...config
-      .get('plugins.scanDirs')
-      .map(cwd => getTranslationPaths({ cwd, glob: `*/${I18N_RC}` })),
+    ...(config.get('plugins.paths') as string[]).map(cwd =>
+      getTranslationPaths({ cwd, glob: I18N_RC })
+    ),
+    ...(config.get('plugins.scanDirs') as string[]).map(cwd =>
+      getTranslationPaths({ cwd, glob: `*/${I18N_RC}` })
+    ),
     getTranslationPaths({
       cwd: fromRoot('../kibana-extra'),
       glob: `*/${I18N_RC}`,
     }),
   ]);
 
-  const currentTranslationPaths = []
+  const currentTranslationPaths = ([] as string[])
     .concat(...translationPaths)
     .filter(translationPath => basename(translationPath, '.json') === locale);
   i18nLoader.registerTranslationFiles(currentTranslationPaths);
@@ -55,5 +60,14 @@ export async function i18nMixin(kbnServer, server, config) {
     })
   );
 
-  server.decorate('server', 'getTranslationsFilePaths', () => currentTranslationPaths);
+  const getTranslationsFilePaths = () => currentTranslationPaths;
+
+  server.decorate('server', 'getTranslationsFilePaths', getTranslationsFilePaths);
+
+  if (kbnServer.newPlatform.setup.plugins.usageCollection) {
+    registerLocalizationUsageCollector(kbnServer.newPlatform.setup.plugins.usageCollection, {
+      getLocale: () => config.get('i18n.locale') as string,
+      getTranslationsFilePaths,
+    });
+  }
 }
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/localization/file_integrity.test.mocks.ts b/src/legacy/server/i18n/localization/file_integrity.test.mocks.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/localization/file_integrity.test.mocks.ts
rename to src/legacy/server/i18n/localization/file_integrity.test.mocks.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/localization/file_integrity.test.ts b/src/legacy/server/i18n/localization/file_integrity.test.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/localization/file_integrity.test.ts
rename to src/legacy/server/i18n/localization/file_integrity.test.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/localization/file_integrity.ts b/src/legacy/server/i18n/localization/file_integrity.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/localization/file_integrity.ts
rename to src/legacy/server/i18n/localization/file_integrity.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/localization/index.ts b/src/legacy/server/i18n/localization/index.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/localization/index.ts
rename to src/legacy/server/i18n/localization/index.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/localization/telemetry_localization_collector.test.ts b/src/legacy/server/i18n/localization/telemetry_localization_collector.test.ts
similarity index 94%
rename from src/legacy/core_plugins/telemetry/server/collectors/localization/telemetry_localization_collector.test.ts
rename to src/legacy/server/i18n/localization/telemetry_localization_collector.test.ts
index eec5cc8a065e4..cbe23da87c767 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/localization/telemetry_localization_collector.test.ts
+++ b/src/legacy/server/i18n/localization/telemetry_localization_collector.test.ts
@@ -22,16 +22,17 @@ interface TranslationsMock {
 }
 
 const createI18nLoaderMock = (translations: TranslationsMock) => {
-  return {
+  return ({
     getTranslationsByLocale() {
       return {
         messages: translations,
       };
     },
-  };
+  } as unknown) as typeof i18nLoader;
 };
 
 import { getTranslationCount } from './telemetry_localization_collector';
+import { i18nLoader } from '@kbn/i18n';
 
 describe('getTranslationCount', () => {
   it('returns 0 if no translations registered', async () => {
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/localization/telemetry_localization_collector.ts b/src/legacy/server/i18n/localization/telemetry_localization_collector.ts
similarity index 71%
rename from src/legacy/core_plugins/telemetry/server/collectors/localization/telemetry_localization_collector.ts
rename to src/legacy/server/i18n/localization/telemetry_localization_collector.ts
index 191565187be14..89566dfd4ef68 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/localization/telemetry_localization_collector.ts
+++ b/src/legacy/server/i18n/localization/telemetry_localization_collector.ts
@@ -19,25 +19,36 @@
 
 import { i18nLoader } from '@kbn/i18n';
 import { size } from 'lodash';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { getIntegrityHashes, Integrities } from './file_integrity';
-import { KIBANA_LOCALIZATION_STATS_TYPE } from '../../../common/constants';
-import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/server';
+import { KIBANA_LOCALIZATION_STATS_TYPE } from '../constants';
+
 export interface UsageStats {
   locale: string;
   integrities: Integrities;
   labelsCount?: number;
 }
 
-export async function getTranslationCount(loader: any, locale: string): Promise<number> {
+export interface LocalizationUsageCollectorHelpers {
+  getLocale: () => string;
+  getTranslationsFilePaths: () => string[];
+}
+
+export async function getTranslationCount(
+  loader: typeof i18nLoader,
+  locale: string
+): Promise<number> {
   const translations = await loader.getTranslationsByLocale(locale);
   return size(translations.messages);
 }
 
-export function createCollectorFetch(server: any) {
+export function createCollectorFetch({
+  getLocale,
+  getTranslationsFilePaths,
+}: LocalizationUsageCollectorHelpers) {
   return async function fetchUsageStats(): Promise<UsageStats> {
-    const config = server.config();
-    const locale: string = config.get('i18n.locale');
-    const translationFilePaths: string[] = server.getTranslationsFilePaths();
+    const locale = getLocale();
+    const translationFilePaths: string[] = getTranslationsFilePaths();
 
     const [labelsCount, integrities] = await Promise.all([
       getTranslationCount(i18nLoader, locale),
@@ -54,12 +65,12 @@ export function createCollectorFetch(server: any) {
 
 export function registerLocalizationUsageCollector(
   usageCollection: UsageCollectionSetup,
-  server: any
+  helpers: LocalizationUsageCollectorHelpers
 ) {
   const collector = usageCollection.makeUsageCollector({
     type: KIBANA_LOCALIZATION_STATS_TYPE,
     isReady: () => true,
-    fetch: createCollectorFetch(server),
+    fetch: createCollectorFetch(helpers),
   });
 
   usageCollection.registerCollector(collector);
diff --git a/src/legacy/server/kbn_server.d.ts b/src/legacy/server/kbn_server.d.ts
index e4aa832a8894b..3d8536085ad04 100644
--- a/src/legacy/server/kbn_server.d.ts
+++ b/src/legacy/server/kbn_server.d.ts
@@ -20,6 +20,7 @@
 import { ResponseObject, Server } from 'hapi';
 import { UnwrapPromise } from '@kbn/utility-types';
 
+import { TelemetryCollectionManagerPluginSetup } from 'src/plugins/telemetry_collection_manager/server';
 import {
   ConfigService,
   CoreSetup,
@@ -104,6 +105,7 @@ type KbnMixinFunc = (kbnServer: KbnServer, server: Server, config: any) => Promi
 
 export interface PluginsSetup {
   usageCollection: UsageCollectionSetup;
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup;
   home: HomeServerPluginSetup;
   [key: string]: object;
 }
diff --git a/src/legacy/server/logging/rotate/log_rotator.test.ts b/src/legacy/server/logging/rotate/log_rotator.test.ts
index c2100546364d4..70842d42f5e1f 100644
--- a/src/legacy/server/logging/rotate/log_rotator.test.ts
+++ b/src/legacy/server/logging/rotate/log_rotator.test.ts
@@ -204,8 +204,8 @@ describe('LogRotator', () => {
     expect(logRotator.running).toBe(true);
     expect(logRotator.usePolling).toBe(false);
 
-    const usePolling = await logRotator._shouldUsePolling();
-    expect(usePolling).toBe(false);
+    const shouldUsePolling = await logRotator._shouldUsePolling();
+    expect(shouldUsePolling).toBe(false);
 
     await logRotator.stop();
   });
@@ -231,7 +231,8 @@ describe('LogRotator', () => {
     await logRotator.start();
 
     expect(logRotator.running).toBe(true);
-    expect(logRotator.usePolling).toBe(true);
+    expect(logRotator.usePolling).toBe(false);
+    expect(logRotator.shouldUsePolling).toBe(true);
 
     await logRotator.stop();
   });
@@ -257,7 +258,8 @@ describe('LogRotator', () => {
     await logRotator.start();
 
     expect(logRotator.running).toBe(true);
-    expect(logRotator.usePolling).toBe(true);
+    expect(logRotator.usePolling).toBe(false);
+    expect(logRotator.shouldUsePolling).toBe(true);
 
     await logRotator.stop();
     jest.useRealTimers();
diff --git a/src/legacy/server/logging/rotate/log_rotator.ts b/src/legacy/server/logging/rotate/log_rotator.ts
index 3662910ca5a7b..eeb91fd0f2636 100644
--- a/src/legacy/server/logging/rotate/log_rotator.ts
+++ b/src/legacy/server/logging/rotate/log_rotator.ts
@@ -50,6 +50,7 @@ export class LogRotator {
   public usePolling: boolean;
   public pollingInterval: number;
   private stalkerUsePollingPolicyTestTimeout: NodeJS.Timeout | null;
+  public shouldUsePolling: boolean;
 
   constructor(config: KibanaConfig, server: Server) {
     this.config = config;
@@ -64,6 +65,7 @@ export class LogRotator {
     this.stalker = null;
     this.usePolling = config.get('logging.rotate.usePolling');
     this.pollingInterval = config.get('logging.rotate.pollingInterval');
+    this.shouldUsePolling = false;
     this.stalkerUsePollingPolicyTestTimeout = null;
   }
 
@@ -150,12 +152,20 @@ export class LogRotator {
   }
 
   async _startLogFileSizeMonitor() {
-    this.usePolling = await this._shouldUsePolling();
+    this.usePolling = this.config.get('logging.rotate.usePolling');
+    this.shouldUsePolling = await this._shouldUsePolling();
 
-    if (this.usePolling && this.usePolling !== this.config.get('logging.rotate.usePolling')) {
+    if (this.usePolling && !this.shouldUsePolling) {
       this.log(
         ['warning', 'logging:rotate'],
-        'The current environment does not support `fs.watch`. Falling back to polling using `fs.watchFile`'
+        'Looks like your current environment support a faster algorithm then polling. You can try to disable `usePolling`'
+      );
+    }
+
+    if (!this.usePolling && this.shouldUsePolling) {
+      this.log(
+        ['error', 'logging:rotate'],
+        'Looks like within your current environment you need to use polling in order to enable log rotator. Please enable `usePolling`'
       );
     }
 
diff --git a/src/legacy/ui/public/field_editor/__snapshots__/field_editor.test.js.snap b/src/legacy/ui/public/field_editor/__snapshots__/field_editor.test.js.snap
index 6c454370f59f5..19d12f4bbbd4c 100644
--- a/src/legacy/ui/public/field_editor/__snapshots__/field_editor.test.js.snap
+++ b/src/legacy/ui/public/field_editor/__snapshots__/field_editor.test.js.snap
@@ -945,6 +945,10 @@ exports[`FieldEditor should show deprecated lang warning 1`] = `
               "text": "_source",
               "value": "_source",
             },
+            Object {
+              "text": "histogram",
+              "value": "histogram",
+            },
             Object {
               "text": "conflict",
               "value": "conflict",
diff --git a/src/legacy/ui/public/new_platform/new_platform.karma_mock.js b/src/legacy/ui/public/new_platform/new_platform.karma_mock.js
index c58a7d2fbb5cd..809022620e69d 100644
--- a/src/legacy/ui/public/new_platform/new_platform.karma_mock.js
+++ b/src/legacy/ui/public/new_platform/new_platform.karma_mock.js
@@ -271,6 +271,12 @@ export const npSetup = {
         }),
       },
     },
+    discover: {
+      docViews: {
+        addDocView: sinon.fake(),
+        setAngularInjectorGetter: sinon.fake(),
+      },
+    },
     visTypeVega: {
       config: sinon.fake(),
     },
@@ -459,6 +465,11 @@ export const npStart = {
         useChartsTheme: sinon.fake(),
       },
     },
+    discover: {
+      docViews: {
+        DocViewer: () => null,
+      },
+    },
   },
 };
 
diff --git a/src/legacy/ui/public/new_platform/new_platform.ts b/src/legacy/ui/public/new_platform/new_platform.ts
index deb8387fee29c..ee14f192a2149 100644
--- a/src/legacy/ui/public/new_platform/new_platform.ts
+++ b/src/legacy/ui/public/new_platform/new_platform.ts
@@ -65,6 +65,7 @@ import {
   NavigationPublicPluginStart,
 } from '../../../../plugins/navigation/public';
 import { VisTypeVegaSetup } from '../../../../plugins/vis_type_vega/public';
+import { DiscoverSetup, DiscoverStart } from '../../../../plugins/discover/public';
 
 export interface PluginsSetup {
   bfetch: BfetchPublicSetup;
@@ -83,6 +84,7 @@ export interface PluginsSetup {
   advancedSettings: AdvancedSettingsSetup;
   management: ManagementSetup;
   visTypeVega: VisTypeVegaSetup;
+  discover: DiscoverSetup;
   telemetry?: TelemetryPluginSetup;
 }
 
@@ -100,6 +102,7 @@ export interface PluginsStart {
   share: SharePluginStart;
   management: ManagementStart;
   advancedSettings: AdvancedSettingsStart;
+  discover: DiscoverStart;
   telemetry?: TelemetryPluginStart;
 }
 
diff --git a/src/plugins/advanced_settings/public/management_app/index.tsx b/src/plugins/advanced_settings/public/management_app/index.tsx
index 27d3114051c16..53b8f9983aa27 100644
--- a/src/plugins/advanced_settings/public/management_app/index.tsx
+++ b/src/plugins/advanced_settings/public/management_app/index.tsx
@@ -24,7 +24,7 @@ import { i18n } from '@kbn/i18n';
 import { I18nProvider } from '@kbn/i18n/react';
 import { AdvancedSettings } from './advanced_settings';
 import { ManagementSetup } from '../../../management/public';
-import { CoreSetup } from '../../../../core/public';
+import { StartServicesAccessor } from '../../../../core/public';
 import { ComponentRegistry } from '../types';
 
 const title = i18n.translate('advancedSettings.advancedSettingsLabel', {
@@ -48,7 +48,7 @@ export async function registerAdvSettingsMgmntApp({
   componentRegistry,
 }: {
   management: ManagementSetup;
-  getStartServices: CoreSetup['getStartServices'];
+  getStartServices: StartServicesAccessor;
   componentRegistry: ComponentRegistry['start'];
 }) {
   const kibanaSection = management.sections.getSection('kibana');
diff --git a/src/plugins/data/common/kbn_field_types/kbn_field_types.test.ts b/src/plugins/data/common/kbn_field_types/kbn_field_types.test.ts
index 09fc4555992a8..a3fe19fa9b2fc 100644
--- a/src/plugins/data/common/kbn_field_types/kbn_field_types.test.ts
+++ b/src/plugins/data/common/kbn_field_types/kbn_field_types.test.ts
@@ -87,6 +87,7 @@ describe('utils/kbn_field_types', () => {
         KBN_FIELD_TYPES.DATE,
         KBN_FIELD_TYPES.GEO_POINT,
         KBN_FIELD_TYPES.GEO_SHAPE,
+        KBN_FIELD_TYPES.HISTOGRAM,
         KBN_FIELD_TYPES.IP,
         KBN_FIELD_TYPES.MURMUR3,
         KBN_FIELD_TYPES.NESTED,
diff --git a/src/plugins/data/common/kbn_field_types/kbn_field_types_factory.ts b/src/plugins/data/common/kbn_field_types/kbn_field_types_factory.ts
index 192e8bc4f3727..cb9357eb9865e 100644
--- a/src/plugins/data/common/kbn_field_types/kbn_field_types_factory.ts
+++ b/src/plugins/data/common/kbn_field_types/kbn_field_types_factory.ts
@@ -95,6 +95,11 @@ export const createKbnFieldTypes = (): KbnFieldType[] => [
     name: KBN_FIELD_TYPES._SOURCE,
     esTypes: [ES_FIELD_TYPES._SOURCE],
   }),
+  new KbnFieldType({
+    name: KBN_FIELD_TYPES.HISTOGRAM,
+    filterable: true,
+    esTypes: [ES_FIELD_TYPES.HISTOGRAM],
+  }),
   new KbnFieldType({
     name: KBN_FIELD_TYPES.CONFLICT,
   }),
diff --git a/src/plugins/data/common/kbn_field_types/types.ts b/src/plugins/data/common/kbn_field_types/types.ts
index 11c62e8f86dce..acd7a36b01fb3 100644
--- a/src/plugins/data/common/kbn_field_types/types.ts
+++ b/src/plugins/data/common/kbn_field_types/types.ts
@@ -59,6 +59,8 @@ export enum ES_FIELD_TYPES {
   ATTACHMENT = 'attachment',
   TOKEN_COUNT = 'token_count',
   MURMUR3 = 'murmur3',
+
+  HISTOGRAM = 'histogram',
 }
 
 /** @public **/
@@ -77,4 +79,5 @@ export enum KBN_FIELD_TYPES {
   CONFLICT = 'conflict',
   OBJECT = 'object',
   NESTED = 'nested',
+  HISTOGRAM = 'histogram',
 }
diff --git a/src/plugins/data/public/field_formats/utils/deserialize.ts b/src/plugins/data/public/field_formats/utils/deserialize.ts
index c735ad196fbee..840e023a11589 100644
--- a/src/plugins/data/public/field_formats/utils/deserialize.ts
+++ b/src/plugins/data/public/field_formats/utils/deserialize.ts
@@ -70,7 +70,8 @@ export const deserializeFieldFormat: FormatFactory = function(
   const { id } = mapping;
   if (id === 'range') {
     const RangeFormat = FieldFormat.from((range: any) => {
-      const format = getFieldFormat(this, id, mapping.params);
+      const nestedFormatter = mapping.params as SerializedFieldFormat;
+      const format = getFieldFormat(this, nestedFormatter.id, nestedFormatter.params);
       const gte = '\u2265';
       const lt = '\u003c';
       return i18n.translate('data.aggTypes.buckets.ranges.rangesFormatMessage', {
diff --git a/src/plugins/data/public/index.ts b/src/plugins/data/public/index.ts
index 339a5fea91c5f..977b9568ceaa6 100644
--- a/src/plugins/data/public/index.ts
+++ b/src/plugins/data/public/index.ts
@@ -328,6 +328,7 @@ export {
   AggParamType,
   AggTypeFieldFilters, // TODO convert to interface
   AggTypeFilters, // TODO convert to interface
+  AggConfigOptions,
   BUCKET_TYPES,
   DateRangeKey, // only used in field formatter deserialization, which will live in data
   IAggConfig,
diff --git a/src/plugins/data/public/public.api.md b/src/plugins/data/public/public.api.md
index 848044217767e..0a0a8d07ef630 100644
--- a/src/plugins/data/public/public.api.md
+++ b/src/plugins/data/public/public.api.md
@@ -54,6 +54,22 @@ import { Unit } from '@elastic/datemath';
 import { UnregisterCallback } from 'history';
 import { UserProvidedValues } from 'src/core/server/types';
 
+// Warning: (ae-missing-release-tag) "AggConfigOptions" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
+//
+// @public (undocumented)
+export interface AggConfigOptions {
+    // (undocumented)
+    enabled?: boolean;
+    // (undocumented)
+    id?: string;
+    // (undocumented)
+    params?: Record<string, any>;
+    // (undocumented)
+    schema?: string;
+    // (undocumented)
+    type: IAggType;
+}
+
 // Warning: (ae-missing-release-tag) "AggGroupNames" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
 //
 // @public (undocumented)
@@ -284,6 +300,8 @@ export enum ES_FIELD_TYPES {
     // (undocumented)
     HALF_FLOAT = "half_float",
     // (undocumented)
+    HISTOGRAM = "histogram",
+    // (undocumented)
     _ID = "_id",
     // (undocumented)
     _INDEX = "_index",
@@ -1136,6 +1154,8 @@ export enum KBN_FIELD_TYPES {
     // (undocumented)
     GEO_SHAPE = "geo_shape",
     // (undocumented)
+    HISTOGRAM = "histogram",
+    // (undocumented)
     IP = "ip",
     // (undocumented)
     MURMUR3 = "murmur3",
@@ -1838,21 +1858,21 @@ export type TSearchStrategyProvider<T extends TStrategyTypes> = (context: ISearc
 // src/plugins/data/public/index.ts:234:27 - (ae-forgotten-export) The symbol "flattenHitWrapper" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/index.ts:234:27 - (ae-forgotten-export) The symbol "getRoutes" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/index.ts:234:27 - (ae-forgotten-export) The symbol "formatHitProvider" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:379:20 - (ae-forgotten-export) The symbol "getRequestInspectorStats" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:379:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:379:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:379:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:384:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:385:1 - (ae-forgotten-export) The symbol "convertDateRangeToString" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:387:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:396:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:397:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:398:1 - (ae-forgotten-export) The symbol "isDateHistogramBucketAggConfig" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:401:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:402:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:405:1 - (ae-forgotten-export) The symbol "parseInterval" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:406:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
-// src/plugins/data/public/index.ts:409:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:380:20 - (ae-forgotten-export) The symbol "getRequestInspectorStats" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:380:20 - (ae-forgotten-export) The symbol "getResponseInspectorStats" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:380:20 - (ae-forgotten-export) The symbol "tabifyAggResponse" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:380:20 - (ae-forgotten-export) The symbol "tabifyGetColumns" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:385:1 - (ae-forgotten-export) The symbol "CidrMask" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:386:1 - (ae-forgotten-export) The symbol "convertDateRangeToString" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:388:1 - (ae-forgotten-export) The symbol "dateHistogramInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:397:1 - (ae-forgotten-export) The symbol "InvalidEsCalendarIntervalError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:398:1 - (ae-forgotten-export) The symbol "InvalidEsIntervalFormatError" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:399:1 - (ae-forgotten-export) The symbol "isDateHistogramBucketAggConfig" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:402:1 - (ae-forgotten-export) The symbol "isValidEsInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:403:1 - (ae-forgotten-export) The symbol "isValidInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:406:1 - (ae-forgotten-export) The symbol "parseInterval" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:407:1 - (ae-forgotten-export) The symbol "propFilter" needs to be exported by the entry point index.d.ts
+// src/plugins/data/public/index.ts:410:1 - (ae-forgotten-export) The symbol "toAbsoluteDates" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/query/state_sync/connect_to_query_state.ts:33:33 - (ae-forgotten-export) The symbol "FilterStateStore" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/query/state_sync/connect_to_query_state.ts:37:1 - (ae-forgotten-export) The symbol "QueryStateChange" needs to be exported by the entry point index.d.ts
 // src/plugins/data/public/types.ts:52:5 - (ae-forgotten-export) The symbol "createFiltersFromEvent" needs to be exported by the entry point index.d.ts
diff --git a/src/plugins/data/public/search/aggs/metrics/cardinality.ts b/src/plugins/data/public/search/aggs/metrics/cardinality.ts
index aa41307b2a052..88cdf3175665e 100644
--- a/src/plugins/data/public/search/aggs/metrics/cardinality.ts
+++ b/src/plugins/data/public/search/aggs/metrics/cardinality.ts
@@ -45,6 +45,9 @@ export const cardinalityMetricAgg = new MetricAggType({
     {
       name: 'field',
       type: 'field',
+      filterFieldTypes: Object.values(KBN_FIELD_TYPES).filter(
+        type => type !== KBN_FIELD_TYPES.HISTOGRAM
+      ),
     },
   ],
 });
diff --git a/src/plugins/data/public/search/aggs/metrics/median.ts b/src/plugins/data/public/search/aggs/metrics/median.ts
index f2636d52e3484..faa0694cd5312 100644
--- a/src/plugins/data/public/search/aggs/metrics/median.ts
+++ b/src/plugins/data/public/search/aggs/metrics/median.ts
@@ -40,7 +40,7 @@ export const medianMetricAgg = new MetricAggType({
     {
       name: 'field',
       type: 'field',
-      filterFieldTypes: [KBN_FIELD_TYPES.NUMBER, KBN_FIELD_TYPES.DATE],
+      filterFieldTypes: [KBN_FIELD_TYPES.NUMBER, KBN_FIELD_TYPES.DATE, KBN_FIELD_TYPES.HISTOGRAM],
       write(agg, output) {
         output.params.field = agg.getParam('field').name;
         output.params.percents = [50];
diff --git a/src/plugins/data/public/search/aggs/metrics/percentile_ranks.ts b/src/plugins/data/public/search/aggs/metrics/percentile_ranks.ts
index 71b1c1415d98e..7dc0f70ea7b80 100644
--- a/src/plugins/data/public/search/aggs/metrics/percentile_ranks.ts
+++ b/src/plugins/data/public/search/aggs/metrics/percentile_ranks.ts
@@ -59,7 +59,7 @@ export const percentileRanksMetricAgg = new MetricAggType<IPercentileRanksAggCon
     {
       name: 'field',
       type: 'field',
-      filterFieldTypes: KBN_FIELD_TYPES.NUMBER,
+      filterFieldTypes: [KBN_FIELD_TYPES.NUMBER, KBN_FIELD_TYPES.HISTOGRAM],
     },
     {
       name: 'values',
diff --git a/src/plugins/data/public/search/aggs/metrics/percentiles.ts b/src/plugins/data/public/search/aggs/metrics/percentiles.ts
index 004918666f622..a39d68248d608 100644
--- a/src/plugins/data/public/search/aggs/metrics/percentiles.ts
+++ b/src/plugins/data/public/search/aggs/metrics/percentiles.ts
@@ -54,7 +54,7 @@ export const percentilesMetricAgg = new MetricAggType<IPercentileAggConfig>({
     {
       name: 'field',
       type: 'field',
-      filterFieldTypes: [KBN_FIELD_TYPES.NUMBER, KBN_FIELD_TYPES.DATE],
+      filterFieldTypes: [KBN_FIELD_TYPES.NUMBER, KBN_FIELD_TYPES.DATE, KBN_FIELD_TYPES.HISTOGRAM],
     },
     {
       name: 'percents',
diff --git a/src/plugins/data/public/search/aggs/metrics/top_hit.ts b/src/plugins/data/public/search/aggs/metrics/top_hit.ts
index 738de6b62bccb..d0c668c577e62 100644
--- a/src/plugins/data/public/search/aggs/metrics/top_hit.ts
+++ b/src/plugins/data/public/search/aggs/metrics/top_hit.ts
@@ -60,7 +60,9 @@ export const topHitMetricAgg = new MetricAggType({
       name: 'field',
       type: 'field',
       onlyAggregatable: false,
-      filterFieldTypes: '*',
+      filterFieldTypes: Object.values(KBN_FIELD_TYPES).filter(
+        type => type !== KBN_FIELD_TYPES.HISTOGRAM
+      ),
       write(agg, output) {
         const field = agg.getParam('field');
         output.params = {};
diff --git a/src/plugins/data/server/kql_telemetry/route.ts b/src/plugins/data/server/kql_telemetry/route.ts
index d5725c859c9a9..dd7ff333e6257 100644
--- a/src/plugins/data/server/kql_telemetry/route.ts
+++ b/src/plugins/data/server/kql_telemetry/route.ts
@@ -17,12 +17,12 @@
  * under the License.
  */
 
-import { CoreSetup, IRouter, Logger } from 'kibana/server';
+import { StartServicesAccessor, IRouter, Logger } from 'kibana/server';
 import { schema } from '@kbn/config-schema';
 
 export function registerKqlTelemetryRoute(
   router: IRouter,
-  getStartServices: CoreSetup['getStartServices'],
+  getStartServices: StartServicesAccessor,
   logger: Logger
 ) {
   router.post(
diff --git a/src/plugins/data/server/server.api.md b/src/plugins/data/server/server.api.md
index 627c7d9849b71..ff9d66a3b5a5d 100644
--- a/src/plugins/data/server/server.api.md
+++ b/src/plugins/data/server/server.api.md
@@ -7,7 +7,6 @@
 import { APICaller as APICaller_2 } from 'kibana/server';
 import Boom from 'boom';
 import { BulkIndexDocumentsParams } from 'elasticsearch';
-import { CallCluster as CallCluster_2 } from 'src/legacy/core_plugins/elasticsearch';
 import { CatAliasesParams } from 'elasticsearch';
 import { CatAllocationParams } from 'elasticsearch';
 import { CatCommonParams } from 'elasticsearch';
@@ -176,6 +175,8 @@ export enum ES_FIELD_TYPES {
     // (undocumented)
     HALF_FLOAT = "half_float",
     // (undocumented)
+    HISTOGRAM = "histogram",
+    // (undocumented)
     _ID = "_id",
     // (undocumented)
     _INDEX = "_index",
@@ -549,6 +550,8 @@ export enum KBN_FIELD_TYPES {
     // (undocumented)
     GEO_SHAPE = "geo_shape",
     // (undocumented)
+    HISTOGRAM = "histogram",
+    // (undocumented)
     IP = "ip",
     // (undocumented)
     MURMUR3 = "murmur3",
diff --git a/src/plugins/dev_tools/public/plugin.ts b/src/plugins/dev_tools/public/plugin.ts
index 9ebfeb5387b26..df61271baf879 100644
--- a/src/plugins/dev_tools/public/plugin.ts
+++ b/src/plugins/dev_tools/public/plugin.ts
@@ -132,4 +132,6 @@ export class DevToolsPlugin implements Plugin<DevToolsSetup, DevToolsStart> {
       getSortedDevTools: this.getSortedDevTools.bind(this),
     };
   }
+
+  public stop() {}
 }
diff --git a/src/plugins/discover/kibana.json b/src/plugins/discover/kibana.json
new file mode 100644
index 0000000000000..91d6358d44c18
--- /dev/null
+++ b/src/plugins/discover/kibana.json
@@ -0,0 +1,6 @@
+{
+  "id": "discover",
+  "version": "kibana",
+  "server": false,
+  "ui": true
+}
diff --git a/src/plugins/discover/public/components/_index.scss b/src/plugins/discover/public/components/_index.scss
new file mode 100644
index 0000000000000..ff50d4b5dca93
--- /dev/null
+++ b/src/plugins/discover/public/components/_index.scss
@@ -0,0 +1 @@
+@import 'doc_viewer/index';
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/__snapshots__/doc_viewer.test.tsx.snap b/src/plugins/discover/public/components/doc_viewer/__snapshots__/doc_viewer.test.tsx.snap
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/__snapshots__/doc_viewer.test.tsx.snap
rename to src/plugins/discover/public/components/doc_viewer/__snapshots__/doc_viewer.test.tsx.snap
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/__snapshots__/doc_viewer_render_tab.test.tsx.snap b/src/plugins/discover/public/components/doc_viewer/__snapshots__/doc_viewer_render_tab.test.tsx.snap
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/__snapshots__/doc_viewer_render_tab.test.tsx.snap
rename to src/plugins/discover/public/components/doc_viewer/__snapshots__/doc_viewer_render_tab.test.tsx.snap
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/_doc_viewer.scss b/src/plugins/discover/public/components/doc_viewer/_doc_viewer.scss
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/_doc_viewer.scss
rename to src/plugins/discover/public/components/doc_viewer/_doc_viewer.scss
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/_index.scss b/src/plugins/discover/public/components/doc_viewer/_index.scss
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/_index.scss
rename to src/plugins/discover/public/components/doc_viewer/_index.scss
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer.test.tsx b/src/plugins/discover/public/components/doc_viewer/doc_viewer.test.tsx
similarity index 81%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer.test.tsx
rename to src/plugins/discover/public/components/doc_viewer/doc_viewer.test.tsx
index 15f0f40700abc..6f29f10ddd026 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer.test.tsx
+++ b/src/plugins/discover/public/components/doc_viewer/doc_viewer.test.tsx
@@ -21,37 +21,33 @@ import { mount, shallow } from 'enzyme';
 import { DocViewer } from './doc_viewer';
 // @ts-ignore
 import { findTestSubject } from '@elastic/eui/lib/test';
-import { getServices } from '../../../kibana_services';
+import { getDocViewsRegistry } from '../../services';
 import { DocViewRenderProps } from '../../doc_views/doc_views_types';
 
-jest.mock('../../../kibana_services', () => {
+jest.mock('../../services', () => {
   let registry: any[] = [];
   return {
-    getServices: () => ({
-      docViewsRegistry: {
-        addDocView(view: any) {
-          registry.push(view);
-        },
-        getDocViewsSorted() {
-          return registry;
-        },
+    getDocViewsRegistry: () => ({
+      addDocView(view: any) {
+        registry.push(view);
+      },
+      getDocViewsSorted() {
+        return registry;
       },
       resetRegistry: () => {
         registry = [];
       },
     }),
-    formatMsg: (x: any) => String(x),
-    formatStack: (x: any) => String(x),
   };
 });
 
 beforeEach(() => {
-  (getServices() as any).resetRegistry();
+  (getDocViewsRegistry() as any).resetRegistry();
   jest.clearAllMocks();
 });
 
 test('Render <DocViewer/> with 3 different tabs', () => {
-  const registry = getServices().docViewsRegistry;
+  const registry = getDocViewsRegistry();
   registry.addDocView({ order: 10, title: 'Render function', render: jest.fn() });
   registry.addDocView({ order: 20, title: 'React component', component: () => <div>test</div> });
   registry.addDocView({ order: 30, title: 'Invalid doc view' });
@@ -69,7 +65,7 @@ test('Render <DocViewer/> with 1 tab displaying error message', () => {
     return null;
   }
 
-  const registry = getServices().docViewsRegistry;
+  const registry = getDocViewsRegistry();
   registry.addDocView({
     order: 10,
     title: 'React component',
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer.tsx b/src/plugins/discover/public/components/doc_viewer/doc_viewer.tsx
similarity index 95%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer.tsx
rename to src/plugins/discover/public/components/doc_viewer/doc_viewer.tsx
index a177d8c29304c..792d9c44400d7 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer.tsx
+++ b/src/plugins/discover/public/components/doc_viewer/doc_viewer.tsx
@@ -18,7 +18,7 @@
  */
 import React from 'react';
 import { EuiTabbedContent } from '@elastic/eui';
-import { getServices } from '../../../kibana_services';
+import { getDocViewsRegistry } from '../../services';
 import { DocViewerTab } from './doc_viewer_tab';
 import { DocView, DocViewRenderProps } from '../../doc_views/doc_views_types';
 
@@ -29,7 +29,7 @@ import { DocView, DocViewRenderProps } from '../../doc_views/doc_views_types';
  * a `render` function.
  */
 export function DocViewer(renderProps: DocViewRenderProps) {
-  const { docViewsRegistry } = getServices();
+  const docViewsRegistry = getDocViewsRegistry();
   const tabs = docViewsRegistry
     .getDocViewsSorted(renderProps.hit)
     .map(({ title, render, component }: DocView, idx: number) => {
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_error.tsx b/src/plugins/discover/public/components/doc_viewer/doc_viewer_render_error.tsx
similarity index 94%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_error.tsx
rename to src/plugins/discover/public/components/doc_viewer/doc_viewer_render_error.tsx
index 075217add7b52..387e57dc8a7e3 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_error.tsx
+++ b/src/plugins/discover/public/components/doc_viewer/doc_viewer_render_error.tsx
@@ -18,7 +18,7 @@
  */
 import React from 'react';
 import { EuiCallOut, EuiCodeBlock } from '@elastic/eui';
-import { formatMsg, formatStack } from '../../../kibana_services';
+import { formatMsg, formatStack } from '../../../../kibana_legacy/public';
 
 interface Props {
   error: Error | string;
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_tab.test.tsx b/src/plugins/discover/public/components/doc_viewer/doc_viewer_render_tab.test.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_tab.test.tsx
rename to src/plugins/discover/public/components/doc_viewer/doc_viewer_render_tab.test.tsx
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_tab.tsx b/src/plugins/discover/public/components/doc_viewer/doc_viewer_render_tab.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_render_tab.tsx
rename to src/plugins/discover/public/components/doc_viewer/doc_viewer_render_tab.tsx
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_tab.tsx b/src/plugins/discover/public/components/doc_viewer/doc_viewer_tab.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/doc_viewer/doc_viewer_tab.tsx
rename to src/plugins/discover/public/components/doc_viewer/doc_viewer_tab.tsx
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/__snapshots__/field_name.test.tsx.snap b/src/plugins/discover/public/components/field_name/__snapshots__/field_name.test.tsx.snap
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/__snapshots__/field_name.test.tsx.snap
rename to src/plugins/discover/public/components/field_name/__snapshots__/field_name.test.tsx.snap
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.test.tsx b/src/plugins/discover/public/components/field_name/field_name.test.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.test.tsx
rename to src/plugins/discover/public/components/field_name/field_name.test.tsx
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.tsx b/src/plugins/discover/public/components/field_name/field_name.tsx
similarity index 94%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.tsx
rename to src/plugins/discover/public/components/field_name/field_name.tsx
index 1b3b16332fa4f..63518aae28de6 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_name.tsx
+++ b/src/plugins/discover/public/components/field_name/field_name.tsx
@@ -20,8 +20,8 @@ import React from 'react';
 import classNames from 'classnames';
 import { EuiFlexGroup, EuiFlexItem, EuiToolTip } from '@elastic/eui';
 
-import { FieldIcon, FieldIconProps } from '../../../../../../../../../plugins/kibana_react/public';
-import { shortenDottedString } from '../../../helpers';
+import { FieldIcon, FieldIconProps } from '../../../../kibana_react/public';
+import { shortenDottedString } from '../../helpers';
 import { getFieldTypeName } from './field_type_name';
 
 // property field is provided at discover's field chooser
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_type_name.ts b/src/plugins/discover/public/components/field_name/field_type_name.ts
similarity index 66%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_type_name.ts
rename to src/plugins/discover/public/components/field_name/field_type_name.ts
index 0cf428ee48b9d..a67c20fc4f353 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/angular/directives/field_name/field_type_name.ts
+++ b/src/plugins/discover/public/components/field_name/field_type_name.ts
@@ -21,52 +21,52 @@ import { i18n } from '@kbn/i18n';
 export function getFieldTypeName(type: string) {
   switch (type) {
     case 'boolean':
-      return i18n.translate('kbn.discover.fieldNameIcons.booleanAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.booleanAriaLabel', {
         defaultMessage: 'Boolean field',
       });
     case 'conflict':
-      return i18n.translate('kbn.discover.fieldNameIcons.conflictFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.conflictFieldAriaLabel', {
         defaultMessage: 'Conflicting field',
       });
     case 'date':
-      return i18n.translate('kbn.discover.fieldNameIcons.dateFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.dateFieldAriaLabel', {
         defaultMessage: 'Date field',
       });
     case 'geo_point':
-      return i18n.translate('kbn.discover.fieldNameIcons.geoPointFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.geoPointFieldAriaLabel', {
         defaultMessage: 'Geo point field',
       });
     case 'geo_shape':
-      return i18n.translate('kbn.discover.fieldNameIcons.geoShapeFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.geoShapeFieldAriaLabel', {
         defaultMessage: 'Geo shape field',
       });
     case 'ip':
-      return i18n.translate('kbn.discover.fieldNameIcons.ipAddressFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.ipAddressFieldAriaLabel', {
         defaultMessage: 'IP address field',
       });
     case 'murmur3':
-      return i18n.translate('kbn.discover.fieldNameIcons.murmur3FieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.murmur3FieldAriaLabel', {
         defaultMessage: 'Murmur3 field',
       });
     case 'number':
-      return i18n.translate('kbn.discover.fieldNameIcons.numberFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.numberFieldAriaLabel', {
         defaultMessage: 'Number field',
       });
     case 'source':
       // Note that this type is currently not provided, type for _source is undefined
-      return i18n.translate('kbn.discover.fieldNameIcons.sourceFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.sourceFieldAriaLabel', {
         defaultMessage: 'Source field',
       });
     case 'string':
-      return i18n.translate('kbn.discover.fieldNameIcons.stringFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.stringFieldAriaLabel', {
         defaultMessage: 'String field',
       });
     case 'nested':
-      return i18n.translate('kbn.discover.fieldNameIcons.nestedFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.nestedFieldAriaLabel', {
         defaultMessage: 'Nested field',
       });
     default:
-      return i18n.translate('kbn.discover.fieldNameIcons.unknownFieldAriaLabel', {
+      return i18n.translate('discover.fieldNameIcons.unknownFieldAriaLabel', {
         defaultMessage: 'Unknown field',
       });
   }
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/json_code_block/__snapshots__/json_code_block.test.tsx.snap b/src/plugins/discover/public/components/json_code_block/__snapshots__/json_code_block.test.tsx.snap
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/json_code_block/__snapshots__/json_code_block.test.tsx.snap
rename to src/plugins/discover/public/components/json_code_block/__snapshots__/json_code_block.test.tsx.snap
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/json_code_block/json_code_block.test.tsx b/src/plugins/discover/public/components/json_code_block/json_code_block.test.tsx
similarity index 95%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/json_code_block/json_code_block.test.tsx
rename to src/plugins/discover/public/components/json_code_block/json_code_block.test.tsx
index 9cab7974c9eb2..7e7f80c6aaa56 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/json_code_block/json_code_block.test.tsx
+++ b/src/plugins/discover/public/components/json_code_block/json_code_block.test.tsx
@@ -19,7 +19,7 @@
 import React from 'react';
 import { shallow } from 'enzyme';
 import { JsonCodeBlock } from './json_code_block';
-import { IndexPattern } from '../../../kibana_services';
+import { IndexPattern } from '../../../../data/public';
 
 it('returns the `JsonCodeEditor` component', () => {
   const props = {
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/json_code_block/json_code_block.tsx b/src/plugins/discover/public/components/json_code_block/json_code_block.tsx
similarity index 93%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/json_code_block/json_code_block.tsx
rename to src/plugins/discover/public/components/json_code_block/json_code_block.tsx
index 3331969e351ab..9297ab0dfcf4d 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/json_code_block/json_code_block.tsx
+++ b/src/plugins/discover/public/components/json_code_block/json_code_block.tsx
@@ -22,7 +22,7 @@ import { i18n } from '@kbn/i18n';
 import { DocViewRenderProps } from '../../doc_views/doc_views_types';
 
 export function JsonCodeBlock({ hit }: DocViewRenderProps) {
-  const label = i18n.translate('kbn.discover.docViews.json.codeEditorAriaLabel', {
+  const label = i18n.translate('discover.docViews.json.codeEditorAriaLabel', {
     defaultMessage: 'Read only JSON view of an elasticsearch document',
   });
   return (
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table.test.tsx b/src/plugins/discover/public/components/table/table.test.tsx
similarity index 98%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table.test.tsx
rename to src/plugins/discover/public/components/table/table.test.tsx
index 386f405544a61..91e116c4c6696 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table.test.tsx
+++ b/src/plugins/discover/public/components/table/table.test.tsx
@@ -21,10 +21,7 @@ import { mount } from 'enzyme';
 // @ts-ignore
 import { findTestSubject } from '@elastic/eui/lib/test';
 import { DocViewTable } from './table';
-
-import { IndexPattern, indexPatterns } from '../../../kibana_services';
-
-jest.mock('ui/new_platform');
+import { indexPatterns, IndexPattern } from '../../../../data/public';
 
 const indexPattern = {
   fields: [
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table.tsx b/src/plugins/discover/public/components/table/table.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table.tsx
rename to src/plugins/discover/public/components/table/table.tsx
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_helper.test.ts b/src/plugins/discover/public/components/table/table_helper.test.ts
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_helper.test.ts
rename to src/plugins/discover/public/components/table/table_helper.test.ts
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_helper.tsx b/src/plugins/discover/public/components/table/table_helper.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_helper.tsx
rename to src/plugins/discover/public/components/table/table_helper.tsx
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row.tsx b/src/plugins/discover/public/components/table/table_row.tsx
similarity index 98%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row.tsx
rename to src/plugins/discover/public/components/table/table_row.tsx
index 5b13f6b3655c3..a4d5c57d10b33 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row.tsx
+++ b/src/plugins/discover/public/components/table/table_row.tsx
@@ -26,7 +26,7 @@ import { DocViewTableRowBtnCollapse } from './table_row_btn_collapse';
 import { DocViewTableRowBtnFilterExists } from './table_row_btn_filter_exists';
 import { DocViewTableRowIconNoMapping } from './table_row_icon_no_mapping';
 import { DocViewTableRowIconUnderscore } from './table_row_icon_underscore';
-import { FieldName } from '../../angular/directives/field_name/field_name';
+import { FieldName } from '../field_name/field_name';
 
 export interface Props {
   field: string;
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_collapse.tsx b/src/plugins/discover/public/components/table/table_row_btn_collapse.tsx
similarity index 94%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_collapse.tsx
rename to src/plugins/discover/public/components/table/table_row_btn_collapse.tsx
index e59f607329d4a..bb5ea4bd20f07 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_collapse.tsx
+++ b/src/plugins/discover/public/components/table/table_row_btn_collapse.tsx
@@ -26,7 +26,7 @@ export interface Props {
 }
 
 export function DocViewTableRowBtnCollapse({ onClick, isCollapsed }: Props) {
-  const label = i18n.translate('kbn.discover.docViews.table.toggleFieldDetails', {
+  const label = i18n.translate('discover.docViews.table.toggleFieldDetails', {
     defaultMessage: 'Toggle field details',
   });
   return (
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_filter_add.tsx b/src/plugins/discover/public/components/table/table_row_btn_filter_add.tsx
similarity index 87%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_filter_add.tsx
rename to src/plugins/discover/public/components/table/table_row_btn_filter_add.tsx
index 8e2668e26cf08..bd842eb5c6f72 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_filter_add.tsx
+++ b/src/plugins/discover/public/components/table/table_row_btn_filter_add.tsx
@@ -29,12 +29,12 @@ export interface Props {
 export function DocViewTableRowBtnFilterAdd({ onClick, disabled = false }: Props) {
   const tooltipContent = disabled ? (
     <FormattedMessage
-      id="kbn.discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip"
+      id="discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip"
       defaultMessage="Unindexed fields can not be searched"
     />
   ) : (
     <FormattedMessage
-      id="kbn.discover.docViews.table.filterForValueButtonTooltip"
+      id="discover.docViews.table.filterForValueButtonTooltip"
       defaultMessage="Filter for value"
     />
   );
@@ -42,7 +42,7 @@ export function DocViewTableRowBtnFilterAdd({ onClick, disabled = false }: Props
   return (
     <EuiToolTip content={tooltipContent}>
       <EuiButtonIcon
-        aria-label={i18n.translate('kbn.discover.docViews.table.filterForValueButtonAriaLabel', {
+        aria-label={i18n.translate('discover.docViews.table.filterForValueButtonAriaLabel', {
           defaultMessage: 'Filter for value',
         })}
         className="kbnDocViewer__actionButton"
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_filter_exists.tsx b/src/plugins/discover/public/components/table/table_row_btn_filter_exists.tsx
similarity index 80%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_filter_exists.tsx
rename to src/plugins/discover/public/components/table/table_row_btn_filter_exists.tsx
index ba1cb4a4db4cf..dab22c103bc48 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_filter_exists.tsx
+++ b/src/plugins/discover/public/components/table/table_row_btn_filter_exists.tsx
@@ -35,18 +35,18 @@ export function DocViewTableRowBtnFilterExists({
   const tooltipContent = disabled ? (
     scripted ? (
       <FormattedMessage
-        id="kbn.discover.docViews.table.unableToFilterForPresenceOfScriptedFieldsTooltip"
+        id="discover.docViews.table.unableToFilterForPresenceOfScriptedFieldsTooltip"
         defaultMessage="Unable to filter for presence of scripted fields"
       />
     ) : (
       <FormattedMessage
-        id="kbn.discover.docViews.table.unableToFilterForPresenceOfMetaFieldsTooltip"
+        id="discover.docViews.table.unableToFilterForPresenceOfMetaFieldsTooltip"
         defaultMessage="Unable to filter for presence of meta fields"
       />
     )
   ) : (
     <FormattedMessage
-      id="kbn.discover.docViews.table.filterForFieldPresentButtonTooltip"
+      id="discover.docViews.table.filterForFieldPresentButtonTooltip"
       defaultMessage="Filter for field present"
     />
   );
@@ -54,12 +54,9 @@ export function DocViewTableRowBtnFilterExists({
   return (
     <EuiToolTip content={tooltipContent}>
       <EuiButtonIcon
-        aria-label={i18n.translate(
-          'kbn.discover.docViews.table.filterForFieldPresentButtonAriaLabel',
-          {
-            defaultMessage: 'Filter for field present',
-          }
-        )}
+        aria-label={i18n.translate('discover.docViews.table.filterForFieldPresentButtonAriaLabel', {
+          defaultMessage: 'Filter for field present',
+        })}
         onClick={onClick}
         className="kbnDocViewer__actionButton"
         data-test-subj="addExistsFilterButton"
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_filter_remove.tsx b/src/plugins/discover/public/components/table/table_row_btn_filter_remove.tsx
similarity index 87%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_filter_remove.tsx
rename to src/plugins/discover/public/components/table/table_row_btn_filter_remove.tsx
index 78538f337ba9e..bbef54cb4ecc7 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_filter_remove.tsx
+++ b/src/plugins/discover/public/components/table/table_row_btn_filter_remove.tsx
@@ -29,12 +29,12 @@ export interface Props {
 export function DocViewTableRowBtnFilterRemove({ onClick, disabled = false }: Props) {
   const tooltipContent = disabled ? (
     <FormattedMessage
-      id="kbn.discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip"
+      id="discover.docViews.table.unindexedFieldsCanNotBeSearchedTooltip"
       defaultMessage="Unindexed fields can not be searched"
     />
   ) : (
     <FormattedMessage
-      id="kbn.discover.docViews.table.filterOutValueButtonTooltip"
+      id="discover.docViews.table.filterOutValueButtonTooltip"
       defaultMessage="Filter out value"
     />
   );
@@ -42,7 +42,7 @@ export function DocViewTableRowBtnFilterRemove({ onClick, disabled = false }: Pr
   return (
     <EuiToolTip content={tooltipContent}>
       <EuiButtonIcon
-        aria-label={i18n.translate('kbn.discover.docViews.table.filterOutValueButtonAriaLabel', {
+        aria-label={i18n.translate('discover.docViews.table.filterOutValueButtonAriaLabel', {
           defaultMessage: 'Filter out value',
         })}
         className="kbnDocViewer__actionButton"
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_toggle_column.tsx b/src/plugins/discover/public/components/table/table_row_btn_toggle_column.tsx
similarity index 79%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_toggle_column.tsx
rename to src/plugins/discover/public/components/table/table_row_btn_toggle_column.tsx
index 7a8fca529ec5e..3e5a057929701 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_btn_toggle_column.tsx
+++ b/src/plugins/discover/public/components/table/table_row_btn_toggle_column.tsx
@@ -31,12 +31,9 @@ export function DocViewTableRowBtnToggleColumn({ onClick, active, disabled = fal
   if (disabled) {
     return (
       <EuiButtonIcon
-        aria-label={i18n.translate(
-          'kbn.discover.docViews.table.toggleColumnInTableButtonAriaLabel',
-          {
-            defaultMessage: 'Toggle column in table',
-          }
-        )}
+        aria-label={i18n.translate('discover.docViews.table.toggleColumnInTableButtonAriaLabel', {
+          defaultMessage: 'Toggle column in table',
+        })}
         className="kbnDocViewer__actionButton"
         data-test-subj="toggleColumnButton"
         disabled
@@ -49,18 +46,15 @@ export function DocViewTableRowBtnToggleColumn({ onClick, active, disabled = fal
     <EuiToolTip
       content={
         <FormattedMessage
-          id="kbn.discover.docViews.table.toggleColumnInTableButtonTooltip"
+          id="discover.docViews.table.toggleColumnInTableButtonTooltip"
           defaultMessage="Toggle column in table"
         />
       }
     >
       <EuiButtonIcon
-        aria-label={i18n.translate(
-          'kbn.discover.docViews.table.toggleColumnInTableButtonAriaLabel',
-          {
-            defaultMessage: 'Toggle column in table',
-          }
-        )}
+        aria-label={i18n.translate('discover.docViews.table.toggleColumnInTableButtonAriaLabel', {
+          defaultMessage: 'Toggle column in table',
+        })}
         aria-pressed={active}
         onClick={onClick}
         className="kbnDocViewer__actionButton"
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_icon_no_mapping.tsx b/src/plugins/discover/public/components/table/table_row_icon_no_mapping.tsx
similarity index 86%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_icon_no_mapping.tsx
rename to src/plugins/discover/public/components/table/table_row_icon_no_mapping.tsx
index 347deb842c0bc..3094d366ce372 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_icon_no_mapping.tsx
+++ b/src/plugins/discover/public/components/table/table_row_icon_no_mapping.tsx
@@ -21,14 +21,11 @@ import { EuiIconTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
 export function DocViewTableRowIconNoMapping() {
-  const ariaLabel = i18n.translate(
-    'kbn.discover.docViews.table.noCachedMappingForThisFieldAriaLabel',
-    {
-      defaultMessage: 'Warning',
-    }
-  );
+  const ariaLabel = i18n.translate('discover.docViews.table.noCachedMappingForThisFieldAriaLabel', {
+    defaultMessage: 'Warning',
+  });
   const tooltipContent = i18n.translate(
-    'kbn.discover.docViews.table.noCachedMappingForThisFieldTooltip',
+    'discover.docViews.table.noCachedMappingForThisFieldTooltip',
     {
       defaultMessage:
         'No cached mapping for this field. Refresh field list from the Management > Index Patterns page',
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_icon_underscore.tsx b/src/plugins/discover/public/components/table/table_row_icon_underscore.tsx
similarity index 89%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_icon_underscore.tsx
rename to src/plugins/discover/public/components/table/table_row_icon_underscore.tsx
index 724b5712cf1fe..791ab18de5175 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/components/table/table_row_icon_underscore.tsx
+++ b/src/plugins/discover/public/components/table/table_row_icon_underscore.tsx
@@ -22,13 +22,13 @@ import { i18n } from '@kbn/i18n';
 
 export function DocViewTableRowIconUnderscore() {
   const ariaLabel = i18n.translate(
-    'kbn.discover.docViews.table.fieldNamesBeginningWithUnderscoreUnsupportedAriaLabel',
+    'discover.docViews.table.fieldNamesBeginningWithUnderscoreUnsupportedAriaLabel',
     {
       defaultMessage: 'Warning',
     }
   );
   const tooltipContent = i18n.translate(
-    'kbn.discover.docViews.table.fieldNamesBeginningWithUnderscoreUnsupportedTooltip',
+    'discover.docViews.table.fieldNamesBeginningWithUnderscoreUnsupportedTooltip',
     {
       defaultMessage: 'Field names beginning with {underscoreSign} are not supported',
       values: { underscoreSign: '_' },
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/doc_views/doc_views_helpers.tsx b/src/plugins/discover/public/doc_views/doc_views_helpers.tsx
similarity index 100%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/doc_views/doc_views_helpers.tsx
rename to src/plugins/discover/public/doc_views/doc_views_helpers.tsx
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/doc_views/doc_views_registry.ts b/src/plugins/discover/public/doc_views/doc_views_registry.ts
similarity index 82%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/doc_views/doc_views_registry.ts
rename to src/plugins/discover/public/doc_views/doc_views_registry.ts
index 91acf1c7ac4ae..8f4518538be72 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/doc_views/doc_views_registry.ts
+++ b/src/plugins/discover/public/doc_views/doc_views_registry.ts
@@ -23,8 +23,11 @@ import { DocView, DocViewInput, ElasticSearchHit, DocViewInputFn } from './doc_v
 
 export class DocViewsRegistry {
   private docViews: DocView[] = [];
+  private angularInjectorGetter: (() => Promise<auto.IInjectorService>) | null = null;
 
-  constructor(private getInjector: () => Promise<auto.IInjectorService>) {}
+  setAngularInjectorGetter(injectorGetter: () => Promise<auto.IInjectorService>) {
+    this.angularInjectorGetter = injectorGetter;
+  }
 
   /**
    * Extends and adds the given doc view to the registry array
@@ -33,7 +36,12 @@ export class DocViewsRegistry {
     const docView = typeof docViewRaw === 'function' ? docViewRaw() : docViewRaw;
     if (docView.directive) {
       // convert angular directive to render function for backwards compatibility
-      docView.render = convertDirectiveToRenderFn(docView.directive, this.getInjector);
+      docView.render = convertDirectiveToRenderFn(docView.directive, () => {
+        if (!this.angularInjectorGetter) {
+          throw new Error('Angular was not initialized');
+        }
+        return this.angularInjectorGetter();
+      });
     }
     if (typeof docView.shouldShow !== 'function') {
       docView.shouldShow = () => true;
diff --git a/src/legacy/core_plugins/kibana/public/discover/np_ready/doc_views/doc_views_types.ts b/src/plugins/discover/public/doc_views/doc_views_types.ts
similarity index 90%
rename from src/legacy/core_plugins/kibana/public/discover/np_ready/doc_views/doc_views_types.ts
rename to src/plugins/discover/public/doc_views/doc_views_types.ts
index a7828f9f0e7ed..0a4b5bb570bd7 100644
--- a/src/legacy/core_plugins/kibana/public/discover/np_ready/doc_views/doc_views_types.ts
+++ b/src/plugins/discover/public/doc_views/doc_views_types.ts
@@ -18,10 +18,10 @@
  */
 import { ComponentType } from 'react';
 import { IScope } from 'angular';
-import { IndexPattern } from '../../kibana_services';
+import { IndexPattern } from '../../../data/public';
 
 export interface AngularDirective {
-  controller: (scope: AngularScope) => void;
+  controller: (...injectedServices: any[]) => void;
   template: string;
 }
 
@@ -51,13 +51,14 @@ export interface DocViewRenderProps {
   onAddColumn?: (columnName: string) => void;
   onRemoveColumn?: (columnName: string) => void;
 }
+export type DocViewerComponent = ComponentType<DocViewRenderProps>;
 export type DocViewRenderFn = (
   domeNode: HTMLDivElement,
   renderProps: DocViewRenderProps
 ) => () => void;
 
 export interface DocViewInput {
-  component?: ComponentType<DocViewRenderProps>;
+  component?: DocViewerComponent;
   directive?: AngularDirective;
   order: number;
   render?: DocViewRenderFn;
diff --git a/src/legacy/core_plugins/telemetry/public/views/management/index.ts b/src/plugins/discover/public/helpers/index.ts
similarity index 92%
rename from src/legacy/core_plugins/telemetry/public/views/management/index.ts
rename to src/plugins/discover/public/helpers/index.ts
index 2e9f064ec80d8..7196c96989e97 100644
--- a/src/legacy/core_plugins/telemetry/public/views/management/index.ts
+++ b/src/plugins/discover/public/helpers/index.ts
@@ -17,4 +17,4 @@
  * under the License.
  */
 
-import './management';
+export { shortenDottedString } from './shorten_dotted_string';
diff --git a/src/plugins/discover/public/helpers/shorten_dotted_string.ts b/src/plugins/discover/public/helpers/shorten_dotted_string.ts
new file mode 100644
index 0000000000000..9d78a96784339
--- /dev/null
+++ b/src/plugins/discover/public/helpers/shorten_dotted_string.ts
@@ -0,0 +1,26 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+const DOT_PREFIX_RE = /(.).+?\./g;
+
+/**
+ * Convert a dot.notated.string into a short
+ * version (d.n.string)
+ */
+export const shortenDottedString = (input: string) => input.replace(DOT_PREFIX_RE, '$1.');
diff --git a/src/plugins/discover/public/index.scss b/src/plugins/discover/public/index.scss
new file mode 100644
index 0000000000000..841415620d691
--- /dev/null
+++ b/src/plugins/discover/public/index.scss
@@ -0,0 +1 @@
+@import 'components/index';
diff --git a/src/plugins/discover/public/index.ts b/src/plugins/discover/public/index.ts
index c5050147c3d5a..dbc361ee59f49 100644
--- a/src/plugins/discover/public/index.ts
+++ b/src/plugins/discover/public/index.ts
@@ -17,5 +17,18 @@
  * under the License.
  */
 
+import { DiscoverPlugin } from './plugin';
+
+export { DiscoverSetup, DiscoverStart } from './plugin';
+export { DocViewTable } from './components/table/table';
+export { JsonCodeBlock } from './components/json_code_block/json_code_block';
+export { DocViewInput, DocViewInputFn, DocViewerComponent } from './doc_views/doc_views_types';
+export { FieldName } from './components/field_name/field_name';
+export * from './doc_views/doc_views_types';
+
+export function plugin() {
+  return new DiscoverPlugin();
+}
+
 export { createSavedSearchesLoader } from './saved_searches/saved_searches';
 export { SavedSearchLoader, SavedSearch } from './saved_searches/types';
diff --git a/src/legacy/core_plugins/data/index.ts b/src/plugins/discover/public/mocks.ts
similarity index 58%
rename from src/legacy/core_plugins/data/index.ts
rename to src/plugins/discover/public/mocks.ts
index 10c8cf464b82d..bb05e3d412001 100644
--- a/src/legacy/core_plugins/data/index.ts
+++ b/src/plugins/discover/public/mocks.ts
@@ -17,25 +17,31 @@
  * under the License.
  */
 
-import { resolve } from 'path';
-import { Legacy } from '../../../../kibana';
+import { DiscoverSetup, DiscoverStart } from '.';
 
-// eslint-disable-next-line import/no-default-export
-export default function DataPlugin(kibana: any) {
-  const config: Legacy.PluginSpecOptions = {
-    id: 'data',
-    require: ['elasticsearch'],
-    publicDir: resolve(__dirname, 'public'),
-    config: (Joi: any) => {
-      return Joi.object({
-        enabled: Joi.boolean().default(true),
-      }).default();
+export type Setup = jest.Mocked<DiscoverSetup>;
+export type Start = jest.Mocked<DiscoverStart>;
+
+const createSetupContract = (): Setup => {
+  const setupContract: Setup = {
+    docViews: {
+      addDocView: jest.fn(),
+      setAngularInjectorGetter: jest.fn(),
     },
-    init: (server: Legacy.Server) => ({}),
-    uiExports: {
-      injectDefaultVars: () => ({}),
+  };
+  return setupContract;
+};
+
+const createStartContract = (): Start => {
+  const startContract: Start = {
+    docViews: {
+      DocViewer: jest.fn(() => null),
     },
   };
+  return startContract;
+};
 
-  return new kibana.Plugin(config);
-}
+export const discoverPluginMock = {
+  createSetupContract,
+  createStartContract,
+};
diff --git a/src/plugins/discover/public/plugin.ts b/src/plugins/discover/public/plugin.ts
new file mode 100644
index 0000000000000..d2797586bfdfb
--- /dev/null
+++ b/src/plugins/discover/public/plugin.ts
@@ -0,0 +1,110 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { auto } from 'angular';
+import { CoreSetup, Plugin } from 'kibana/public';
+import { DocViewInput, DocViewInputFn, DocViewRenderProps } from './doc_views/doc_views_types';
+import { DocViewsRegistry } from './doc_views/doc_views_registry';
+import { DocViewTable } from './components/table/table';
+import { JsonCodeBlock } from './components/json_code_block/json_code_block';
+import { DocViewer } from './components/doc_viewer/doc_viewer';
+import { setDocViewsRegistry } from './services';
+
+import './index.scss';
+
+/**
+ * @public
+ */
+export interface DiscoverSetup {
+  docViews: {
+    /**
+     * Add new doc view shown along with table view and json view in the details of each document in Discover.
+     * Both react and angular doc views are supported.
+     * @param docViewRaw
+     */
+    addDocView(docViewRaw: DocViewInput | DocViewInputFn): void;
+    /**
+     * Set the angular injector for bootstrapping angular doc views. This is only exposed temporarily to aid
+     * migration to the new platform and will be removed soon.
+     * @deprecated
+     * @param injectorGetter
+     */
+    setAngularInjectorGetter(injectorGetter: () => Promise<auto.IInjectorService>): void;
+  };
+}
+/**
+ * @public
+ */
+export interface DiscoverStart {
+  docViews: {
+    /**
+     * Component rendering all the doc views for a given document.
+     * This is only exposed temporarily to aid migration to the new platform and will be removed soon.
+     * @deprecated
+     */
+    DocViewer: React.ComponentType<DocViewRenderProps>;
+  };
+}
+
+/**
+ * Contains Discover, one of the oldest parts of Kibana
+ * There are 2 kinds of Angular bootstrapped for rendering, additionally to the main Angular
+ * Discover provides embeddables, those contain a slimmer Angular
+ */
+export class DiscoverPlugin implements Plugin<DiscoverSetup, DiscoverStart> {
+  private docViewsRegistry: DocViewsRegistry | null = null;
+
+  setup(core: CoreSetup): DiscoverSetup {
+    this.docViewsRegistry = new DocViewsRegistry();
+    setDocViewsRegistry(this.docViewsRegistry);
+    this.docViewsRegistry.addDocView({
+      title: i18n.translate('discover.docViews.table.tableTitle', {
+        defaultMessage: 'Table',
+      }),
+      order: 10,
+      component: DocViewTable,
+    });
+    this.docViewsRegistry.addDocView({
+      title: i18n.translate('discover.docViews.json.jsonTitle', {
+        defaultMessage: 'JSON',
+      }),
+      order: 20,
+      component: JsonCodeBlock,
+    });
+
+    return {
+      docViews: {
+        addDocView: this.docViewsRegistry.addDocView.bind(this.docViewsRegistry),
+        setAngularInjectorGetter: this.docViewsRegistry.setAngularInjectorGetter.bind(
+          this.docViewsRegistry
+        ),
+      },
+    };
+  }
+
+  start() {
+    return {
+      docViews: {
+        DocViewer,
+      },
+    };
+  }
+}
diff --git a/src/plugins/discover/public/saved_searches/_saved_search.ts b/src/plugins/discover/public/saved_searches/_saved_search.ts
index 72983b7835eee..56360b04a49c8 100644
--- a/src/plugins/discover/public/saved_searches/_saved_search.ts
+++ b/src/plugins/discover/public/saved_searches/_saved_search.ts
@@ -16,7 +16,11 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { createSavedObjectClass, SavedObjectKibanaServices } from '../../../saved_objects/public';
+import {
+  createSavedObjectClass,
+  SavedObject,
+  SavedObjectKibanaServices,
+} from '../../../saved_objects/public';
 
 export function createSavedSearchClass(services: SavedObjectKibanaServices) {
   const SavedObjectClass = createSavedObjectClass(services);
@@ -66,5 +70,5 @@ export function createSavedSearchClass(services: SavedObjectKibanaServices) {
     }
   }
 
-  return SavedSearch;
+  return SavedSearch as new (id: string) => SavedObject;
 }
diff --git a/src/plugins/discover/public/services.ts b/src/plugins/discover/public/services.ts
new file mode 100644
index 0000000000000..3a28759d82b71
--- /dev/null
+++ b/src/plugins/discover/public/services.ts
@@ -0,0 +1,25 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { createGetterSetter } from '../../kibana_utils/common';
+import { DocViewsRegistry } from './doc_views/doc_views_registry';
+
+export const [getDocViewsRegistry, setDocViewsRegistry] = createGetterSetter<DocViewsRegistry>(
+  'DocViewsRegistry'
+);
diff --git a/src/plugins/kibana_react/public/code_editor/code_editor.tsx b/src/plugins/kibana_react/public/code_editor/code_editor.tsx
index 37707fdec2140..e8b118b804347 100644
--- a/src/plugins/kibana_react/public/code_editor/code_editor.tsx
+++ b/src/plugins/kibana_react/public/code_editor/code_editor.tsx
@@ -25,6 +25,8 @@ import { monaco } from '@kbn/ui-shared-deps/monaco';
 
 import { LIGHT_THEME, DARK_THEME } from './editor_theme';
 
+import './editor.scss';
+
 export interface Props {
   /** Width of editor. Defaults to 100%. */
   width?: string | number;
diff --git a/src/plugins/kibana_react/public/code_editor/editor.scss b/src/plugins/kibana_react/public/code_editor/editor.scss
index 86a764716bc7c..23a3e3af7e656 100644
--- a/src/plugins/kibana_react/public/code_editor/editor.scss
+++ b/src/plugins/kibana_react/public/code_editor/editor.scss
@@ -1,3 +1,3 @@
 .react-monaco-editor-container .monaco-editor .inputarea:focus {
-  animation: none; // Removes textarea EUI blue underline animation from EUI
+  animation: none !important; // Removes textarea EUI blue underline animation from EUI
 }
diff --git a/src/plugins/kibana_react/public/index.ts b/src/plugins/kibana_react/public/index.ts
index e88ca7178cde3..e1689e38dbfe0 100644
--- a/src/plugins/kibana_react/public/index.ts
+++ b/src/plugins/kibana_react/public/index.ts
@@ -26,6 +26,7 @@ export * from './field_icon';
 export * from './table_list_view';
 export * from './split_panel';
 export { ValidatedDualRange } from './validated_range';
+export * from './notifications';
 export { Markdown, MarkdownSimple } from './markdown';
 export { reactToUiComponent, uiToReactComponent } from './adapters';
 export { useUrlTracker } from './use_url_tracker';
diff --git a/src/plugins/management/public/management_app.tsx b/src/plugins/management/public/management_app.tsx
index 705d98eaaf2ff..38db1039042e5 100644
--- a/src/plugins/management/public/management_app.tsx
+++ b/src/plugins/management/public/management_app.tsx
@@ -26,7 +26,7 @@ import { KibanaLegacySetup } from '../../kibana_legacy/public';
 import { LegacyManagementSection } from './legacy';
 import { ManagementChrome } from './components';
 import { ManagementSection } from './management_section';
-import { ChromeBreadcrumb, CoreSetup } from '../../../core/public/';
+import { ChromeBreadcrumb, StartServicesAccessor } from '../../../core/public/';
 
 export class ManagementApp {
   readonly id: string;
@@ -41,7 +41,7 @@ export class ManagementApp {
     getSections: () => ManagementSection[],
     registerLegacyApp: KibanaLegacySetup['registerLegacyApp'],
     getLegacyManagementSections: () => LegacyManagementSection,
-    getStartServices: CoreSetup['getStartServices']
+    getStartServices: StartServicesAccessor
   ) {
     this.id = id;
     this.title = title;
diff --git a/src/plugins/management/public/management_section.ts b/src/plugins/management/public/management_section.ts
index 2f323c4b6a9cf..483605341ae4c 100644
--- a/src/plugins/management/public/management_section.ts
+++ b/src/plugins/management/public/management_section.ts
@@ -19,7 +19,7 @@
 
 import { CreateSection, RegisterManagementAppArgs } from './types';
 import { KibanaLegacySetup } from '../../kibana_legacy/public';
-import { CoreSetup } from '../../../core/public';
+import { StartServicesAccessor } from '../../../core/public';
 // @ts-ignore
 import { LegacyManagementSection } from './legacy';
 import { ManagementApp } from './management_app';
@@ -34,14 +34,14 @@ export class ManagementSection {
   private readonly getSections: () => ManagementSection[];
   private readonly registerLegacyApp: KibanaLegacySetup['registerLegacyApp'];
   private readonly getLegacyManagementSection: () => LegacyManagementSection;
-  private readonly getStartServices: CoreSetup['getStartServices'];
+  private readonly getStartServices: StartServicesAccessor;
 
   constructor(
     { id, title, order = 100, euiIconType, icon }: CreateSection,
     getSections: () => ManagementSection[],
     registerLegacyApp: KibanaLegacySetup['registerLegacyApp'],
     getLegacyManagementSection: () => ManagementSection,
-    getStartServices: CoreSetup['getStartServices']
+    getStartServices: StartServicesAccessor
   ) {
     this.id = id;
     this.title = title;
diff --git a/src/plugins/management/public/management_service.ts b/src/plugins/management/public/management_service.ts
index 4a900345b3843..ed31a22992da8 100644
--- a/src/plugins/management/public/management_service.ts
+++ b/src/plugins/management/public/management_service.ts
@@ -22,7 +22,7 @@ import { KibanaLegacySetup } from '../../kibana_legacy/public';
 // @ts-ignore
 import { LegacyManagementSection } from './legacy';
 import { CreateSection } from './types';
-import { CoreSetup, CoreStart } from '../../../core/public';
+import { StartServicesAccessor, CoreStart } from '../../../core/public';
 
 export class ManagementService {
   private sections: ManagementSection[] = [];
@@ -30,7 +30,7 @@ export class ManagementService {
   private register(
     registerLegacyApp: KibanaLegacySetup['registerLegacyApp'],
     getLegacyManagement: () => LegacyManagementSection,
-    getStartServices: CoreSetup['getStartServices']
+    getStartServices: StartServicesAccessor
   ) {
     return (section: CreateSection) => {
       if (this.getSection(section.id)) {
@@ -71,7 +71,7 @@ export class ManagementService {
   public setup(
     kibanaLegacy: KibanaLegacySetup,
     getLegacyManagement: () => LegacyManagementSection,
-    getStartServices: CoreSetup['getStartServices']
+    getStartServices: StartServicesAccessor
   ) {
     const register = this.register.bind(this)(
       kibanaLegacy.registerLegacyApp,
diff --git a/src/plugins/navigation/public/top_nav_menu/__snapshots__/top_nav_menu_item.test.tsx.snap b/src/plugins/navigation/public/top_nav_menu/__snapshots__/top_nav_menu_item.test.tsx.snap
new file mode 100644
index 0000000000000..0d54d5d3e9c4a
--- /dev/null
+++ b/src/plugins/navigation/public/top_nav_menu/__snapshots__/top_nav_menu_item.test.tsx.snap
@@ -0,0 +1,19 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`TopNavMenu Should render emphasized item which should be clickable 1`] = `
+<EuiButton
+  fill={true}
+  iconSide="right"
+  iconType="beaker"
+  isDisabled={false}
+  onClick={[Function]}
+  size="s"
+  style={
+    Object {
+      "fontSize": "smaller",
+    }
+  }
+>
+  Test
+</EuiButton>
+`;
diff --git a/src/plugins/navigation/public/top_nav_menu/_index.scss b/src/plugins/navigation/public/top_nav_menu/_index.scss
index 4a0e6af3f7f70..5befe4789dd6c 100644
--- a/src/plugins/navigation/public/top_nav_menu/_index.scss
+++ b/src/plugins/navigation/public/top_nav_menu/_index.scss
@@ -1,7 +1,11 @@
 .kbnTopNavMenu__wrapper {
   z-index: 5;
 
-  .kbnTopNavMenu {      
-    padding: $euiSizeS 0px $euiSizeXS;
+  .kbnTopNavMenu {
+    padding: $euiSizeS 0;
+
+    .kbnTopNavItemEmphasized {
+      padding: 0 $euiSizeS;
+    }
   }
 }
diff --git a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx
index 80d1a53cd417f..14ad40f13e388 100644
--- a/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx
+++ b/src/plugins/navigation/public/top_nav_menu/top_nav_menu.tsx
@@ -46,7 +46,11 @@ export function TopNavMenu(props: TopNavMenuProps) {
     if (!config) return;
     return config.map((menuItem: TopNavMenuData, i: number) => {
       return (
-        <EuiFlexItem grow={false} key={`nav-menu-${i}`}>
+        <EuiFlexItem
+          grow={false}
+          key={`nav-menu-${i}`}
+          className={menuItem.emphasize ? 'kbnTopNavItemEmphasized' : ''}
+        >
           <TopNavMenuItem {...menuItem} />
         </EuiFlexItem>
       );
@@ -66,6 +70,7 @@ export function TopNavMenu(props: TopNavMenuProps) {
         <EuiFlexGroup
           data-test-subj="top-nav"
           justifyContent="flexStart"
+          alignItems="center"
           gutterSize="none"
           className="kbnTopNavMenu"
           responsive={false}
diff --git a/src/plugins/navigation/public/top_nav_menu/top_nav_menu_data.tsx b/src/plugins/navigation/public/top_nav_menu/top_nav_menu_data.tsx
index f709985bcf453..2b7466ffd6ab3 100644
--- a/src/plugins/navigation/public/top_nav_menu/top_nav_menu_data.tsx
+++ b/src/plugins/navigation/public/top_nav_menu/top_nav_menu_data.tsx
@@ -17,6 +17,8 @@
  * under the License.
  */
 
+import { ButtonIconSide } from '@elastic/eui';
+
 export type TopNavMenuAction = (anchorElement: EventTarget) => void;
 
 export interface TopNavMenuData {
@@ -28,6 +30,9 @@ export interface TopNavMenuData {
   className?: string;
   disableButton?: boolean | (() => boolean);
   tooltip?: string | (() => string);
+  emphasize?: boolean;
+  iconType?: string;
+  iconSide?: ButtonIconSide;
 }
 
 export interface RegisteredTopNavMenuData extends TopNavMenuData {
diff --git a/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.test.tsx b/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.test.tsx
index 4816ef3c95869..9ba58379c5ce1 100644
--- a/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.test.tsx
+++ b/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.test.tsx
@@ -23,6 +23,15 @@ import { TopNavMenuData } from './top_nav_menu_data';
 import { shallowWithIntl } from 'test_utils/enzyme_helpers';
 
 describe('TopNavMenu', () => {
+  const ensureMenuItemDisabled = (data: TopNavMenuData) => {
+    const component = shallowWithIntl(<TopNavMenuItem {...data} />);
+    expect(component.prop('isDisabled')).toEqual(true);
+
+    const event = { currentTarget: { value: 'a' } };
+    component.simulate('click', event);
+    expect(data.run).toHaveBeenCalledTimes(0);
+  };
+
   it('Should render and click an item', () => {
     const data: TopNavMenuData = {
       id: 'test',
@@ -60,35 +69,62 @@ describe('TopNavMenu', () => {
     expect(data.run).toHaveBeenCalled();
   });
 
-  it('Should render disabled item and it shouldnt be clickable', () => {
+  it('Should render emphasized item which should be clickable', () => {
     const data: TopNavMenuData = {
       id: 'test',
       label: 'test',
-      disableButton: true,
+      iconType: 'beaker',
+      iconSide: 'right',
+      emphasize: true,
       run: jest.fn(),
     };
 
     const component = shallowWithIntl(<TopNavMenuItem {...data} />);
-    expect(component.prop('isDisabled')).toEqual(true);
-
     const event = { currentTarget: { value: 'a' } };
     component.simulate('click', event);
-    expect(data.run).toHaveBeenCalledTimes(0);
+    expect(data.run).toHaveBeenCalledTimes(1);
+    expect(component).toMatchSnapshot();
+  });
+
+  it('Should render disabled item and it shouldnt be clickable', () => {
+    ensureMenuItemDisabled({
+      id: 'test',
+      label: 'test',
+      disableButton: true,
+      run: jest.fn(),
+    });
   });
 
   it('Should render item with disable function and it shouldnt be clickable', () => {
-    const data: TopNavMenuData = {
+    ensureMenuItemDisabled({
       id: 'test',
       label: 'test',
       disableButton: () => true,
       run: jest.fn(),
-    };
+    });
+  });
 
-    const component = shallowWithIntl(<TopNavMenuItem {...data} />);
-    expect(component.prop('isDisabled')).toEqual(true);
+  it('Should render disabled emphasized item which shouldnt be clickable', () => {
+    ensureMenuItemDisabled({
+      id: 'test',
+      label: 'test',
+      iconType: 'beaker',
+      iconSide: 'right',
+      emphasize: true,
+      disableButton: true,
+      run: jest.fn(),
+    });
+  });
 
-    const event = { currentTarget: { value: 'a' } };
-    component.simulate('click', event);
-    expect(data.run).toHaveBeenCalledTimes(0);
+  it('Should render emphasized item with disable function and it shouldnt be clickable', () => {
+    ensureMenuItemDisabled({
+      id: 'test',
+      label: 'test',
+      iconType: 'beaker',
+      iconSide: 'right',
+      emphasize: true,
+      disableButton: () => true,
+      run: jest.fn(),
+    });
   });
 });
diff --git a/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.tsx b/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.tsx
index 4d3b72bae6411..92e267f17d08e 100644
--- a/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.tsx
+++ b/src/plugins/navigation/public/top_nav_menu/top_nav_menu_item.tsx
@@ -21,6 +21,7 @@ import { capitalize, isFunction } from 'lodash';
 import React, { MouseEvent } from 'react';
 import { EuiButtonEmpty, EuiToolTip } from '@elastic/eui';
 
+import { EuiButton } from '@elastic/eui';
 import { TopNavMenuData } from './top_nav_menu_data';
 
 export function TopNavMenuItem(props: TopNavMenuData) {
@@ -39,14 +40,20 @@ export function TopNavMenuItem(props: TopNavMenuData) {
     props.run(e.currentTarget);
   }
 
-  const btn = (
-    <EuiButtonEmpty
-      size="xs"
-      isDisabled={isDisabled()}
-      onClick={handleClick}
-      data-test-subj={props.testId}
-      className={props.className}
-    >
+  const commonButtonProps = {
+    isDisabled: isDisabled(),
+    onClick: handleClick,
+    iconType: props.iconType,
+    iconSide: props.iconSide,
+    'data-test-subj': props.testId,
+  };
+
+  const btn = props.emphasize ? (
+    <EuiButton {...commonButtonProps} size="s" fill style={{ fontSize: 'smaller' }}>
+      {capitalize(props.label || props.id!)}
+    </EuiButton>
+  ) : (
+    <EuiButtonEmpty {...commonButtonProps} size="xs">
       {capitalize(props.label || props.id!)}
     </EuiButtonEmpty>
   );
@@ -54,9 +61,8 @@ export function TopNavMenuItem(props: TopNavMenuData) {
   const tooltip = getTooltip();
   if (tooltip) {
     return <EuiToolTip content={tooltip}>{btn}</EuiToolTip>;
-  } else {
-    return btn;
   }
+  return btn;
 }
 
 TopNavMenuItem.defaultProps = {
diff --git a/src/plugins/saved_objects/public/index.ts b/src/plugins/saved_objects/public/index.ts
index ea92c921efad0..9e0a7c40c043f 100644
--- a/src/plugins/saved_objects/public/index.ts
+++ b/src/plugins/saved_objects/public/index.ts
@@ -21,7 +21,13 @@ import { SavedObjectsPublicPlugin } from './plugin';
 
 export { OnSaveProps, SavedObjectSaveModal, SaveResult, showSaveModal } from './save_modal';
 export { getSavedObjectFinder, SavedObjectFinderUi, SavedObjectMetaData } from './finder';
-export { SavedObjectLoader, createSavedObjectClass } from './saved_object';
+export {
+  SavedObjectLoader,
+  createSavedObjectClass,
+  checkForDuplicateTitle,
+  saveWithConfirmation,
+  isErrorNonFatal,
+} from './saved_object';
 export { SavedObjectSaveOpts, SavedObjectKibanaServices, SavedObject } from './types';
 
 export const plugin = () => new SavedObjectsPublicPlugin();
diff --git a/src/plugins/saved_objects/public/save_modal/saved_object_save_modal.tsx b/src/plugins/saved_objects/public/save_modal/saved_object_save_modal.tsx
index 1d145bc97bdb4..95eb56c0e874b 100644
--- a/src/plugins/saved_objects/public/save_modal/saved_object_save_modal.tsx
+++ b/src/plugins/saved_objects/public/save_modal/saved_object_save_modal.tsx
@@ -289,7 +289,7 @@ export class SavedObjectSaveModal extends React.Component<Props, State> {
             <p>
               <FormattedMessage
                 id="savedObjects.saveModal.duplicateTitleDescription"
-                defaultMessage="Clicking {confirmSaveLabel} overwrites the existing {objectType}."
+                defaultMessage="Clicking {confirmSaveLabel} will save the {objectType} with this duplicate title."
                 values={{
                   objectType: this.props.objectType,
                   confirmSaveLabel: (
diff --git a/src/plugins/saved_objects/public/saved_object/helpers/save_saved_object.ts b/src/plugins/saved_objects/public/saved_object/helpers/save_saved_object.ts
index e43619c2692a5..1fe3e551b09bc 100644
--- a/src/plugins/saved_objects/public/saved_object/helpers/save_saved_object.ts
+++ b/src/plugins/saved_objects/public/saved_object/helpers/save_saved_object.ts
@@ -30,7 +30,7 @@ import { checkForDuplicateTitle } from './check_for_duplicate_title';
  * @param error {Error} the error
  * @return {boolean}
  */
-function isErrorNonFatal(error: { message: string }) {
+export function isErrorNonFatal(error: { message: string }) {
   if (!error) return false;
   return error.message === OVERWRITE_REJECTED || error.message === SAVE_DUPLICATE_REJECTED;
 }
diff --git a/src/plugins/saved_objects/public/saved_object/helpers/save_with_confirmation.test.ts b/src/plugins/saved_objects/public/saved_object/helpers/save_with_confirmation.test.ts
new file mode 100644
index 0000000000000..b05747a10ecb7
--- /dev/null
+++ b/src/plugins/saved_objects/public/saved_object/helpers/save_with_confirmation.test.ts
@@ -0,0 +1,93 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SavedObjectAttributes, SavedObjectsCreateOptions, OverlayStart } from 'kibana/public';
+import { SavedObjectsClientContract } from '../../../../../core/public';
+import { saveWithConfirmation } from './save_with_confirmation';
+import * as deps from './confirm_modal_promise';
+import { OVERWRITE_REJECTED } from '../../constants';
+
+describe('saveWithConfirmation', () => {
+  const savedObjectsClient: SavedObjectsClientContract = {} as SavedObjectsClientContract;
+  const overlays: OverlayStart = {} as OverlayStart;
+  const source: SavedObjectAttributes = {} as SavedObjectAttributes;
+  const options: SavedObjectsCreateOptions = {} as SavedObjectsCreateOptions;
+  const savedObject = {
+    getEsType: () => 'test type',
+    title: 'test title',
+    displayName: 'test display name',
+  };
+
+  beforeEach(() => {
+    savedObjectsClient.create = jest.fn();
+    jest.spyOn(deps, 'confirmModalPromise').mockReturnValue(Promise.resolve({} as any));
+  });
+
+  test('should call create of savedObjectsClient', async () => {
+    await saveWithConfirmation(source, savedObject, options, { savedObjectsClient, overlays });
+    expect(savedObjectsClient.create).toHaveBeenCalledWith(
+      savedObject.getEsType(),
+      source,
+      options
+    );
+  });
+
+  test('should call confirmModalPromise when such record exists', async () => {
+    savedObjectsClient.create = jest
+      .fn()
+      .mockImplementation((type, src, opt) =>
+        opt && opt.overwrite ? Promise.resolve({} as any) : Promise.reject({ res: { status: 409 } })
+      );
+
+    await saveWithConfirmation(source, savedObject, options, { savedObjectsClient, overlays });
+    expect(deps.confirmModalPromise).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.any(String),
+      expect.any(String),
+      overlays
+    );
+  });
+
+  test('should call create of savedObjectsClient when overwriting confirmed', async () => {
+    savedObjectsClient.create = jest
+      .fn()
+      .mockImplementation((type, src, opt) =>
+        opt && opt.overwrite ? Promise.resolve({} as any) : Promise.reject({ res: { status: 409 } })
+      );
+
+    await saveWithConfirmation(source, savedObject, options, { savedObjectsClient, overlays });
+    expect(savedObjectsClient.create).toHaveBeenLastCalledWith(savedObject.getEsType(), source, {
+      overwrite: true,
+      ...options,
+    });
+  });
+
+  test('should reject when overwriting denied', async () => {
+    savedObjectsClient.create = jest.fn().mockReturnValue(Promise.reject({ res: { status: 409 } }));
+    jest.spyOn(deps, 'confirmModalPromise').mockReturnValue(Promise.reject());
+
+    expect.assertions(1);
+    await expect(
+      saveWithConfirmation(source, savedObject, options, {
+        savedObjectsClient,
+        overlays,
+      })
+    ).rejects.toThrow(OVERWRITE_REJECTED);
+  });
+});
diff --git a/src/plugins/saved_objects/public/saved_object/helpers/save_with_confirmation.ts b/src/plugins/saved_objects/public/saved_object/helpers/save_with_confirmation.ts
new file mode 100644
index 0000000000000..b413ea19a932d
--- /dev/null
+++ b/src/plugins/saved_objects/public/saved_object/helpers/save_with_confirmation.ts
@@ -0,0 +1,87 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { get } from 'lodash';
+import { i18n } from '@kbn/i18n';
+import {
+  SavedObjectAttributes,
+  SavedObjectsCreateOptions,
+  OverlayStart,
+  SavedObjectsClientContract,
+} from 'kibana/public';
+import { OVERWRITE_REJECTED } from '../../constants';
+import { confirmModalPromise } from './confirm_modal_promise';
+
+/**
+ * Attempts to create the current object using the serialized source. If an object already
+ * exists, a warning message requests an overwrite confirmation.
+ * @param source - serialized version of this object what will be indexed into elasticsearch.
+ * @param savedObject - a simple object that contains properties title and displayName, and getEsType method
+ * @param options - options to pass to the saved object create method
+ * @param services - provides Kibana services savedObjectsClient and overlays
+ * @returns {Promise} - A promise that is resolved with the objects id if the object is
+ * successfully indexed. If the overwrite confirmation was rejected, an error is thrown with
+ * a confirmRejected = true parameter so that case can be handled differently than
+ * a create or index error.
+ * @resolved {SavedObject}
+ */
+export async function saveWithConfirmation(
+  source: SavedObjectAttributes,
+  savedObject: {
+    getEsType(): string;
+    title: string;
+    displayName: string;
+  },
+  options: SavedObjectsCreateOptions,
+  services: { savedObjectsClient: SavedObjectsClientContract; overlays: OverlayStart }
+) {
+  const { savedObjectsClient, overlays } = services;
+  try {
+    return await savedObjectsClient.create(savedObject.getEsType(), source, options);
+  } catch (err) {
+    // record exists, confirm overwriting
+    if (get(err, 'res.status') === 409) {
+      const confirmMessage = i18n.translate(
+        'savedObjects.confirmModal.overwriteConfirmationMessage',
+        {
+          defaultMessage: 'Are you sure you want to overwrite {title}?',
+          values: { title: savedObject.title },
+        }
+      );
+
+      const title = i18n.translate('savedObjects.confirmModal.overwriteTitle', {
+        defaultMessage: 'Overwrite {name}?',
+        values: { name: savedObject.displayName },
+      });
+      const confirmButtonText = i18n.translate('savedObjects.confirmModal.overwriteButtonLabel', {
+        defaultMessage: 'Overwrite',
+      });
+
+      return confirmModalPromise(confirmMessage, title, confirmButtonText, overlays)
+        .then(() =>
+          savedObjectsClient.create(savedObject.getEsType(), source, {
+            overwrite: true,
+            ...options,
+          })
+        )
+        .catch(() => Promise.reject(new Error(OVERWRITE_REJECTED)));
+    }
+    return await Promise.reject(err);
+  }
+}
diff --git a/src/plugins/saved_objects/public/saved_object/index.ts b/src/plugins/saved_objects/public/saved_object/index.ts
index d3be5ea6df617..178ffaf88f4be 100644
--- a/src/plugins/saved_objects/public/saved_object/index.ts
+++ b/src/plugins/saved_objects/public/saved_object/index.ts
@@ -19,3 +19,6 @@
 
 export { createSavedObjectClass } from './saved_object';
 export { SavedObjectLoader } from './saved_object_loader';
+export { checkForDuplicateTitle } from './helpers/check_for_duplicate_title';
+export { saveWithConfirmation } from './helpers/save_with_confirmation';
+export { isErrorNonFatal } from './helpers/save_saved_object';
diff --git a/src/legacy/core_plugins/telemetry/README.md b/src/plugins/telemetry/README.md
similarity index 81%
rename from src/legacy/core_plugins/telemetry/README.md
rename to src/plugins/telemetry/README.md
index 830c08f8e8bed..196d596fb784f 100644
--- a/src/legacy/core_plugins/telemetry/README.md
+++ b/src/plugins/telemetry/README.md
@@ -6,4 +6,4 @@ Telemetry allows Kibana features to have usage tracked in the wild. The general
 2. Sending a payload of usage data up to Elastic's telemetry cluster.
 3. Viewing usage data in the Kibana instance of the telemetry cluster (Viewing).
 
-This plugin is responsible for sending usage data to the telemetry cluster. For collecting usage data, use 
+This plugin is responsible for sending usage data to the telemetry cluster. For collecting usage data, use the [`usageCollection` plugin](../usage_collection/README.md)
diff --git a/src/plugins/telemetry/common/constants.ts b/src/plugins/telemetry/common/constants.ts
index 7b7694ed9aed7..babd009143c5e 100644
--- a/src/plugins/telemetry/common/constants.ts
+++ b/src/plugins/telemetry/common/constants.ts
@@ -17,13 +17,31 @@
  * under the License.
  */
 
+import { i18n } from '@kbn/i18n';
+
+/**
+ * config options opt into telemetry
+ */
+export const CONFIG_TELEMETRY = 'telemetry:optIn';
+
+/**
+ * config description for opting into telemetry
+ */
+export const getConfigTelemetryDesc = () => {
+  // Can't find where it's used but copying it over from the legacy code just in case...
+  return i18n.translate('telemetry.telemetryConfigDescription', {
+    defaultMessage:
+      'Help us improve the Elastic Stack by providing usage statistics for basic features. We will not share this data outside of Elastic.',
+  });
+};
+
 /**
  * The amount of time, in milliseconds, to wait between reports when enabled.
  * Currently 24 hours.
  */
 export const REPORT_INTERVAL_MS = 86400000;
 
-/*
+/**
  * Key for the localStorage service
  */
 export const LOCALSTORAGE_KEY = 'telemetry.data';
@@ -37,3 +55,28 @@ export const PATH_TO_ADVANCED_SETTINGS = 'kibana#/management/kibana/settings';
  * Link to the Elastic Telemetry privacy statement.
  */
 export const PRIVACY_STATEMENT_URL = `https://www.elastic.co/legal/privacy-statement`;
+
+/**
+ * The type name used to publish telemetry plugin stats.
+ */
+export const TELEMETRY_STATS_TYPE = 'telemetry';
+
+/**
+ * The endpoint version when hitting the remote telemetry service
+ */
+export const ENDPOINT_VERSION = 'v2';
+
+/**
+ * UI metric usage type
+ */
+export const UI_METRIC_USAGE_TYPE = 'ui_metric';
+
+/**
+ * Application Usage type
+ */
+export const APPLICATION_USAGE_TYPE = 'application_usage';
+
+/**
+ * The type name used within the Monitoring index to publish management stats.
+ */
+export const KIBANA_STACK_MANAGEMENT_STATS_TYPE = 'stack_management';
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_allow_changing_opt_in_status.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_allow_changing_opt_in_status.ts
similarity index 93%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_allow_changing_opt_in_status.ts
rename to src/plugins/telemetry/common/telemetry_config/get_telemetry_allow_changing_opt_in_status.ts
index 9fa4fbc5e0227..d7dcfd606b6ac 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_allow_changing_opt_in_status.ts
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_allow_changing_opt_in_status.ts
@@ -16,7 +16,8 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { TelemetrySavedObject } from '../telemetry_repository/get_telemetry_saved_object';
+
+import { TelemetrySavedObject } from './types';
 
 interface GetTelemetryAllowChangingOptInStatus {
   configTelemetryAllowChangingOptInStatus: boolean;
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_failure_details.test.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_failure_details.test.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_failure_details.test.ts
rename to src/plugins/telemetry/common/telemetry_config/get_telemetry_failure_details.test.ts
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_failure_details.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_failure_details.ts
similarity index 94%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_failure_details.ts
rename to src/plugins/telemetry/common/telemetry_config/get_telemetry_failure_details.ts
index 2952fa96a5cf3..c23ec42be56c4 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_failure_details.ts
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_failure_details.ts
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { TelemetrySavedObject } from '../telemetry_repository/get_telemetry_saved_object';
+import { TelemetrySavedObject } from './types';
 
 interface GetTelemetryFailureDetailsConfig {
   telemetrySavedObject: TelemetrySavedObject;
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_notify_user_about_optin_default.test.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_notify_user_about_optin_default.test.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_notify_user_about_optin_default.test.ts
rename to src/plugins/telemetry/common/telemetry_config/get_telemetry_notify_user_about_optin_default.test.ts
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_notify_user_about_optin_default.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_notify_user_about_optin_default.ts
similarity index 94%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_notify_user_about_optin_default.ts
rename to src/plugins/telemetry/common/telemetry_config/get_telemetry_notify_user_about_optin_default.ts
index 8ef3bd8388ecb..19bd1974ffba1 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_notify_user_about_optin_default.ts
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_notify_user_about_optin_default.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { TelemetrySavedObject } from '../telemetry_repository/get_telemetry_saved_object';
+import { TelemetrySavedObject } from './types';
 
 interface NotifyOpts {
   allowChangingOptInStatus: boolean;
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_opt_in.test.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.test.ts
similarity index 98%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_opt_in.test.ts
rename to src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.test.ts
index efc4a020e0ff0..da44abd35517c 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_opt_in.test.ts
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.test.ts
@@ -18,7 +18,7 @@
  */
 
 import { getTelemetryOptIn } from './get_telemetry_opt_in';
-import { TelemetrySavedObject } from '../telemetry_repository/get_telemetry_saved_object';
+import { TelemetrySavedObject } from './types';
 
 describe('getTelemetryOptIn', () => {
   it('returns null when saved object not found', () => {
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_opt_in.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.ts
similarity index 97%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_opt_in.ts
rename to src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.ts
index d83ffdf69b576..7beb5415ad7b1 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_opt_in.ts
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_opt_in.ts
@@ -18,7 +18,7 @@
  */
 
 import semver from 'semver';
-import { TelemetrySavedObject } from '../telemetry_repository/get_telemetry_saved_object';
+import { TelemetrySavedObject } from './types';
 
 interface GetTelemetryOptInConfig {
   telemetrySavedObject: TelemetrySavedObject;
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_send_usage_from.test.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_send_usage_from.test.ts
similarity index 96%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_send_usage_from.test.ts
rename to src/plugins/telemetry/common/telemetry_config/get_telemetry_send_usage_from.test.ts
index 69868a97a931d..2cf68f0abedea 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_send_usage_from.test.ts
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_send_usage_from.test.ts
@@ -18,7 +18,7 @@
  */
 
 import { getTelemetrySendUsageFrom } from './get_telemetry_send_usage_from';
-import { TelemetrySavedObject } from '../telemetry_repository/get_telemetry_saved_object';
+import { TelemetrySavedObject } from './types';
 
 describe('getTelemetrySendUsageFrom', () => {
   it('returns kibana.yml config when saved object not found', () => {
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_send_usage_from.ts b/src/plugins/telemetry/common/telemetry_config/get_telemetry_send_usage_from.ts
similarity index 93%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_send_usage_from.ts
rename to src/plugins/telemetry/common/telemetry_config/get_telemetry_send_usage_from.ts
index 9e4ae14b6097c..78dc1d877c47f 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_config/get_telemetry_send_usage_from.ts
+++ b/src/plugins/telemetry/common/telemetry_config/get_telemetry_send_usage_from.ts
@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { TelemetrySavedObject } from '../telemetry_repository/get_telemetry_saved_object';
+import { TelemetrySavedObject } from './types';
 
 interface GetTelemetryUsageFetcherConfig {
   configTelemetrySendUsageFrom: 'browser' | 'server';
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_config/index.ts b/src/plugins/telemetry/common/telemetry_config/index.ts
similarity index 94%
rename from src/legacy/core_plugins/telemetry/server/telemetry_config/index.ts
rename to src/plugins/telemetry/common/telemetry_config/index.ts
index bf9855ce7538e..51eb4dd16105e 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_config/index.ts
+++ b/src/plugins/telemetry/common/telemetry_config/index.ts
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-export { replaceTelemetryInjectedVars } from './replace_injected_vars';
 export { getTelemetryOptIn } from './get_telemetry_opt_in';
 export { getTelemetrySendUsageFrom } from './get_telemetry_send_usage_from';
 export { getTelemetryAllowChangingOptInStatus } from './get_telemetry_allow_changing_opt_in_status';
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_repository/index.ts b/src/plugins/telemetry/common/telemetry_config/types.ts
similarity index 86%
rename from src/legacy/core_plugins/telemetry/server/telemetry_repository/index.ts
rename to src/plugins/telemetry/common/telemetry_config/types.ts
index f1735d1bb2866..7ab37e9544164 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_repository/index.ts
+++ b/src/plugins/telemetry/common/telemetry_config/types.ts
@@ -17,9 +17,6 @@
  * under the License.
  */
 
-export { getTelemetrySavedObject, TelemetrySavedObject } from './get_telemetry_saved_object';
-export { updateTelemetrySavedObject } from './update_telemetry_saved_object';
-
 export interface TelemetrySavedObjectAttributes {
   enabled?: boolean | null;
   lastVersionChecked?: string;
@@ -30,3 +27,5 @@ export interface TelemetrySavedObjectAttributes {
   reportFailureCount?: number;
   reportFailureVersion?: string;
 }
+
+export type TelemetrySavedObject = TelemetrySavedObjectAttributes | null | false;
diff --git a/src/plugins/telemetry/kibana.json b/src/plugins/telemetry/kibana.json
index 3a28149276c3e..f623f4f2a565d 100644
--- a/src/plugins/telemetry/kibana.json
+++ b/src/plugins/telemetry/kibana.json
@@ -1,6 +1,10 @@
 {
   "id": "telemetry",
   "version": "kibana",
-  "server": false,
-  "ui": true
+  "server": true,
+  "ui": true,
+  "requiredPlugins": [
+    "telemetryCollectionManager",
+    "usageCollection"
+  ]
 }
diff --git a/src/plugins/telemetry/public/components/index.ts b/src/plugins/telemetry/public/components/index.ts
index f4341154f527a..8fda181b2ed93 100644
--- a/src/plugins/telemetry/public/components/index.ts
+++ b/src/plugins/telemetry/public/components/index.ts
@@ -17,6 +17,4 @@
  * under the License.
  */
 
-export { OptInExampleFlyout } from './opt_in_example_flyout';
-export { TelemetryManagementSection } from './telemetry_management_section';
 export { OptedInNoticeBanner } from './opted_in_notice_banner';
diff --git a/src/plugins/telemetry/public/index.ts b/src/plugins/telemetry/public/index.ts
index 2f86d7749bb9b..665c89ba2bffa 100644
--- a/src/plugins/telemetry/public/index.ts
+++ b/src/plugins/telemetry/public/index.ts
@@ -17,9 +17,10 @@
  * under the License.
  */
 
-import { TelemetryPlugin } from './plugin';
+import { PluginInitializerContext } from 'kibana/public';
+import { TelemetryPlugin, TelemetryPluginConfig } from './plugin';
 export { TelemetryPluginStart, TelemetryPluginSetup } from './plugin';
 
-export function plugin() {
-  return new TelemetryPlugin();
+export function plugin(initializerContext: PluginInitializerContext<TelemetryPluginConfig>) {
+  return new TelemetryPlugin(initializerContext);
 }
diff --git a/src/plugins/telemetry/public/mocks.ts b/src/plugins/telemetry/public/mocks.ts
index 93dc13c327509..4e0f02242961a 100644
--- a/src/plugins/telemetry/public/mocks.ts
+++ b/src/plugins/telemetry/public/mocks.ts
@@ -23,8 +23,6 @@ import { overlayServiceMock } from '../../../core/public/overlays/overlay_servic
 import { httpServiceMock } from '../../../core/public/http/http_service.mock';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { notificationServiceMock } from '../../../core/public/notifications/notifications_service.mock';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { injectedMetadataServiceMock } from '../../../core/public/injected_metadata/injected_metadata_service.mock';
 import { TelemetryService } from './services/telemetry_service';
 import { TelemetryNotifications } from './services/telemetry_notifications/telemetry_notifications';
 import { TelemetryPluginStart } from './plugin';
@@ -32,23 +30,19 @@ import { TelemetryPluginStart } from './plugin';
 export function mockTelemetryService({
   reportOptInStatusChange,
 }: { reportOptInStatusChange?: boolean } = {}) {
-  const injectedMetadata = injectedMetadataServiceMock.createStartContract();
-  injectedMetadata.getInjectedVar.mockImplementation((key: string) => {
-    switch (key) {
-      case 'telemetryNotifyUserAboutOptInDefault':
-        return true;
-      case 'allowChangingOptInStatus':
-        return true;
-      case 'telemetryOptedIn':
-        return true;
-      default: {
-        throw Error(`Unhandled getInjectedVar key "${key}".`);
-      }
-    }
-  });
+  const config = {
+    enabled: true,
+    url: 'http://localhost',
+    optInStatusUrl: 'http://localhost',
+    sendUsageFrom: 'browser' as const,
+    optIn: true,
+    banner: true,
+    allowChangingOptInStatus: true,
+    telemetryNotifyUserAboutOptInDefault: true,
+  };
 
   return new TelemetryService({
-    injectedMetadata,
+    config,
     http: httpServiceMock.createStartContract(),
     notifications: notificationServiceMock.createStartContract(),
     reportOptInStatusChange,
diff --git a/src/plugins/telemetry/public/plugin.ts b/src/plugins/telemetry/public/plugin.ts
index 9cfb4ca1ec395..86679227059e6 100644
--- a/src/plugins/telemetry/public/plugin.ts
+++ b/src/plugins/telemetry/public/plugin.ts
@@ -16,9 +16,27 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { Plugin, CoreStart, CoreSetup, HttpStart } from '../../../core/public';
+
+import {
+  Plugin,
+  CoreStart,
+  CoreSetup,
+  HttpStart,
+  PluginInitializerContext,
+  SavedObjectsClientContract,
+} from '../../../core/public';
 
 import { TelemetrySender, TelemetryService, TelemetryNotifications } from './services';
+import {
+  TelemetrySavedObjectAttributes,
+  TelemetrySavedObject,
+} from '../common/telemetry_config/types';
+import {
+  getTelemetryAllowChangingOptInStatus,
+  getTelemetryOptIn,
+  getTelemetrySendUsageFrom,
+} from '../common/telemetry_config';
+import { getNotifyUserAboutOptInDefault } from '../common/telemetry_config/get_telemetry_notify_user_about_optin_default';
 
 export interface TelemetryPluginSetup {
   telemetryService: TelemetryService;
@@ -29,17 +47,32 @@ export interface TelemetryPluginStart {
   telemetryNotifications: TelemetryNotifications;
 }
 
+export interface TelemetryPluginConfig {
+  enabled: boolean;
+  url: string;
+  banner: boolean;
+  allowChangingOptInStatus: boolean;
+  optIn: boolean | null;
+  optInStatusUrl: string;
+  sendUsageFrom: 'browser' | 'server';
+  telemetryNotifyUserAboutOptInDefault?: boolean;
+}
+
 export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPluginStart> {
+  private readonly currentKibanaVersion: string;
+  private readonly config: TelemetryPluginConfig;
   private telemetrySender?: TelemetrySender;
   private telemetryNotifications?: TelemetryNotifications;
   private telemetryService?: TelemetryService;
 
-  public setup({ http, injectedMetadata, notifications }: CoreSetup): TelemetryPluginSetup {
-    this.telemetryService = new TelemetryService({
-      http,
-      injectedMetadata,
-      notifications,
-    });
+  constructor(initializerContext: PluginInitializerContext<TelemetryPluginConfig>) {
+    this.currentKibanaVersion = initializerContext.env.packageInfo.version;
+    this.config = initializerContext.config.get();
+  }
+
+  public setup({ http, notifications }: CoreSetup): TelemetryPluginSetup {
+    const config = this.config;
+    this.telemetryService = new TelemetryService({ config, http, notifications });
 
     this.telemetrySender = new TelemetrySender(this.telemetryService);
 
@@ -48,24 +81,29 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
     };
   }
 
-  public start({ injectedMetadata, http, overlays, application }: CoreStart): TelemetryPluginStart {
+  public start({ http, overlays, application, savedObjects }: CoreStart): TelemetryPluginStart {
     if (!this.telemetryService) {
       throw Error('Telemetry plugin failed to initialize properly.');
     }
 
-    const telemetryBanner = injectedMetadata.getInjectedVar('telemetryBanner') as boolean;
-
     this.telemetryNotifications = new TelemetryNotifications({
       overlays,
       telemetryService: this.telemetryService,
     });
 
-    application.currentAppId$.subscribe(appId => {
+    application.currentAppId$.subscribe(async () => {
       const isUnauthenticated = this.getIsUnauthenticated(http);
       if (isUnauthenticated) {
         return;
       }
 
+      // Update the telemetry config based as a mix of the config files and saved objects
+      const telemetrySavedObject = await this.getTelemetrySavedObject(savedObjects.client);
+      const updatedConfig = await this.updateConfigsBasedOnSavedObjects(telemetrySavedObject);
+      this.telemetryService!.config = updatedConfig;
+
+      const telemetryBanner = updatedConfig.banner;
+
       this.maybeStartTelemetryPoller();
       if (telemetryBanner) {
         this.maybeShowOptedInNotificationBanner();
@@ -111,4 +149,66 @@ export class TelemetryPlugin implements Plugin<TelemetryPluginSetup, TelemetryPl
       this.telemetryNotifications.renderOptInBanner();
     }
   }
+
+  private async updateConfigsBasedOnSavedObjects(
+    telemetrySavedObject: TelemetrySavedObject
+  ): Promise<TelemetryPluginConfig> {
+    const configTelemetrySendUsageFrom = this.config.sendUsageFrom;
+    const configTelemetryOptIn = this.config.optIn as boolean;
+    const configTelemetryAllowChangingOptInStatus = this.config.allowChangingOptInStatus;
+
+    const currentKibanaVersion = this.currentKibanaVersion;
+
+    const allowChangingOptInStatus = getTelemetryAllowChangingOptInStatus({
+      configTelemetryAllowChangingOptInStatus,
+      telemetrySavedObject,
+    });
+
+    const optIn = getTelemetryOptIn({
+      configTelemetryOptIn,
+      allowChangingOptInStatus,
+      telemetrySavedObject,
+      currentKibanaVersion,
+    });
+
+    const sendUsageFrom = getTelemetrySendUsageFrom({
+      configTelemetrySendUsageFrom,
+      telemetrySavedObject,
+    });
+
+    const telemetryNotifyUserAboutOptInDefault = getNotifyUserAboutOptInDefault({
+      telemetrySavedObject,
+      allowChangingOptInStatus,
+      configTelemetryOptIn,
+      telemetryOptedIn: optIn,
+    });
+
+    return {
+      ...this.config,
+      optIn,
+      sendUsageFrom,
+      telemetryNotifyUserAboutOptInDefault,
+    };
+  }
+
+  private async getTelemetrySavedObject(savedObjectsClient: SavedObjectsClientContract) {
+    try {
+      const { attributes } = await savedObjectsClient.get<TelemetrySavedObjectAttributes>(
+        'telemetry',
+        'telemetry'
+      );
+      return attributes;
+    } catch (error) {
+      const errorCode = error[Symbol('SavedObjectsClientErrorCode')];
+      if (errorCode === 'SavedObjectsClient/notFound') {
+        return null;
+      }
+
+      if (errorCode === 'SavedObjectsClient/forbidden') {
+        return false;
+      }
+
+      throw error;
+    }
+  }
 }
diff --git a/src/plugins/telemetry/public/services/telemetry_service.ts b/src/plugins/telemetry/public/services/telemetry_service.ts
index cb91451bd8ef4..cac4e3fdf5f50 100644
--- a/src/plugins/telemetry/public/services/telemetry_service.ts
+++ b/src/plugins/telemetry/public/services/telemetry_service.ts
@@ -20,62 +20,75 @@
 import moment from 'moment';
 import { i18n } from '@kbn/i18n';
 import { CoreStart } from 'kibana/public';
+import { TelemetryPluginConfig } from '../plugin';
 
 interface TelemetryServiceConstructor {
+  config: TelemetryPluginConfig;
   http: CoreStart['http'];
-  injectedMetadata: CoreStart['injectedMetadata'];
   notifications: CoreStart['notifications'];
   reportOptInStatusChange?: boolean;
 }
 
 export class TelemetryService {
   private readonly http: CoreStart['http'];
-  private readonly injectedMetadata: CoreStart['injectedMetadata'];
   private readonly reportOptInStatusChange: boolean;
   private readonly notifications: CoreStart['notifications'];
-  private isOptedIn: boolean | null;
-  private userHasSeenOptedInNotice: boolean;
+  private readonly defaultConfig: TelemetryPluginConfig;
+  private updatedConfig?: TelemetryPluginConfig;
 
   constructor({
+    config,
     http,
-    injectedMetadata,
     notifications,
     reportOptInStatusChange = true,
   }: TelemetryServiceConstructor) {
-    const isOptedIn = injectedMetadata.getInjectedVar('telemetryOptedIn') as boolean | null;
-    const userHasSeenOptedInNotice = injectedMetadata.getInjectedVar(
-      'telemetryNotifyUserAboutOptInDefault'
-    ) as boolean;
+    this.defaultConfig = config;
     this.reportOptInStatusChange = reportOptInStatusChange;
-    this.injectedMetadata = injectedMetadata;
     this.notifications = notifications;
     this.http = http;
+  }
+
+  public set config(updatedConfig: TelemetryPluginConfig) {
+    this.updatedConfig = updatedConfig;
+  }
+
+  public get config() {
+    return { ...this.defaultConfig, ...this.updatedConfig };
+  }
+
+  public get isOptedIn() {
+    return this.config.optIn;
+  }
+
+  public set isOptedIn(optIn) {
+    this.config = { ...this.config, optIn };
+  }
+
+  public get userHasSeenOptedInNotice() {
+    return this.config.telemetryNotifyUserAboutOptInDefault;
+  }
 
-    this.isOptedIn = isOptedIn;
-    this.userHasSeenOptedInNotice = userHasSeenOptedInNotice;
+  public set userHasSeenOptedInNotice(telemetryNotifyUserAboutOptInDefault) {
+    this.config = { ...this.config, telemetryNotifyUserAboutOptInDefault };
   }
 
   public getCanChangeOptInStatus = () => {
-    const allowChangingOptInStatus = this.injectedMetadata.getInjectedVar(
-      'allowChangingOptInStatus'
-    ) as boolean;
+    const allowChangingOptInStatus = this.config.allowChangingOptInStatus;
     return allowChangingOptInStatus;
   };
 
   public getOptInStatusUrl = () => {
-    const telemetryOptInStatusUrl = this.injectedMetadata.getInjectedVar(
-      'telemetryOptInStatusUrl'
-    ) as string;
+    const telemetryOptInStatusUrl = this.config.optInStatusUrl;
     return telemetryOptInStatusUrl;
   };
 
   public getTelemetryUrl = () => {
-    const telemetryUrl = this.injectedMetadata.getInjectedVar('telemetryUrl') as string;
+    const telemetryUrl = this.config.url;
     return telemetryUrl;
   };
 
   public getUserHasSeenOptedInNotice = () => {
-    return this.userHasSeenOptedInNotice;
+    return this.config.telemetryNotifyUserAboutOptInDefault || false;
   };
 
   public getIsOptedIn = () => {
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/application_usage/index.test.ts b/src/plugins/telemetry/server/collectors/application_usage/index.test.ts
similarity index 91%
rename from src/legacy/core_plugins/telemetry/server/collectors/application_usage/index.test.ts
rename to src/plugins/telemetry/server/collectors/application_usage/index.test.ts
index 1a64100bda692..5a8fa71363ba7 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/application_usage/index.test.ts
+++ b/src/plugins/telemetry/server/collectors/application_usage/index.test.ts
@@ -17,10 +17,10 @@
  * under the License.
  */
 
-import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/server';
-import { savedObjectsRepositoryMock } from '../../../../../../core/server/mocks';
+import { UsageCollectionSetup } from '../../../../../plugins/usage_collection/server';
+import { savedObjectsRepositoryMock } from '../../../../../core/server/mocks';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { CollectorOptions } from '../../../../../../plugins/usage_collection/server/collector/collector';
+import { CollectorOptions } from '../../../../../plugins/usage_collection/server/collector/collector';
 
 import { registerApplicationUsageCollector } from './';
 import {
@@ -40,9 +40,12 @@ describe('telemetry_application_usage', () => {
   } as any;
 
   const getUsageCollector = jest.fn();
+  const registerType = jest.fn();
   const callCluster = jest.fn();
 
-  beforeAll(() => registerApplicationUsageCollector(usageCollectionMock, getUsageCollector));
+  beforeAll(() =>
+    registerApplicationUsageCollector(usageCollectionMock, registerType, getUsageCollector)
+  );
   afterAll(() => jest.clearAllTimers());
 
   test('registered collector is set', () => {
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/application_usage/index.ts b/src/plugins/telemetry/server/collectors/application_usage/index.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/application_usage/index.ts
rename to src/plugins/telemetry/server/collectors/application_usage/index.ts
diff --git a/src/plugins/telemetry/server/collectors/application_usage/saved_objects_types.ts b/src/plugins/telemetry/server/collectors/application_usage/saved_objects_types.ts
new file mode 100644
index 0000000000000..9f997ab7b5df3
--- /dev/null
+++ b/src/plugins/telemetry/server/collectors/application_usage/saved_objects_types.ts
@@ -0,0 +1,59 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { SavedObjectAttributes, SavedObjectsServiceSetup } from 'kibana/server';
+
+export interface ApplicationUsageTotal extends SavedObjectAttributes {
+  appId: string;
+  minutesOnScreen: number;
+  numberOfClicks: number;
+}
+
+export interface ApplicationUsageTransactional extends ApplicationUsageTotal {
+  timestamp: string;
+}
+
+export function registerMappings(registerType: SavedObjectsServiceSetup['registerType']) {
+  registerType({
+    name: 'application_usage_totals',
+    hidden: false,
+    namespaceAgnostic: true,
+    mappings: {
+      properties: {
+        appId: { type: 'keyword' },
+        numberOfClicks: { type: 'long' },
+        minutesOnScreen: { type: 'float' },
+      },
+    },
+  });
+
+  registerType({
+    name: 'application_usage_transactional',
+    hidden: false,
+    namespaceAgnostic: true,
+    mappings: {
+      properties: {
+        timestamp: { type: 'date' },
+        appId: { type: 'keyword' },
+        numberOfClicks: { type: 'long' },
+        minutesOnScreen: { type: 'float' },
+      },
+    },
+  });
+}
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/application_usage/telemetry_application_usage_collector.ts b/src/plugins/telemetry/server/collectors/application_usage/telemetry_application_usage_collector.ts
similarity index 94%
rename from src/legacy/core_plugins/telemetry/server/collectors/application_usage/telemetry_application_usage_collector.ts
rename to src/plugins/telemetry/server/collectors/application_usage/telemetry_application_usage_collector.ts
index 5c862686a37d9..f52687038bbbc 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/application_usage/telemetry_application_usage_collector.ts
+++ b/src/plugins/telemetry/server/collectors/application_usage/telemetry_application_usage_collector.ts
@@ -18,10 +18,15 @@
  */
 
 import moment from 'moment';
+import { ISavedObjectsRepository, SavedObjectsServiceSetup } from 'kibana/server';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { APPLICATION_USAGE_TYPE } from '../../../common/constants';
-import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/server';
-import { ISavedObjectsRepository, SavedObjectAttributes } from '../../../../../../core/server';
 import { findAll } from '../find_all';
+import {
+  ApplicationUsageTotal,
+  ApplicationUsageTransactional,
+  registerMappings,
+} from './saved_objects_types';
 
 /**
  * Roll indices every 24h
@@ -36,16 +41,6 @@ export const ROLL_INDICES_START = 5 * 60 * 1000;
 export const SAVED_OBJECTS_TOTAL_TYPE = 'application_usage_totals';
 export const SAVED_OBJECTS_TRANSACTIONAL_TYPE = 'application_usage_transactional';
 
-interface ApplicationUsageTotal extends SavedObjectAttributes {
-  appId: string;
-  minutesOnScreen: number;
-  numberOfClicks: number;
-}
-
-interface ApplicationUsageTransactional extends ApplicationUsageTotal {
-  timestamp: string;
-}
-
 interface ApplicationUsageTelemetryReport {
   [appId: string]: {
     clicks_total: number;
@@ -61,8 +56,11 @@ interface ApplicationUsageTelemetryReport {
 
 export function registerApplicationUsageCollector(
   usageCollection: UsageCollectionSetup,
+  registerType: SavedObjectsServiceSetup['registerType'],
   getSavedObjectsClient: () => ISavedObjectsRepository | undefined
 ) {
+  registerMappings(registerType);
+
   const collector = usageCollection.makeUsageCollector({
     type: APPLICATION_USAGE_TYPE,
     isReady: () => typeof getSavedObjectsClient() !== 'undefined',
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/find_all.test.ts b/src/plugins/telemetry/server/collectors/find_all.test.ts
similarity index 96%
rename from src/legacy/core_plugins/telemetry/server/collectors/find_all.test.ts
rename to src/plugins/telemetry/server/collectors/find_all.test.ts
index 012cda395bc6c..a62c74c0c0838 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/find_all.test.ts
+++ b/src/plugins/telemetry/server/collectors/find_all.test.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { savedObjectsRepositoryMock } from '../../../../../core/server/mocks';
+import { savedObjectsRepositoryMock } from '../../../../core/server/mocks';
 
 import { findAll } from './find_all';
 
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/find_all.ts b/src/plugins/telemetry/server/collectors/find_all.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/find_all.ts
rename to src/plugins/telemetry/server/collectors/find_all.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/index.ts b/src/plugins/telemetry/server/collectors/index.ts
similarity index 90%
rename from src/legacy/core_plugins/telemetry/server/collectors/index.ts
rename to src/plugins/telemetry/server/collectors/index.ts
index 6cb7a38b6414f..6eeda080bb3ab 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/index.ts
+++ b/src/plugins/telemetry/server/collectors/index.ts
@@ -17,10 +17,8 @@
  * under the License.
  */
 
-export { encryptTelemetry } from './encryption';
 export { registerTelemetryUsageCollector } from './usage';
 export { registerUiMetricUsageCollector } from './ui_metric';
-export { registerLocalizationUsageCollector } from './localization';
 export { registerTelemetryPluginUsageCollector } from './telemetry_plugin';
 export { registerManagementUsageCollector } from './management';
 export { registerApplicationUsageCollector } from './application_usage';
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/management/index.ts b/src/plugins/telemetry/server/collectors/management/index.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/management/index.ts
rename to src/plugins/telemetry/server/collectors/management/index.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/management/telemetry_management_collector.ts b/src/plugins/telemetry/server/collectors/management/telemetry_management_collector.ts
similarity index 73%
rename from src/legacy/core_plugins/telemetry/server/collectors/management/telemetry_management_collector.ts
rename to src/plugins/telemetry/server/collectors/management/telemetry_management_collector.ts
index 481b1e9af2a79..7dc4ca64e6bc3 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/management/telemetry_management_collector.ts
+++ b/src/plugins/telemetry/server/collectors/management/telemetry_management_collector.ts
@@ -17,11 +17,10 @@
  * under the License.
  */
 
-import { Server } from 'hapi';
 import { size } from 'lodash';
+import { IUiSettingsClient } from 'kibana/server';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { KIBANA_STACK_MANAGEMENT_STATS_TYPE } from '../../../common/constants';
-import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/server';
-import { SavedObjectsClient } from '../../../../../../core/server';
 
 export type UsageStats = Record<string, any>;
 
@@ -30,12 +29,12 @@ export async function getTranslationCount(loader: any, locale: string): Promise<
   return size(translations.messages);
 }
 
-export function createCollectorFetch(server: Server) {
-  return async function fetchUsageStats(): Promise<UsageStats> {
-    const internalRepo = server.newPlatform.start.core.savedObjects.createInternalRepository();
-    const uiSettingsClient = server.newPlatform.start.core.uiSettings.asScopedToClient(
-      new SavedObjectsClient(internalRepo)
-    );
+export function createCollectorFetch(getUiSettingsClient: () => IUiSettingsClient | undefined) {
+  return async function fetchUsageStats(): Promise<UsageStats | undefined> {
+    const uiSettingsClient = getUiSettingsClient();
+    if (!uiSettingsClient) {
+      return;
+    }
 
     const user = await uiSettingsClient.getUserProvided();
     const modifiedEntries = Object.keys(user)
@@ -51,12 +50,12 @@ export function createCollectorFetch(server: Server) {
 
 export function registerManagementUsageCollector(
   usageCollection: UsageCollectionSetup,
-  server: any
+  getUiSettingsClient: () => IUiSettingsClient | undefined
 ) {
   const collector = usageCollection.makeUsageCollector({
     type: KIBANA_STACK_MANAGEMENT_STATS_TYPE,
-    isReady: () => true,
-    fetch: createCollectorFetch(server),
+    isReady: () => typeof getUiSettingsClient() !== 'undefined',
+    fetch: createCollectorFetch(getUiSettingsClient),
   });
 
   usageCollection.registerCollector(collector);
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/telemetry_plugin/index.ts b/src/plugins/telemetry/server/collectors/telemetry_plugin/index.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/telemetry_plugin/index.ts
rename to src/plugins/telemetry/server/collectors/telemetry_plugin/index.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts b/src/plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts
similarity index 62%
rename from src/legacy/core_plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts
rename to src/plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts
index 5e25538cbad80..ab90935266d69 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts
+++ b/src/plugins/telemetry/server/collectors/telemetry_plugin/telemetry_plugin_collector.ts
@@ -17,10 +17,14 @@
  * under the License.
  */
 
+import { Observable } from 'rxjs';
+import { take } from 'rxjs/operators';
+import { ISavedObjectsRepository, SavedObjectsClient } from '../../../../../core/server';
 import { TELEMETRY_STATS_TYPE } from '../../../common/constants';
 import { getTelemetrySavedObject, TelemetrySavedObject } from '../../telemetry_repository';
-import { getTelemetryOptIn, getTelemetrySendUsageFrom } from '../../telemetry_config';
-import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/server';
+import { getTelemetryOptIn, getTelemetrySendUsageFrom } from '../../../common/telemetry_config';
+import { UsageCollectionSetup } from '../../../../usage_collection/server';
+import { TelemetryConfigType } from '../../config';
 
 export interface TelemetryUsageStats {
   opt_in_status?: boolean | null;
@@ -28,21 +32,31 @@ export interface TelemetryUsageStats {
   last_reported?: number;
 }
 
-export function createCollectorFetch(server: any) {
+export interface TelemetryPluginUsageCollectorOptions {
+  currentKibanaVersion: string;
+  config$: Observable<TelemetryConfigType>;
+  getSavedObjectsClient: () => ISavedObjectsRepository | undefined;
+}
+
+export function createCollectorFetch({
+  currentKibanaVersion,
+  config$,
+  getSavedObjectsClient,
+}: TelemetryPluginUsageCollectorOptions) {
   return async function fetchUsageStats(): Promise<TelemetryUsageStats> {
-    const config = server.config();
-    const configTelemetrySendUsageFrom = config.get('telemetry.sendUsageFrom');
-    const allowChangingOptInStatus = config.get('telemetry.allowChangingOptInStatus');
-    const configTelemetryOptIn = config.get('telemetry.optIn');
-    const currentKibanaVersion = config.get('pkg.version');
+    const { sendUsageFrom, allowChangingOptInStatus, optIn = null } = await config$
+      .pipe(take(1))
+      .toPromise();
+    const configTelemetrySendUsageFrom = sendUsageFrom;
+    const configTelemetryOptIn = optIn;
 
     let telemetrySavedObject: TelemetrySavedObject = {};
 
     try {
-      const { getSavedObjectsRepository } = server.savedObjects;
-      const { callWithInternalUser } = server.plugins.elasticsearch.getCluster('admin');
-      const internalRepository = getSavedObjectsRepository(callWithInternalUser);
-      telemetrySavedObject = await getTelemetrySavedObject(internalRepository);
+      const internalRepository = getSavedObjectsClient()!;
+      telemetrySavedObject = await getTelemetrySavedObject(
+        new SavedObjectsClient(internalRepository)
+      );
     } catch (err) {
       // no-op
     }
@@ -65,12 +79,12 @@ export function createCollectorFetch(server: any) {
 
 export function registerTelemetryPluginUsageCollector(
   usageCollection: UsageCollectionSetup,
-  server: any
+  options: TelemetryPluginUsageCollectorOptions
 ) {
   const collector = usageCollection.makeUsageCollector({
     type: TELEMETRY_STATS_TYPE,
-    isReady: () => true,
-    fetch: createCollectorFetch(server),
+    isReady: () => typeof options.getSavedObjectsClient() !== 'undefined',
+    fetch: createCollectorFetch(options),
   });
 
   usageCollection.registerCollector(collector);
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/ui_metric/index.test.ts b/src/plugins/telemetry/server/collectors/ui_metric/index.test.ts
similarity index 87%
rename from src/legacy/core_plugins/telemetry/server/collectors/ui_metric/index.test.ts
rename to src/plugins/telemetry/server/collectors/ui_metric/index.test.ts
index ddb58a7d09bbd..d6667a6384a1f 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/ui_metric/index.test.ts
+++ b/src/plugins/telemetry/server/collectors/ui_metric/index.test.ts
@@ -17,10 +17,10 @@
  * under the License.
  */
 
-import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/server';
-import { savedObjectsRepositoryMock } from '../../../../../../core/server/mocks';
+import { UsageCollectionSetup } from '../../../../../plugins/usage_collection/server';
+import { savedObjectsRepositoryMock } from '../../../../../core/server/mocks';
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { CollectorOptions } from '../../../../../../plugins/usage_collection/server/collector/collector';
+import { CollectorOptions } from '../../../../../plugins/usage_collection/server/collector/collector';
 
 import { registerUiMetricUsageCollector } from './';
 
@@ -33,9 +33,12 @@ describe('telemetry_ui_metric', () => {
   } as any;
 
   const getUsageCollector = jest.fn();
+  const registerType = jest.fn();
   const callCluster = jest.fn();
 
-  beforeAll(() => registerUiMetricUsageCollector(usageCollectionMock, getUsageCollector));
+  beforeAll(() =>
+    registerUiMetricUsageCollector(usageCollectionMock, registerType, getUsageCollector)
+  );
 
   test('registered collector is set', () => {
     expect(collector).not.toBeUndefined();
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/ui_metric/index.ts b/src/plugins/telemetry/server/collectors/ui_metric/index.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/ui_metric/index.ts
rename to src/plugins/telemetry/server/collectors/ui_metric/index.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/ui_metric/telemetry_ui_metric_collector.ts b/src/plugins/telemetry/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
similarity index 82%
rename from src/legacy/core_plugins/telemetry/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
rename to src/plugins/telemetry/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
index a7b6850b0b20a..3f6e1836cac7d 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
+++ b/src/plugins/telemetry/server/collectors/ui_metric/telemetry_ui_metric_collector.ts
@@ -17,9 +17,13 @@
  * under the License.
  */
 
-import { ISavedObjectsRepository, SavedObjectAttributes } from 'kibana/server';
+import {
+  ISavedObjectsRepository,
+  SavedObjectAttributes,
+  SavedObjectsServiceSetup,
+} from 'kibana/server';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 import { UI_METRIC_USAGE_TYPE } from '../../../common/constants';
-import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/server';
 import { findAll } from '../find_all';
 
 interface UIMetricsSavedObjects extends SavedObjectAttributes {
@@ -28,8 +32,22 @@ interface UIMetricsSavedObjects extends SavedObjectAttributes {
 
 export function registerUiMetricUsageCollector(
   usageCollection: UsageCollectionSetup,
+  registerType: SavedObjectsServiceSetup['registerType'],
   getSavedObjectsClient: () => ISavedObjectsRepository | undefined
 ) {
+  registerType({
+    name: 'ui-metric',
+    hidden: false,
+    namespaceAgnostic: true,
+    mappings: {
+      properties: {
+        count: {
+          type: 'integer',
+        },
+      },
+    },
+  });
+
   const collector = usageCollection.makeUsageCollector({
     type: UI_METRIC_USAGE_TYPE,
     fetch: async () => {
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/usage/ensure_deep_object.test.ts b/src/plugins/telemetry/server/collectors/usage/ensure_deep_object.test.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/usage/ensure_deep_object.test.ts
rename to src/plugins/telemetry/server/collectors/usage/ensure_deep_object.test.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/usage/ensure_deep_object.ts b/src/plugins/telemetry/server/collectors/usage/ensure_deep_object.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/usage/ensure_deep_object.ts
rename to src/plugins/telemetry/server/collectors/usage/ensure_deep_object.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/usage/index.ts b/src/plugins/telemetry/server/collectors/usage/index.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/usage/index.ts
rename to src/plugins/telemetry/server/collectors/usage/index.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts b/src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
similarity index 89%
rename from src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
rename to src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
index 78685cd6becc8..f44603f4f19f4 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
+++ b/src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.test.ts
@@ -18,7 +18,6 @@
  */
 
 import { writeFileSync, unlinkSync } from 'fs';
-import { Server } from 'hapi';
 import { resolve } from 'path';
 import { tmpdir } from 'os';
 import {
@@ -32,20 +31,6 @@ const mockUsageCollector = () => ({
   makeUsageCollector: jest.fn().mockImplementationOnce((arg: object) => arg),
 });
 
-const serverWithConfig = (configPath: string): Server => {
-  return {
-    config: () => ({
-      get: (key: string) => {
-        if (key !== 'telemetry.config' && key !== 'xpack.xpack_main.telemetry.config') {
-          throw new Error('Expected `telemetry.config`');
-        }
-
-        return configPath;
-      },
-    }),
-  } as Server;
-};
-
 describe('telemetry_usage_collector', () => {
   const tempDir = tmpdir();
   const tempFiles = {
@@ -129,11 +114,13 @@ describe('telemetry_usage_collector', () => {
       // note: it uses the file's path to get the directory, then looks for 'telemetry.yml'
       // exclusively, which is indirectly tested by passing it the wrong "file" in the same
       // dir
-      const server: Server = serverWithConfig(tempFiles.unreadable);
 
       // the `makeUsageCollector` is mocked above to return the argument passed to it
       const usageCollector = mockUsageCollector() as any;
-      const collectorOptions = createTelemetryUsageCollector(usageCollector, server);
+      const collectorOptions = createTelemetryUsageCollector(
+        usageCollector,
+        () => tempFiles.unreadable
+      );
 
       expect(collectorOptions.type).toBe('static_telemetry');
       expect(await collectorOptions.fetch({} as any)).toEqual(expectedObject); // Sending any as the callCluster client because it's not needed in this collector but TS requires it when calling it.
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.ts b/src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.ts
similarity index 87%
rename from src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.ts
rename to src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.ts
index 6919b6959aa8c..3daae90106e9e 100644
--- a/src/legacy/core_plugins/telemetry/server/collectors/usage/telemetry_usage_collector.ts
+++ b/src/plugins/telemetry/server/collectors/usage/telemetry_usage_collector.ts
@@ -18,13 +18,16 @@
  */
 
 import { accessSync, constants, readFileSync, statSync } from 'fs';
-import { Server } from 'hapi';
 import { safeLoad } from 'js-yaml';
 import { dirname, join } from 'path';
 
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { getConfigPath } from '../../../../../core/server/path';
+
 // look for telemetry.yml in the same places we expect kibana.yml
 import { ensureDeepObject } from './ensure_deep_object';
-import { UsageCollectionSetup } from '../../../../../../plugins/usage_collection/server';
 
 /**
  * The maximum file size before we ignore it (note: this limit is arbitrary).
@@ -77,24 +80,20 @@ export async function readTelemetryFile(path: string): Promise<object | undefine
 
 export function createTelemetryUsageCollector(
   usageCollection: UsageCollectionSetup,
-  server: Server
+  getConfigPathFn = getConfigPath // exposed for testing
 ) {
   return usageCollection.makeUsageCollector({
     type: 'static_telemetry',
     isReady: () => true,
     fetch: async () => {
-      const config = server.config();
-      const configPath = config.get('telemetry.config') as string;
+      const configPath = getConfigPathFn();
       const telemetryPath = join(dirname(configPath), 'telemetry.yml');
       return await readTelemetryFile(telemetryPath);
     },
   });
 }
 
-export function registerTelemetryUsageCollector(
-  usageCollection: UsageCollectionSetup,
-  server: Server
-) {
-  const collector = createTelemetryUsageCollector(usageCollection, server);
+export function registerTelemetryUsageCollector(usageCollection: UsageCollectionSetup) {
+  const collector = createTelemetryUsageCollector(usageCollection);
   usageCollection.registerCollector(collector);
 }
diff --git a/src/plugins/telemetry/server/config.ts b/src/plugins/telemetry/server/config.ts
new file mode 100644
index 0000000000000..7c62a37df7170
--- /dev/null
+++ b/src/plugins/telemetry/server/config.ts
@@ -0,0 +1,61 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { schema, TypeOf } from '@kbn/config-schema';
+import { ENDPOINT_VERSION } from '../common/constants';
+
+export const configSchema = schema.object({
+  enabled: schema.boolean({ defaultValue: true }),
+  allowChangingOptInStatus: schema.boolean({ defaultValue: true }),
+  optIn: schema.conditional(
+    schema.siblingRef('allowChangingOptInStatus'),
+    schema.literal(false),
+    schema.maybe(schema.literal(true)),
+    schema.boolean({ defaultValue: true }),
+    { defaultValue: true }
+  ),
+  // `config` is used internally and not intended to be set
+  // config: Joi.string().default(getConfigPath()), TODO: Get it in some other way
+  banner: schema.boolean({ defaultValue: true }),
+  url: schema.conditional(
+    schema.contextRef('dev'),
+    schema.literal(true),
+    schema.string({
+      defaultValue: `https://telemetry-staging.elastic.co/xpack/${ENDPOINT_VERSION}/send`,
+    }),
+    schema.string({
+      defaultValue: `https://telemetry.elastic.co/xpack/${ENDPOINT_VERSION}/send`,
+    })
+  ),
+  optInStatusUrl: schema.conditional(
+    schema.contextRef('dev'),
+    schema.literal(true),
+    schema.string({
+      defaultValue: `https://telemetry-staging.elastic.co/opt_in_status/${ENDPOINT_VERSION}/send`,
+    }),
+    schema.string({
+      defaultValue: `https://telemetry.elastic.co/opt_in_status/${ENDPOINT_VERSION}/send`,
+    })
+  ),
+  sendUsageFrom: schema.oneOf([schema.literal('server'), schema.literal('browser')], {
+    defaultValue: 'browser',
+  }),
+});
+
+export type TelemetryConfigType = TypeOf<typeof configSchema>;
diff --git a/src/legacy/core_plugins/telemetry/server/fetcher.ts b/src/plugins/telemetry/server/fetcher.ts
similarity index 55%
rename from src/legacy/core_plugins/telemetry/server/fetcher.ts
rename to src/plugins/telemetry/server/fetcher.ts
index d30ee10066813..be85824855ff3 100644
--- a/src/legacy/core_plugins/telemetry/server/fetcher.ts
+++ b/src/plugins/telemetry/server/fetcher.ts
@@ -18,48 +18,109 @@
  */
 
 import moment from 'moment';
+import { Observable } from 'rxjs';
+import { take } from 'rxjs/operators';
 // @ts-ignore
 import fetch from 'node-fetch';
-import { telemetryCollectionManager } from './collection_manager';
+import { TelemetryCollectionManagerPluginStart } from 'src/plugins/telemetry_collection_manager/server';
+import {
+  PluginInitializerContext,
+  Logger,
+  SavedObjectsClientContract,
+  SavedObjectsClient,
+  CoreStart,
+  ICustomClusterClient,
+} from '../../../core/server';
 import {
   getTelemetryOptIn,
   getTelemetrySendUsageFrom,
   getTelemetryFailureDetails,
-} from './telemetry_config';
+} from '../common/telemetry_config';
 import { getTelemetrySavedObject, updateTelemetrySavedObject } from './telemetry_repository';
 import { REPORT_INTERVAL_MS } from '../common/constants';
+import { TelemetryConfigType } from './config';
+
+export interface FetcherTaskDepsStart {
+  telemetryCollectionManager: TelemetryCollectionManagerPluginStart;
+}
 
 export class FetcherTask {
   private readonly initialCheckDelayMs = 60 * 1000 * 5;
   private readonly checkIntervalMs = 60 * 1000 * 60 * 12;
+  private readonly config$: Observable<TelemetryConfigType>;
+  private readonly currentKibanaVersion: string;
+  private readonly logger: Logger;
   private intervalId?: NodeJS.Timeout;
   private lastReported?: number;
-  private currentVersion: string;
   private isSending = false;
-  private server: any;
+  private internalRepository?: SavedObjectsClientContract;
+  private telemetryCollectionManager?: TelemetryCollectionManagerPluginStart;
+  private elasticsearchClient?: ICustomClusterClient;
+
+  constructor(initializerContext: PluginInitializerContext<TelemetryConfigType>) {
+    this.config$ = initializerContext.config.create();
+    this.currentKibanaVersion = initializerContext.env.packageInfo.version;
+    this.logger = initializerContext.logger.get('fetcher');
+  }
+
+  public start(
+    { savedObjects, elasticsearch }: CoreStart,
+    { telemetryCollectionManager }: FetcherTaskDepsStart
+  ) {
+    this.internalRepository = new SavedObjectsClient(savedObjects.createInternalRepository());
+    this.telemetryCollectionManager = telemetryCollectionManager;
+    this.elasticsearchClient = elasticsearch.legacy.createClient('telemetry-fetcher');
+
+    setTimeout(() => {
+      this.sendIfDue();
+      this.intervalId = setInterval(() => this.sendIfDue(), this.checkIntervalMs);
+    }, this.initialCheckDelayMs);
+  }
+
+  public stop() {
+    if (this.intervalId) {
+      clearInterval(this.intervalId);
+    }
+    if (this.elasticsearchClient) {
+      this.elasticsearchClient.close();
+    }
+  }
 
-  constructor(server: any) {
-    this.server = server;
-    this.currentVersion = this.server.config().get('pkg.version');
+  private async sendIfDue() {
+    if (this.isSending) {
+      return;
+    }
+    const telemetryConfig = await this.getCurrentConfigs();
+    if (!this.shouldSendReport(telemetryConfig)) {
+      return;
+    }
+
+    try {
+      this.isSending = true;
+      const clusters = await this.fetchTelemetry();
+      const { telemetryUrl } = telemetryConfig;
+      for (const cluster of clusters) {
+        await this.sendTelemetry(telemetryUrl, cluster);
+      }
+
+      await this.updateLastReported();
+    } catch (err) {
+      await this.updateReportFailure(telemetryConfig);
+
+      this.logger.warn(`Error sending telemetry usage data: ${err}`);
+    }
+    this.isSending = false;
   }
 
-  private getInternalRepository = () => {
-    const { getSavedObjectsRepository } = this.server.savedObjects;
-    const { callWithInternalUser } = this.server.plugins.elasticsearch.getCluster('admin');
-    const internalRepository = getSavedObjectsRepository(callWithInternalUser);
-    return internalRepository;
-  };
-
-  private getCurrentConfigs = async () => {
-    const internalRepository = this.getInternalRepository();
-    const telemetrySavedObject = await getTelemetrySavedObject(internalRepository);
-    const config = this.server.config();
-    const currentKibanaVersion = config.get('pkg.version');
-    const configTelemetrySendUsageFrom = config.get('telemetry.sendUsageFrom');
-    const allowChangingOptInStatus = config.get('telemetry.allowChangingOptInStatus');
-    const configTelemetryOptIn = config.get('telemetry.optIn');
-    const telemetryUrl = config.get('telemetry.url') as string;
-    const { failureCount, failureVersion } = await getTelemetryFailureDetails({
+  private async getCurrentConfigs() {
+    const telemetrySavedObject = await getTelemetrySavedObject(this.internalRepository!);
+    const config = await this.config$.pipe(take(1)).toPromise();
+    const currentKibanaVersion = this.currentKibanaVersion;
+    const configTelemetrySendUsageFrom = config.sendUsageFrom;
+    const allowChangingOptInStatus = config.allowChangingOptInStatus;
+    const configTelemetryOptIn = typeof config.optIn === 'undefined' ? null : config.optIn;
+    const telemetryUrl = config.url;
+    const { failureCount, failureVersion } = getTelemetryFailureDetails({
       telemetrySavedObject,
     });
 
@@ -78,33 +139,30 @@ export class FetcherTask {
       failureCount,
       failureVersion,
     };
-  };
+  }
 
-  private updateLastReported = async () => {
-    const internalRepository = this.getInternalRepository();
+  private async updateLastReported() {
     this.lastReported = Date.now();
-    updateTelemetrySavedObject(internalRepository, {
+    updateTelemetrySavedObject(this.internalRepository!, {
       reportFailureCount: 0,
       lastReported: this.lastReported,
     });
-  };
-
-  private updateReportFailure = async ({ failureCount }: { failureCount: number }) => {
-    const internalRepository = this.getInternalRepository();
+  }
 
-    updateTelemetrySavedObject(internalRepository, {
+  private async updateReportFailure({ failureCount }: { failureCount: number }) {
+    updateTelemetrySavedObject(this.internalRepository!, {
       reportFailureCount: failureCount + 1,
-      reportFailureVersion: this.currentVersion,
+      reportFailureVersion: this.currentKibanaVersion,
     });
-  };
+  }
 
-  private shouldSendReport = ({
+  private shouldSendReport({
     telemetryOptIn,
     telemetrySendUsageFrom,
     reportFailureCount,
     currentVersion,
     reportFailureVersion,
-  }: any) => {
+  }: any) {
     if (reportFailureCount > 2 && reportFailureVersion === currentVersion) {
       return false;
     }
@@ -115,21 +173,20 @@ export class FetcherTask {
       }
     }
     return false;
-  };
+  }
 
-  private fetchTelemetry = async () => {
-    return await telemetryCollectionManager.getStats({
+  private async fetchTelemetry() {
+    return await this.telemetryCollectionManager!.getStats({
       unencrypted: false,
-      server: this.server,
       start: moment()
         .subtract(20, 'minutes')
         .toISOString(),
       end: moment().toISOString(),
     });
-  };
+  }
 
-  private sendTelemetry = async (url: string, cluster: any): Promise<void> => {
-    this.server.log(['debug', 'telemetry', 'fetcher'], `Sending usage stats.`);
+  private async sendTelemetry(url: string, cluster: any): Promise<void> {
+    this.logger.debug(`Sending usage stats.`);
     /**
      * send OPTIONS before sending usage data.
      * OPTIONS is less intrusive as it does not contain any payload and is used here to check if the endpoint is reachable.
@@ -142,47 +199,5 @@ export class FetcherTask {
       method: 'post',
       body: cluster,
     });
-  };
-
-  private sendIfDue = async () => {
-    if (this.isSending) {
-      return;
-    }
-    const telemetryConfig = await this.getCurrentConfigs();
-    if (!this.shouldSendReport(telemetryConfig)) {
-      return;
-    }
-
-    try {
-      this.isSending = true;
-      const clusters = await this.fetchTelemetry();
-      const { telemetryUrl } = telemetryConfig;
-      for (const cluster of clusters) {
-        await this.sendTelemetry(telemetryUrl, cluster);
-      }
-
-      await this.updateLastReported();
-    } catch (err) {
-      await this.updateReportFailure(telemetryConfig);
-
-      this.server.log(
-        ['warning', 'telemetry', 'fetcher'],
-        `Error sending telemetry usage data: ${err}`
-      );
-    }
-    this.isSending = false;
-  };
-
-  public start = () => {
-    setTimeout(() => {
-      this.sendIfDue();
-      this.intervalId = setInterval(() => this.sendIfDue(), this.checkIntervalMs);
-    }, this.initialCheckDelayMs);
-  };
-
-  public stop = () => {
-    if (this.intervalId) {
-      clearInterval(this.intervalId);
-    }
-  };
+  }
 }
diff --git a/src/legacy/core_plugins/telemetry/server/handle_old_settings/handle_old_settings.ts b/src/plugins/telemetry/server/handle_old_settings/handle_old_settings.ts
similarity index 74%
rename from src/legacy/core_plugins/telemetry/server/handle_old_settings/handle_old_settings.ts
rename to src/plugins/telemetry/server/handle_old_settings/handle_old_settings.ts
index b28a01bffa44d..3562ba452104c 100644
--- a/src/legacy/core_plugins/telemetry/server/handle_old_settings/handle_old_settings.ts
+++ b/src/plugins/telemetry/server/handle_old_settings/handle_old_settings.ts
@@ -26,27 +26,25 @@
  * @return {Boolean} {@code true} if the banner should still be displayed. {@code false} if the banner should not be displayed.
  */
 
-import { Server } from 'hapi';
+import { IUiSettingsClient, SavedObjectsClientContract } from 'kibana/server';
 import { CONFIG_TELEMETRY } from '../../common/constants';
 import { updateTelemetrySavedObject } from '../telemetry_repository';
 
 const CONFIG_ALLOW_REPORT = 'xPackMonitoring:allowReport';
 
-export async function handleOldSettings(server: Server) {
-  const { getSavedObjectsRepository } = server.savedObjects;
-  const { callWithInternalUser } = server.plugins.elasticsearch.getCluster('admin');
-  const savedObjectsClient = getSavedObjectsRepository(callWithInternalUser);
-  const uiSettings = server.uiSettingsServiceFactory({ savedObjectsClient });
-
-  const oldTelemetrySetting = await uiSettings.get(CONFIG_TELEMETRY);
-  const oldAllowReportSetting = await uiSettings.get(CONFIG_ALLOW_REPORT);
+export async function handleOldSettings(
+  savedObjectsClient: SavedObjectsClientContract,
+  uiSettingsClient: IUiSettingsClient
+) {
+  const oldTelemetrySetting = await uiSettingsClient.get(CONFIG_TELEMETRY);
+  const oldAllowReportSetting = await uiSettingsClient.get(CONFIG_ALLOW_REPORT);
   let legacyOptInValue = null;
 
   if (typeof oldTelemetrySetting === 'boolean') {
     legacyOptInValue = oldTelemetrySetting;
   } else if (
     typeof oldAllowReportSetting === 'boolean' &&
-    uiSettings.isOverridden(CONFIG_ALLOW_REPORT)
+    uiSettingsClient.isOverridden(CONFIG_ALLOW_REPORT)
   ) {
     legacyOptInValue = oldAllowReportSetting;
   }
diff --git a/src/legacy/core_plugins/telemetry/server/handle_old_settings/index.ts b/src/plugins/telemetry/server/handle_old_settings/index.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/handle_old_settings/index.ts
rename to src/plugins/telemetry/server/handle_old_settings/index.ts
diff --git a/src/legacy/core_plugins/telemetry/server/index.ts b/src/plugins/telemetry/server/index.ts
similarity index 60%
rename from src/legacy/core_plugins/telemetry/server/index.ts
rename to src/plugins/telemetry/server/index.ts
index 85d7d80234ffc..d048c8f5e9427 100644
--- a/src/legacy/core_plugins/telemetry/server/index.ts
+++ b/src/plugins/telemetry/server/index.ts
@@ -17,15 +17,34 @@
  * under the License.
  */
 
-import { PluginInitializerContext } from 'src/core/server';
+import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server';
 import { TelemetryPlugin } from './plugin';
 import * as constants from '../common/constants';
+import { configSchema, TelemetryConfigType } from './config';
 
 export { FetcherTask } from './fetcher';
-export { replaceTelemetryInjectedVars } from './telemetry_config';
 export { handleOldSettings } from './handle_old_settings';
-export { telemetryCollectionManager } from './collection_manager';
-export { PluginsSetup } from './plugin';
-export const telemetryPlugin = (initializerContext: PluginInitializerContext) =>
+export { TelemetryPluginsSetup } from './plugin';
+
+export const config: PluginConfigDescriptor<TelemetryConfigType> = {
+  schema: configSchema,
+  exposeToBrowser: {
+    enabled: true,
+    url: true,
+    banner: true,
+    allowChangingOptInStatus: true,
+    optIn: true,
+    optInStatusUrl: true,
+    sendUsageFrom: true,
+  },
+};
+
+export const plugin = (initializerContext: PluginInitializerContext<TelemetryConfigType>) =>
   new TelemetryPlugin(initializerContext);
 export { constants };
+export {
+  getClusterUuids,
+  getLocalLicense,
+  getLocalStats,
+  TelemetryLocalStats,
+} from './telemetry_collection';
diff --git a/src/plugins/telemetry/server/plugin.ts b/src/plugins/telemetry/server/plugin.ts
new file mode 100644
index 0000000000000..af512d234a7dc
--- /dev/null
+++ b/src/plugins/telemetry/server/plugin.ts
@@ -0,0 +1,168 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Observable } from 'rxjs';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import {
+  TelemetryCollectionManagerPluginSetup,
+  TelemetryCollectionManagerPluginStart,
+} from 'src/plugins/telemetry_collection_manager/server';
+import {
+  CoreSetup,
+  PluginInitializerContext,
+  ISavedObjectsRepository,
+  CoreStart,
+  IUiSettingsClient,
+  SavedObjectsClient,
+  Plugin,
+  Logger,
+} from '../../../core/server';
+import { registerRoutes } from './routes';
+import { registerCollection } from './telemetry_collection';
+import {
+  registerUiMetricUsageCollector,
+  registerTelemetryUsageCollector,
+  registerTelemetryPluginUsageCollector,
+  registerManagementUsageCollector,
+  registerApplicationUsageCollector,
+} from './collectors';
+import { TelemetryConfigType } from './config';
+import { FetcherTask } from './fetcher';
+import { handleOldSettings } from './handle_old_settings';
+
+export interface TelemetryPluginsSetup {
+  usageCollection: UsageCollectionSetup;
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup;
+}
+
+export interface TelemetryPluginsStart {
+  telemetryCollectionManager: TelemetryCollectionManagerPluginStart;
+}
+
+type SavedObjectsRegisterType = CoreSetup['savedObjects']['registerType'];
+
+export class TelemetryPlugin implements Plugin {
+  private readonly logger: Logger;
+  private readonly currentKibanaVersion: string;
+  private readonly config$: Observable<TelemetryConfigType>;
+  private readonly isDev: boolean;
+  private readonly fetcherTask: FetcherTask;
+  private savedObjectsClient?: ISavedObjectsRepository;
+  private uiSettingsClient?: IUiSettingsClient;
+
+  constructor(initializerContext: PluginInitializerContext<TelemetryConfigType>) {
+    this.logger = initializerContext.logger.get();
+    this.isDev = initializerContext.env.mode.dev;
+    this.currentKibanaVersion = initializerContext.env.packageInfo.version;
+    this.config$ = initializerContext.config.create();
+    this.fetcherTask = new FetcherTask({
+      ...initializerContext,
+      logger: this.logger,
+    });
+  }
+
+  public async setup(
+    core: CoreSetup,
+    { usageCollection, telemetryCollectionManager }: TelemetryPluginsSetup
+  ) {
+    const currentKibanaVersion = this.currentKibanaVersion;
+    const config$ = this.config$;
+    const isDev = this.isDev;
+
+    registerCollection(telemetryCollectionManager, core.elasticsearch.dataClient);
+    const router = core.http.createRouter();
+
+    registerRoutes({
+      config$,
+      currentKibanaVersion,
+      isDev,
+      router,
+      telemetryCollectionManager,
+    });
+
+    this.registerMappings(opts => core.savedObjects.registerType(opts));
+    this.registerUsageCollectors(usageCollection, opts => core.savedObjects.registerType(opts));
+  }
+
+  public async start(core: CoreStart, { telemetryCollectionManager }: TelemetryPluginsStart) {
+    const { savedObjects, uiSettings } = core;
+    this.savedObjectsClient = savedObjects.createInternalRepository();
+    const savedObjectsClient = new SavedObjectsClient(this.savedObjectsClient);
+    this.uiSettingsClient = uiSettings.asScopedToClient(savedObjectsClient);
+
+    try {
+      await handleOldSettings(savedObjectsClient, this.uiSettingsClient);
+    } catch (error) {
+      this.logger.warn('Unable to update legacy telemetry configs.');
+    }
+
+    this.fetcherTask.start(core, { telemetryCollectionManager });
+  }
+
+  private registerMappings(registerType: SavedObjectsRegisterType) {
+    registerType({
+      name: 'telemetry',
+      hidden: false,
+      namespaceAgnostic: true,
+      mappings: {
+        properties: {
+          enabled: {
+            type: 'boolean',
+          },
+          sendUsageFrom: {
+            type: 'keyword',
+          },
+          lastReported: {
+            type: 'date',
+          },
+          lastVersionChecked: {
+            type: 'keyword',
+          },
+          userHasSeenNotice: {
+            type: 'boolean',
+          },
+          reportFailureCount: {
+            type: 'integer',
+          },
+          reportFailureVersion: {
+            type: 'keyword',
+          },
+        },
+      },
+    });
+  }
+
+  private registerUsageCollectors(
+    usageCollection: UsageCollectionSetup,
+    registerType: SavedObjectsRegisterType
+  ) {
+    const getSavedObjectsClient = () => this.savedObjectsClient;
+    const getUiSettingsClient = () => this.uiSettingsClient;
+
+    registerTelemetryPluginUsageCollector(usageCollection, {
+      currentKibanaVersion: this.currentKibanaVersion,
+      config$: this.config$,
+      getSavedObjectsClient,
+    });
+    registerTelemetryUsageCollector(usageCollection);
+    registerManagementUsageCollector(usageCollection, getUiSettingsClient);
+    registerUiMetricUsageCollector(usageCollection, registerType, getSavedObjectsClient);
+    registerApplicationUsageCollector(usageCollection, registerType, getSavedObjectsClient);
+  }
+}
diff --git a/src/legacy/core_plugins/telemetry/server/routes/index.ts b/src/plugins/telemetry/server/routes/index.ts
similarity index 61%
rename from src/legacy/core_plugins/telemetry/server/routes/index.ts
rename to src/plugins/telemetry/server/routes/index.ts
index 31ff1682d6806..ad84cb9d2665d 100644
--- a/src/legacy/core_plugins/telemetry/server/routes/index.ts
+++ b/src/plugins/telemetry/server/routes/index.ts
@@ -17,22 +17,27 @@
  * under the License.
  */
 
-import { Legacy } from 'kibana';
-import { CoreSetup } from 'src/core/server';
+import { Observable } from 'rxjs';
+import { IRouter } from 'kibana/server';
+import { TelemetryCollectionManagerPluginSetup } from 'src/plugins/telemetry_collection_manager/server';
 import { registerTelemetryOptInRoutes } from './telemetry_opt_in';
 import { registerTelemetryUsageStatsRoutes } from './telemetry_usage_stats';
 import { registerTelemetryOptInStatsRoutes } from './telemetry_opt_in_stats';
 import { registerTelemetryUserHasSeenNotice } from './telemetry_user_has_seen_notice';
+import { TelemetryConfigType } from '../config';
 
 interface RegisterRoutesParams {
-  core: CoreSetup;
+  isDev: boolean;
+  config$: Observable<TelemetryConfigType>;
   currentKibanaVersion: string;
-  server: Legacy.Server;
+  router: IRouter;
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup;
 }
 
-export function registerRoutes({ core, currentKibanaVersion, server }: RegisterRoutesParams) {
-  registerTelemetryOptInRoutes({ core, currentKibanaVersion, server });
-  registerTelemetryUsageStatsRoutes(server);
-  registerTelemetryOptInStatsRoutes(server);
-  registerTelemetryUserHasSeenNotice(server);
+export function registerRoutes(options: RegisterRoutesParams) {
+  const { isDev, telemetryCollectionManager, router } = options;
+  registerTelemetryOptInRoutes(options);
+  registerTelemetryUsageStatsRoutes(router, telemetryCollectionManager, isDev);
+  registerTelemetryOptInStatsRoutes(router, telemetryCollectionManager);
+  registerTelemetryUserHasSeenNotice(router);
 }
diff --git a/src/plugins/telemetry/server/routes/telemetry_opt_in.ts b/src/plugins/telemetry/server/routes/telemetry_opt_in.ts
new file mode 100644
index 0000000000000..e65ade0ab8aaa
--- /dev/null
+++ b/src/plugins/telemetry/server/routes/telemetry_opt_in.ts
@@ -0,0 +1,101 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import moment from 'moment';
+import { Observable } from 'rxjs';
+import { take } from 'rxjs/operators';
+import { schema } from '@kbn/config-schema';
+import { IRouter } from 'kibana/server';
+import { TelemetryCollectionManagerPluginSetup } from 'src/plugins/telemetry_collection_manager/server';
+import { getTelemetryAllowChangingOptInStatus } from '../../common/telemetry_config';
+import { sendTelemetryOptInStatus } from './telemetry_opt_in_stats';
+
+import {
+  TelemetrySavedObjectAttributes,
+  updateTelemetrySavedObject,
+  getTelemetrySavedObject,
+} from '../telemetry_repository';
+import { TelemetryConfigType } from '../config';
+
+interface RegisterOptInRoutesParams {
+  currentKibanaVersion: string;
+  router: IRouter;
+  config$: Observable<TelemetryConfigType>;
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup;
+}
+
+export function registerTelemetryOptInRoutes({
+  config$,
+  router,
+  currentKibanaVersion,
+  telemetryCollectionManager,
+}: RegisterOptInRoutesParams) {
+  router.post(
+    {
+      path: '/api/telemetry/v2/optIn',
+      validate: {
+        body: schema.object({ enabled: schema.boolean() }),
+      },
+    },
+    async (context, req, res) => {
+      const newOptInStatus = req.body.enabled;
+      const attributes: TelemetrySavedObjectAttributes = {
+        enabled: newOptInStatus,
+        lastVersionChecked: currentKibanaVersion,
+      };
+      const config = await config$.pipe(take(1)).toPromise();
+      const telemetrySavedObject = await getTelemetrySavedObject(context.core.savedObjects.client);
+
+      if (telemetrySavedObject === false) {
+        // If we get false, we couldn't get the saved object due to lack of permissions
+        // so we can assume the user won't be able to update it either
+        return res.forbidden();
+      }
+
+      const configTelemetryAllowChangingOptInStatus = config.allowChangingOptInStatus;
+      const allowChangingOptInStatus = getTelemetryAllowChangingOptInStatus({
+        telemetrySavedObject,
+        configTelemetryAllowChangingOptInStatus,
+      });
+      if (!allowChangingOptInStatus) {
+        return res.badRequest({
+          body: JSON.stringify({ error: 'Not allowed to change Opt-in Status.' }),
+        });
+      }
+
+      if (config.sendUsageFrom === 'server') {
+        const optInStatusUrl = config.optInStatusUrl;
+        await sendTelemetryOptInStatus(
+          telemetryCollectionManager,
+          { optInStatusUrl, newOptInStatus },
+          {
+            start: moment()
+              .subtract(20, 'minutes')
+              .toISOString(),
+            end: moment().toISOString(),
+            unencrypted: false,
+          }
+        );
+      }
+
+      await updateTelemetrySavedObject(context.core.savedObjects.client, attributes);
+      return res.ok({});
+    }
+  );
+}
diff --git a/src/legacy/core_plugins/telemetry/server/routes/telemetry_opt_in_stats.ts b/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.ts
similarity index 65%
rename from src/legacy/core_plugins/telemetry/server/routes/telemetry_opt_in_stats.ts
rename to src/plugins/telemetry/server/routes/telemetry_opt_in_stats.ts
index e64f3f6ff8a94..3263c6d49523c 100644
--- a/src/legacy/core_plugins/telemetry/server/routes/telemetry_opt_in_stats.ts
+++ b/src/plugins/telemetry/server/routes/telemetry_opt_in_stats.ts
@@ -19,10 +19,14 @@
 
 // @ts-ignore
 import fetch from 'node-fetch';
-import Joi from 'joi';
 import moment from 'moment';
-import { Legacy } from 'kibana';
-import { telemetryCollectionManager, StatsGetterConfig } from '../collection_manager';
+
+import { IRouter } from 'kibana/server';
+import { schema } from '@kbn/config-schema';
+import {
+  TelemetryCollectionManagerPluginSetup,
+  StatsGetterConfig,
+} from 'src/plugins/telemetry_collection_manager/server';
 
 interface SendTelemetryOptInStatusConfig {
   optInStatusUrl: string;
@@ -30,6 +34,7 @@ interface SendTelemetryOptInStatusConfig {
 }
 
 export async function sendTelemetryOptInStatus(
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup,
   config: SendTelemetryOptInStatusConfig,
   statsGetterConfig: StatsGetterConfig
 ) {
@@ -45,41 +50,42 @@ export async function sendTelemetryOptInStatus(
   });
 }
 
-export function registerTelemetryOptInStatsRoutes(server: Legacy.Server) {
-  server.route({
-    method: 'POST',
-    path: '/api/telemetry/v2/clusters/_opt_in_stats',
-    options: {
+export function registerTelemetryOptInStatsRoutes(
+  router: IRouter,
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup
+) {
+  router.post(
+    {
+      path: '/api/telemetry/v2/clusters/_opt_in_stats',
       validate: {
-        payload: Joi.object({
-          enabled: Joi.bool().required(),
-          unencrypted: Joi.bool().default(true),
+        body: schema.object({
+          enabled: schema.boolean(),
+          unencrypted: schema.boolean({ defaultValue: true }),
         }),
       },
     },
-    handler: async (req: any, h: any) => {
+    async (context, req, res) => {
       try {
-        const newOptInStatus = req.payload.enabled;
-        const unencrypted = req.payload.unencrypted;
-        const statsGetterConfig = {
+        const newOptInStatus = req.body.enabled;
+        const unencrypted = req.body.unencrypted;
+
+        const statsGetterConfig: StatsGetterConfig = {
           start: moment()
             .subtract(20, 'minutes')
             .toISOString(),
           end: moment().toISOString(),
-          server: req.server,
-          req,
           unencrypted,
+          request: req,
         };
 
         const optInStatus = await telemetryCollectionManager.getOptInStats(
           newOptInStatus,
           statsGetterConfig
         );
-
-        return h.response(optInStatus).code(200);
+        return res.ok({ body: optInStatus });
       } catch (err) {
-        return h.response([]).code(200);
+        return res.ok({ body: [] });
       }
-    },
-  });
+    }
+  );
 }
diff --git a/src/plugins/telemetry/server/routes/telemetry_usage_stats.ts b/src/plugins/telemetry/server/routes/telemetry_usage_stats.ts
new file mode 100644
index 0000000000000..15d4c0ca2fa55
--- /dev/null
+++ b/src/plugins/telemetry/server/routes/telemetry_usage_stats.ts
@@ -0,0 +1,82 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import moment from 'moment';
+import { schema } from '@kbn/config-schema';
+import { TypeOptions } from '@kbn/config-schema/target/types/types';
+import { IRouter } from 'kibana/server';
+import {
+  TelemetryCollectionManagerPluginSetup,
+  StatsGetterConfig,
+} from 'src/plugins/telemetry_collection_manager/server';
+
+const validate: TypeOptions<string | number>['validate'] = value => {
+  if (!moment(value).isValid()) {
+    return `${value} is not a valid date`;
+  }
+};
+
+const dateSchema = schema.oneOf([schema.string({ validate }), schema.number({ validate })]);
+
+export function registerTelemetryUsageStatsRoutes(
+  router: IRouter,
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup,
+  isDev: boolean
+) {
+  router.post(
+    {
+      path: '/api/telemetry/v2/clusters/_stats',
+      validate: {
+        body: schema.object({
+          unencrypted: schema.boolean({ defaultValue: false }),
+          timeRange: schema.object({
+            min: dateSchema,
+            max: dateSchema,
+          }),
+        }),
+      },
+    },
+    async (context, req, res) => {
+      const start = moment(req.body.timeRange.min).toISOString();
+      const end = moment(req.body.timeRange.max).toISOString();
+      const unencrypted = req.body.unencrypted;
+
+      try {
+        const statsConfig: StatsGetterConfig = {
+          unencrypted,
+          start,
+          end,
+          request: req,
+        };
+        const stats = await telemetryCollectionManager.getStats(statsConfig);
+        return res.ok({ body: stats });
+      } catch (err) {
+        if (isDev) {
+          // don't ignore errors when running in dev mode
+          throw err;
+        }
+        if (unencrypted && err.status === 403) {
+          return res.forbidden();
+        }
+        // ignore errors and return empty set
+        return res.ok({ body: [] });
+      }
+    }
+  );
+}
diff --git a/src/legacy/core_plugins/telemetry/server/routes/telemetry_user_has_seen_notice.ts b/src/plugins/telemetry/server/routes/telemetry_user_has_seen_notice.ts
similarity index 65%
rename from src/legacy/core_plugins/telemetry/server/routes/telemetry_user_has_seen_notice.ts
rename to src/plugins/telemetry/server/routes/telemetry_user_has_seen_notice.ts
index 665e6d9aaeb75..45a5147107f02 100644
--- a/src/legacy/core_plugins/telemetry/server/routes/telemetry_user_has_seen_notice.ts
+++ b/src/plugins/telemetry/server/routes/telemetry_user_has_seen_notice.ts
@@ -17,8 +17,7 @@
  * under the License.
  */
 
-import { Legacy } from 'kibana';
-import { Request } from 'hapi';
+import { IRouter } from 'kibana/server';
 import {
   TelemetrySavedObject,
   TelemetrySavedObjectAttributes,
@@ -26,19 +25,14 @@ import {
   updateTelemetrySavedObject,
 } from '../telemetry_repository';
 
-const getInternalRepository = (server: Legacy.Server) => {
-  const { getSavedObjectsRepository } = server.savedObjects;
-  const { callWithInternalUser } = server.plugins.elasticsearch.getCluster('admin');
-  const internalRepository = getSavedObjectsRepository(callWithInternalUser);
-  return internalRepository;
-};
-
-export function registerTelemetryUserHasSeenNotice(server: Legacy.Server) {
-  server.route({
-    method: 'PUT',
-    path: '/api/telemetry/v2/userHasSeenNotice',
-    handler: async (req: Request): Promise<TelemetrySavedObjectAttributes> => {
-      const internalRepository = getInternalRepository(server);
+export function registerTelemetryUserHasSeenNotice(router: IRouter) {
+  router.put(
+    {
+      path: '/api/telemetry/v2/userHasSeenNotice',
+      validate: false,
+    },
+    async (context, req, res) => {
+      const internalRepository = context.core.savedObjects.client;
       const telemetrySavedObject: TelemetrySavedObject = await getTelemetrySavedObject(
         internalRepository
       );
@@ -50,7 +44,7 @@ export function registerTelemetryUserHasSeenNotice(server: Legacy.Server) {
       };
       await updateTelemetrySavedObject(internalRepository, updatedAttributes);
 
-      return updatedAttributes;
-    },
-  });
+      return res.ok({ body: updatedAttributes });
+    }
+  );
 }
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/__tests__/get_cluster_info.js b/src/plugins/telemetry/server/telemetry_collection/__tests__/get_cluster_info.js
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/__tests__/get_cluster_info.js
rename to src/plugins/telemetry/server/telemetry_collection/__tests__/get_cluster_info.js
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/__tests__/get_cluster_stats.js b/src/plugins/telemetry/server/telemetry_collection/__tests__/get_cluster_stats.js
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/__tests__/get_cluster_stats.js
rename to src/plugins/telemetry/server/telemetry_collection/__tests__/get_cluster_stats.js
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/__tests__/get_local_stats.js b/src/plugins/telemetry/server/telemetry_collection/__tests__/get_local_stats.js
similarity index 96%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/__tests__/get_local_stats.js
rename to src/plugins/telemetry/server/telemetry_collection/__tests__/get_local_stats.js
index 94627953f1ac6..ac3c5307adcf6 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/__tests__/get_local_stats.js
+++ b/src/plugins/telemetry/server/telemetry_collection/__tests__/get_local_stats.js
@@ -128,9 +128,14 @@ describe('get_local_stats', () => {
     },
   };
 
+  const context = {
+    logger: console,
+    version: '8.0.0',
+  };
+
   describe('handleLocalStats', () => {
     it('returns expected object without xpack and kibana data', () => {
-      const result = handleLocalStats(getMockServer(), clusterInfo, clusterStats);
+      const result = handleLocalStats(clusterInfo, clusterStats, void 0, context);
       expect(result.cluster_uuid).to.eql(combinedStatsResult.cluster_uuid);
       expect(result.cluster_name).to.eql(combinedStatsResult.cluster_name);
       expect(result.cluster_stats).to.eql(combinedStatsResult.cluster_stats);
@@ -141,7 +146,7 @@ describe('get_local_stats', () => {
     });
 
     it('returns expected object with xpack', () => {
-      const result = handleLocalStats(getMockServer(), clusterInfo, clusterStats);
+      const result = handleLocalStats(clusterInfo, clusterStats, void 0, context);
       const { stack_stats: stack, ...cluster } = result;
       expect(cluster.collection).to.be(combinedStatsResult.collection);
       expect(cluster.cluster_uuid).to.be(combinedStatsResult.cluster_uuid);
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/constants.ts b/src/plugins/telemetry/server/telemetry_collection/constants.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/constants.ts
rename to src/plugins/telemetry/server/telemetry_collection/constants.ts
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_cluster_info.ts b/src/plugins/telemetry/server/telemetry_collection/get_cluster_info.ts
similarity index 92%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/get_cluster_info.ts
rename to src/plugins/telemetry/server/telemetry_collection/get_cluster_info.ts
index 67812457ed4ec..d5f0d2d8c9598 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_cluster_info.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_cluster_info.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { APICaller } from 'kibana/server';
 
 // This can be removed when the ES client improves the types
 export interface ESClusterInfo {
@@ -43,6 +43,6 @@ export interface ESClusterInfo {
  *
  * @param {function} callCluster The callWithInternalUser handler (exposed for testing)
  */
-export function getClusterInfo(callCluster: CallCluster) {
+export function getClusterInfo(callCluster: APICaller) {
   return callCluster<ESClusterInfo>('info');
 }
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_cluster_stats.ts b/src/plugins/telemetry/server/telemetry_collection/get_cluster_stats.ts
similarity index 86%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/get_cluster_stats.ts
rename to src/plugins/telemetry/server/telemetry_collection/get_cluster_stats.ts
index 4abd95f0cf66d..89e2cae777985 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_cluster_stats.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_cluster_stats.ts
@@ -17,15 +17,15 @@
  * under the License.
  */
 
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { ClusterDetailsGetter } from 'src/plugins/telemetry_collection_manager/server';
+import { APICaller } from 'kibana/server';
 import { TIMEOUT } from './constants';
-import { ClusterDetailsGetter } from '../collection_manager';
 /**
  * Get the cluster stats from the connected cluster.
  *
  * This is the equivalent to GET /_cluster/stats?timeout=30s.
  */
-export async function getClusterStats(callCluster: CallCluster) {
+export async function getClusterStats(callCluster: APICaller) {
   return await callCluster('cluster.stats', {
     timeout: TIMEOUT,
   });
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_kibana.ts b/src/plugins/telemetry/server/telemetry_collection/get_kibana.ts
similarity index 79%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/get_kibana.ts
rename to src/plugins/telemetry/server/telemetry_collection/get_kibana.ts
index 537d5a85911cd..86c6731e11d37 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_kibana.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_kibana.ts
@@ -19,7 +19,8 @@
 
 import { omit } from 'lodash';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { APICaller } from 'kibana/server';
+import { StatsCollectionContext } from 'src/plugins/telemetry_collection_manager/server';
 
 export interface KibanaUsageStats {
   kibana: {
@@ -37,12 +38,12 @@ export interface KibanaUsageStats {
   [plugin: string]: any;
 }
 
-export function handleKibanaStats(server: any, response?: KibanaUsageStats) {
+export function handleKibanaStats(
+  { logger, version: serverVersion }: StatsCollectionContext,
+  response?: KibanaUsageStats
+) {
   if (!response) {
-    server.log(
-      ['warning', 'telemetry', 'local-stats'],
-      'No Kibana stats returned from usage collectors'
-    );
+    logger.warn('No Kibana stats returned from usage collectors');
     return;
   }
 
@@ -60,10 +61,7 @@ export function handleKibanaStats(server: any, response?: KibanaUsageStats) {
     };
   }, {});
 
-  const version = server
-    .config()
-    .get('pkg.version')
-    .replace(/-snapshot/i, '');
+  const version = serverVersion.replace(/-snapshot/i, ''); // Shouldn't we better maintain the -snapshot so we can differentiate between actual final releases and snapshots?
 
   // combine core stats (os types, saved objects) with plugin usage stats
   // organize the object into the same format as monitoring-enabled telemetry
@@ -79,7 +77,7 @@ export function handleKibanaStats(server: any, response?: KibanaUsageStats) {
 
 export async function getKibana(
   usageCollection: UsageCollectionSetup,
-  callWithInternalUser: CallCluster
+  callWithInternalUser: APICaller
 ): Promise<KibanaUsageStats> {
   const usage = await usageCollection.bulkFetch(callWithInternalUser);
   return usageCollection.toObject(usage);
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_license.ts b/src/plugins/telemetry/server/telemetry_collection/get_local_license.ts
similarity index 80%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_license.ts
rename to src/plugins/telemetry/server/telemetry_collection/get_local_license.ts
index 589392ffb6095..ad0666c7ad153 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_license.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_local_license.ts
@@ -17,26 +17,12 @@
  * under the License.
  */
 
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
-import { LicenseGetter } from '../collection_manager';
+import { APICaller } from 'kibana/server';
+import { ESLicense, LicenseGetter } from 'src/plugins/telemetry_collection_manager/server';
 
-// From https://www.elastic.co/guide/en/elasticsearch/reference/current/get-license.html
-export interface ESLicense {
-  status: string;
-  uid: string;
-  type: string;
-  issue_date: string;
-  issue_date_in_millis: number;
-  expiry_date: string;
-  expirty_date_in_millis: number;
-  max_nodes: number;
-  issued_to: string;
-  issuer: string;
-  start_date_in_millis: number;
-}
 let cachedLicense: ESLicense | undefined;
 
-function fetchLicense(callCluster: CallCluster, local: boolean) {
+function fetchLicense(callCluster: APICaller, local: boolean) {
   return callCluster<{ license: ESLicense }>('transport.request', {
     method: 'GET',
     path: '/_license',
@@ -55,7 +41,7 @@ function fetchLicense(callCluster: CallCluster, local: boolean) {
  *
  * Like any X-Pack related API, X-Pack must installed for this to work.
  */
-async function getLicenseFromLocalOrMaster(callCluster: CallCluster) {
+async function getLicenseFromLocalOrMaster(callCluster: APICaller) {
   // Fetching the local license is cheaper than getting it from the master and good enough
   const { license } = await fetchLicense(callCluster, true).catch(async err => {
     if (cachedLicense) {
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_stats.ts b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
similarity index 82%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_stats.ts
rename to src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
index d99710deb1cbc..19d5c2970361c 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_stats.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/get_local_stats.ts
@@ -17,10 +17,13 @@
  * under the License.
  */
 
+import {
+  StatsGetter,
+  StatsCollectionContext,
+} from 'src/plugins/telemetry_collection_manager/server';
 import { getClusterInfo, ESClusterInfo } from './get_cluster_info';
 import { getClusterStats } from './get_cluster_stats';
 import { getKibana, handleKibanaStats, KibanaUsageStats } from './get_kibana';
-import { StatsGetter } from '../collection_manager';
 
 /**
  * Handle the separate local calls by combining them into a single object response that looks like the
@@ -32,10 +35,10 @@ import { StatsGetter } from '../collection_manager';
  * @param {Object} kibana The Kibana Usage stats
  */
 export function handleLocalStats(
-  server: any,
   { cluster_name, cluster_uuid, version }: ESClusterInfo,
   { _nodes, cluster_name: clusterName, ...clusterStats }: any,
-  kibana: KibanaUsageStats
+  kibana: KibanaUsageStats,
+  context: StatsCollectionContext
 ) {
   return {
     timestamp: new Date().toISOString(),
@@ -45,7 +48,7 @@ export function handleLocalStats(
     cluster_stats: clusterStats,
     collection: 'local',
     stack_stats: {
-      kibana: handleKibanaStats(server, kibana),
+      kibana: handleKibanaStats(context, kibana),
     },
   };
 }
@@ -55,8 +58,12 @@ export type TelemetryLocalStats = ReturnType<typeof handleLocalStats>;
 /**
  * Get statistics for all products joined by Elasticsearch cluster.
  */
-export const getLocalStats: StatsGetter<TelemetryLocalStats> = async (clustersDetails, config) => {
-  const { server, callCluster, usageCollection } = config;
+export const getLocalStats: StatsGetter<{}, TelemetryLocalStats> = async (
+  clustersDetails,
+  config,
+  context
+) => {
+  const { callCluster, usageCollection } = config;
 
   return await Promise.all(
     clustersDetails.map(async clustersDetail => {
@@ -65,7 +72,7 @@ export const getLocalStats: StatsGetter<TelemetryLocalStats> = async (clustersDe
         getClusterStats(callCluster), // cluster stats (not to be confused with cluster _state_)
         getKibana(usageCollection, callCluster),
       ]);
-      return handleLocalStats(server, clusterInfo, clusterStats, kibana);
+      return handleLocalStats(clusterInfo, clusterStats, kibana, context);
     })
   );
 };
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/index.ts b/src/plugins/telemetry/server/telemetry_collection/index.ts
similarity index 87%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/index.ts
rename to src/plugins/telemetry/server/telemetry_collection/index.ts
index 9ac94216c21bc..377ddab7b877c 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/index.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/index.ts
@@ -17,6 +17,7 @@
  * under the License.
  */
 
-export { getLocalStats } from './get_local_stats';
+export { getLocalStats, TelemetryLocalStats } from './get_local_stats';
+export { getLocalLicense } from './get_local_license';
 export { getClusterUuids } from './get_cluster_stats';
 export { registerCollection } from './register_collection';
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_collection/register_collection.ts b/src/plugins/telemetry/server/telemetry_collection/register_collection.ts
similarity index 86%
rename from src/legacy/core_plugins/telemetry/server/telemetry_collection/register_collection.ts
rename to src/plugins/telemetry/server/telemetry_collection/register_collection.ts
index 6580b47dba08e..833fd9f7fd5bc 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_collection/register_collection.ts
+++ b/src/plugins/telemetry/server/telemetry_collection/register_collection.ts
@@ -36,14 +36,18 @@
  * under the License.
  */
 
-import { telemetryCollectionManager } from '../collection_manager';
+import { IClusterClient } from 'kibana/server';
+import { TelemetryCollectionManagerPluginSetup } from 'src/plugins/telemetry_collection_manager/server';
 import { getLocalStats } from './get_local_stats';
 import { getClusterUuids } from './get_cluster_stats';
 import { getLocalLicense } from './get_local_license';
 
-export function registerCollection() {
+export function registerCollection(
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup,
+  esCluster: IClusterClient
+) {
   telemetryCollectionManager.setCollection({
-    esCluster: 'data',
+    esCluster,
     title: 'local',
     priority: 0,
     statsGetter: getLocalStats,
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts b/src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts
similarity index 95%
rename from src/legacy/core_plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts
rename to src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts
index 7cc177878de4d..ebb583e88d4e1 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts
+++ b/src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.test.ts
@@ -18,7 +18,7 @@
  */
 
 import { getTelemetrySavedObject } from './get_telemetry_saved_object';
-import { SavedObjectsErrorHelpers } from '../../../../../core/server';
+import { SavedObjectsErrorHelpers } from '../../../../core/server';
 
 describe('getTelemetrySavedObject', () => {
   it('returns null when saved object not found', async () => {
@@ -79,7 +79,7 @@ function getCallGetTelemetrySavedObjectParams(
 
 async function callGetTelemetrySavedObject(params: CallGetTelemetrySavedObjectParams) {
   const savedObjectsClient = getMockSavedObjectsClient(params);
-  return await getTelemetrySavedObject(savedObjectsClient);
+  return await getTelemetrySavedObject(savedObjectsClient as any);
 }
 
 const SavedObjectForbiddenMessage = 'savedObjectForbidden';
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.ts b/src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.ts
similarity index 81%
rename from src/legacy/core_plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.ts
rename to src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.ts
index 91965ef201ecb..1b3ea093fb3d8 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.ts
+++ b/src/plugins/telemetry/server/telemetry_repository/get_telemetry_saved_object.ts
@@ -17,13 +17,16 @@
  * under the License.
  */
 
-import { TelemetrySavedObjectAttributes } from './';
-import { SavedObjectsErrorHelpers } from '../../../../../core/server';
+import { SavedObjectsErrorHelpers, SavedObjectsClientContract } from '../../../../core/server';
+import { TelemetrySavedObject } from './';
 
-export type TelemetrySavedObject = TelemetrySavedObjectAttributes | null | false;
-type GetTelemetrySavedObject = (repository: any) => Promise<TelemetrySavedObject>;
+type GetTelemetrySavedObject = (
+  repository: SavedObjectsClientContract
+) => Promise<TelemetrySavedObject>;
 
-export const getTelemetrySavedObject: GetTelemetrySavedObject = async (repository: any) => {
+export const getTelemetrySavedObject: GetTelemetrySavedObject = async (
+  repository: SavedObjectsClientContract
+) => {
   try {
     const { attributes } = await repository.get('telemetry', 'telemetry');
     return attributes;
diff --git a/src/plugins/telemetry/server/telemetry_repository/index.ts b/src/plugins/telemetry/server/telemetry_repository/index.ts
new file mode 100644
index 0000000000000..b98fa6971e481
--- /dev/null
+++ b/src/plugins/telemetry/server/telemetry_repository/index.ts
@@ -0,0 +1,25 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { getTelemetrySavedObject } from './get_telemetry_saved_object';
+export { updateTelemetrySavedObject } from './update_telemetry_saved_object';
+export {
+  TelemetrySavedObject,
+  TelemetrySavedObjectAttributes,
+} from '../../common/telemetry_config/types';
diff --git a/src/legacy/core_plugins/telemetry/server/telemetry_repository/update_telemetry_saved_object.ts b/src/plugins/telemetry/server/telemetry_repository/update_telemetry_saved_object.ts
similarity index 89%
rename from src/legacy/core_plugins/telemetry/server/telemetry_repository/update_telemetry_saved_object.ts
rename to src/plugins/telemetry/server/telemetry_repository/update_telemetry_saved_object.ts
index b66e01faaa6bc..64a2f675e4fd8 100644
--- a/src/legacy/core_plugins/telemetry/server/telemetry_repository/update_telemetry_saved_object.ts
+++ b/src/plugins/telemetry/server/telemetry_repository/update_telemetry_saved_object.ts
@@ -17,11 +17,11 @@
  * under the License.
  */
 
+import { SavedObjectsErrorHelpers, SavedObjectsClientContract } from '../../../../core/server';
 import { TelemetrySavedObjectAttributes } from './';
-import { SavedObjectsErrorHelpers } from '../../../../../core/server';
 
 export async function updateTelemetrySavedObject(
-  savedObjectsClient: any,
+  savedObjectsClient: SavedObjectsClientContract,
   savedObjectAttributes: TelemetrySavedObjectAttributes
 ) {
   try {
diff --git a/src/plugins/telemetry_collection_manager/README.md b/src/plugins/telemetry_collection_manager/README.md
new file mode 100644
index 0000000000000..3ded16e08a7aa
--- /dev/null
+++ b/src/plugins/telemetry_collection_manager/README.md
@@ -0,0 +1,7 @@
+# Telemetry Collection Manager
+
+Telemetry's collection manager to go through all the telemetry sources when fetching it before reporting.
+
+It has been split into a separate plugin because the `telemetry` plugin was pretty much being a passthrough in many cases to instantiate and maintain the logic of this bit.
+
+For separation of concerns, it's better to have this piece of logic independent to the rest.
diff --git a/src/legacy/server/i18n/constants.js b/src/plugins/telemetry_collection_manager/common/index.ts
similarity index 87%
rename from src/legacy/server/i18n/constants.js
rename to src/plugins/telemetry_collection_manager/common/index.ts
index a7a410dbcb5b3..5ad29c06bb682 100644
--- a/src/legacy/server/i18n/constants.js
+++ b/src/plugins/telemetry_collection_manager/common/index.ts
@@ -17,4 +17,5 @@
  * under the License.
  */
 
-export const I18N_RC = '.i18nrc.json';
+export const PLUGIN_ID = 'telemetryCollectionManager';
+export const PLUGIN_NAME = 'telemetry_collection_manager';
diff --git a/src/plugins/telemetry_collection_manager/kibana.json b/src/plugins/telemetry_collection_manager/kibana.json
new file mode 100644
index 0000000000000..f4278265834a4
--- /dev/null
+++ b/src/plugins/telemetry_collection_manager/kibana.json
@@ -0,0 +1,10 @@
+{
+  "id": "telemetryCollectionManager",
+  "version": "kibana",
+  "server": true,
+  "ui": false,
+  "requiredPlugins": [
+    "usageCollection"
+  ],
+  "optionalPlugins": []
+}
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/encryption/encrypt.test.ts b/src/plugins/telemetry_collection_manager/server/encryption/encrypt.test.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/encryption/encrypt.test.ts
rename to src/plugins/telemetry_collection_manager/server/encryption/encrypt.test.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/encryption/encrypt.ts b/src/plugins/telemetry_collection_manager/server/encryption/encrypt.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/encryption/encrypt.ts
rename to src/plugins/telemetry_collection_manager/server/encryption/encrypt.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/encryption/index.ts b/src/plugins/telemetry_collection_manager/server/encryption/index.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/encryption/index.ts
rename to src/plugins/telemetry_collection_manager/server/encryption/index.ts
diff --git a/src/legacy/core_plugins/telemetry/server/collectors/encryption/telemetry_jwks.ts b/src/plugins/telemetry_collection_manager/server/encryption/telemetry_jwks.ts
similarity index 100%
rename from src/legacy/core_plugins/telemetry/server/collectors/encryption/telemetry_jwks.ts
rename to src/plugins/telemetry_collection_manager/server/encryption/telemetry_jwks.ts
diff --git a/src/plugins/telemetry_collection_manager/server/index.ts b/src/plugins/telemetry_collection_manager/server/index.ts
new file mode 100644
index 0000000000000..8761c28e14095
--- /dev/null
+++ b/src/plugins/telemetry_collection_manager/server/index.ts
@@ -0,0 +1,41 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { PluginInitializerContext } from 'kibana/server';
+import { TelemetryCollectionManagerPlugin } from './plugin';
+
+//  This exports static code and TypeScript types,
+//  as well as, Kibana Platform `plugin()` initializer.
+
+export function plugin(initializerContext: PluginInitializerContext) {
+  return new TelemetryCollectionManagerPlugin(initializerContext);
+}
+
+export {
+  TelemetryCollectionManagerPluginSetup,
+  TelemetryCollectionManagerPluginStart,
+  ESLicense,
+  StatsCollectionConfig,
+  StatsGetter,
+  StatsGetterConfig,
+  StatsCollectionContext,
+  ClusterDetails,
+  ClusterDetailsGetter,
+  LicenseGetter,
+} from './types';
diff --git a/src/plugins/telemetry_collection_manager/server/plugin.ts b/src/plugins/telemetry_collection_manager/server/plugin.ts
new file mode 100644
index 0000000000000..7e8dff9e0aec1
--- /dev/null
+++ b/src/plugins/telemetry_collection_manager/server/plugin.ts
@@ -0,0 +1,253 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import {
+  PluginInitializerContext,
+  CoreSetup,
+  CoreStart,
+  Plugin,
+  Logger,
+} from '../../../core/server';
+
+import {
+  TelemetryCollectionManagerPluginSetup,
+  TelemetryCollectionManagerPluginStart,
+  BasicStatsPayload,
+  CollectionConfig,
+  Collection,
+  StatsGetterConfig,
+  StatsCollectionConfig,
+  UsageStatsPayload,
+  StatsCollectionContext,
+} from './types';
+
+import { encryptTelemetry } from './encryption';
+
+interface TelemetryCollectionPluginsDepsSetup {
+  usageCollection: UsageCollectionSetup;
+}
+
+export class TelemetryCollectionManagerPlugin
+  implements Plugin<TelemetryCollectionManagerPluginSetup, TelemetryCollectionManagerPluginStart> {
+  private readonly logger: Logger;
+  private readonly collections: Array<Collection<any>> = [];
+  private usageGetterMethodPriority = -1;
+  private usageCollection?: UsageCollectionSetup;
+  private readonly isDev: boolean;
+  private readonly version: string;
+
+  constructor(initializerContext: PluginInitializerContext) {
+    this.logger = initializerContext.logger.get();
+    this.isDev = initializerContext.env.mode.dev;
+    this.version = initializerContext.env.packageInfo.version;
+  }
+
+  public setup(core: CoreSetup, { usageCollection }: TelemetryCollectionPluginsDepsSetup) {
+    this.usageCollection = usageCollection;
+
+    return {
+      setCollection: this.setCollection.bind(this),
+      getOptInStats: this.getOptInStats.bind(this),
+      getStats: this.getStats.bind(this),
+    };
+  }
+
+  public start(core: CoreStart) {
+    return {
+      setCollection: this.setCollection.bind(this),
+      getOptInStats: this.getOptInStats.bind(this),
+      getStats: this.getStats.bind(this),
+    };
+  }
+
+  public stop() {}
+
+  private setCollection<CustomContext extends Record<string, any>, T extends BasicStatsPayload>(
+    collectionConfig: CollectionConfig<CustomContext, T>
+  ) {
+    const {
+      title,
+      priority,
+      esCluster,
+      statsGetter,
+      clusterDetailsGetter,
+      licenseGetter,
+    } = collectionConfig;
+
+    if (typeof priority !== 'number') {
+      throw new Error('priority must be set.');
+    }
+    if (priority === this.usageGetterMethodPriority) {
+      throw new Error(`A Usage Getter with the same priority is already set.`);
+    }
+
+    if (priority > this.usageGetterMethodPriority) {
+      if (!statsGetter) {
+        throw Error('Stats getter method not set.');
+      }
+      if (!esCluster) {
+        throw Error('esCluster name must be set for the getCluster method.');
+      }
+      if (!clusterDetailsGetter) {
+        throw Error('Cluster UUIds method is not set.');
+      }
+      if (!licenseGetter) {
+        throw Error('License getter method not set.');
+      }
+
+      this.collections.unshift({
+        licenseGetter,
+        statsGetter,
+        clusterDetailsGetter,
+        esCluster,
+        title,
+      });
+      this.usageGetterMethodPriority = priority;
+    }
+  }
+
+  private getStatsCollectionConfig(
+    config: StatsGetterConfig,
+    collection: Collection,
+    usageCollection: UsageCollectionSetup
+  ): StatsCollectionConfig {
+    const { start, end, request } = config;
+
+    const callCluster = config.unencrypted
+      ? collection.esCluster.asScoped(request).callAsCurrentUser
+      : collection.esCluster.callAsInternalUser;
+
+    return { callCluster, start, end, usageCollection };
+  }
+
+  private async getOptInStats(optInStatus: boolean, config: StatsGetterConfig) {
+    if (!this.usageCollection) {
+      return [];
+    }
+    for (const collection of this.collections) {
+      const statsCollectionConfig = this.getStatsCollectionConfig(
+        config,
+        collection,
+        this.usageCollection
+      );
+      try {
+        const optInStats = await this.getOptInStatsForCollection(
+          collection,
+          optInStatus,
+          statsCollectionConfig
+        );
+        if (optInStats && optInStats.length) {
+          this.logger.debug(`Got Opt In stats using ${collection.title} collection.`);
+          if (config.unencrypted) {
+            return optInStats;
+          }
+          return encryptTelemetry(optInStats, this.isDev);
+        }
+      } catch (err) {
+        this.logger.debug(`Failed to collect any opt in stats with registered collections.`);
+        // swallow error to try next collection;
+      }
+    }
+
+    return [];
+  }
+
+  private getOptInStatsForCollection = async (
+    collection: Collection,
+    optInStatus: boolean,
+    statsCollectionConfig: StatsCollectionConfig
+  ) => {
+    const context: StatsCollectionContext = {
+      logger: this.logger.get(collection.title),
+      isDev: this.isDev,
+      version: this.version,
+      ...collection.customContext,
+    };
+
+    const clustersDetails = await collection.clusterDetailsGetter(statsCollectionConfig, context);
+    return clustersDetails.map(({ clusterUuid }) => ({
+      cluster_uuid: clusterUuid,
+      opt_in_status: optInStatus,
+    }));
+  };
+
+  private async getStats(config: StatsGetterConfig) {
+    if (!this.usageCollection) {
+      return [];
+    }
+    for (const collection of this.collections) {
+      const statsCollectionConfig = this.getStatsCollectionConfig(
+        config,
+        collection,
+        this.usageCollection
+      );
+      try {
+        const usageData = await this.getUsageForCollection(collection, statsCollectionConfig);
+        if (usageData.length) {
+          this.logger.debug(`Got Usage using ${collection.title} collection.`);
+          if (config.unencrypted) {
+            return usageData;
+          }
+          return encryptTelemetry(usageData, this.isDev);
+        }
+      } catch (err) {
+        this.logger.debug(
+          `Failed to collect any usage with registered collection ${collection.title}.`
+        );
+        // swallow error to try next collection;
+      }
+    }
+
+    return [];
+  }
+
+  private async getUsageForCollection(
+    collection: Collection,
+    statsCollectionConfig: StatsCollectionConfig
+  ): Promise<UsageStatsPayload[]> {
+    const context: StatsCollectionContext = {
+      logger: this.logger.get(collection.title),
+      isDev: this.isDev,
+      version: this.version,
+      ...collection.customContext,
+    };
+
+    const clustersDetails = await collection.clusterDetailsGetter(statsCollectionConfig, context);
+
+    if (clustersDetails.length === 0) {
+      // don't bother doing a further lookup, try next collection.
+      return [];
+    }
+
+    const [stats, licenses] = await Promise.all([
+      collection.statsGetter(clustersDetails, statsCollectionConfig, context),
+      collection.licenseGetter(clustersDetails, statsCollectionConfig, context),
+    ]);
+
+    return stats.map(stat => {
+      const license = licenses[stat.cluster_uuid];
+      return {
+        ...(license ? { license } : {}),
+        ...stat,
+        collectionSource: collection.title,
+      };
+    });
+  }
+}
diff --git a/src/plugins/telemetry_collection_manager/server/types.ts b/src/plugins/telemetry_collection_manager/server/types.ts
new file mode 100644
index 0000000000000..e23d6a4c388f4
--- /dev/null
+++ b/src/plugins/telemetry_collection_manager/server/types.ts
@@ -0,0 +1,150 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { APICaller, Logger, KibanaRequest, IClusterClient } from 'kibana/server';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import { TelemetryCollectionManagerPlugin } from './plugin';
+
+export interface TelemetryCollectionManagerPluginSetup {
+  setCollection: <CustomContext extends Record<string, any>, T extends BasicStatsPayload>(
+    collectionConfig: CollectionConfig<CustomContext, T>
+  ) => void;
+  getOptInStats: TelemetryCollectionManagerPlugin['getOptInStats'];
+  getStats: TelemetryCollectionManagerPlugin['getStats'];
+}
+
+export interface TelemetryCollectionManagerPluginStart {
+  setCollection: <CustomContext extends Record<string, any>, T extends BasicStatsPayload>(
+    collectionConfig: CollectionConfig<CustomContext, T>
+  ) => void;
+  getOptInStats: TelemetryCollectionManagerPlugin['getOptInStats'];
+  getStats: TelemetryCollectionManagerPlugin['getStats'];
+}
+
+export interface TelemetryOptInStats {
+  cluster_uuid: string;
+  opt_in_status: boolean;
+}
+
+export interface BaseStatsGetterConfig {
+  unencrypted: boolean;
+  start: string;
+  end: string;
+  request?: KibanaRequest;
+}
+
+export interface EncryptedStatsGetterConfig extends BaseStatsGetterConfig {
+  unencrypted: false;
+}
+
+export interface UnencryptedStatsGetterConfig extends BaseStatsGetterConfig {
+  unencrypted: true;
+  request: KibanaRequest;
+}
+
+export interface ClusterDetails {
+  clusterUuid: string;
+}
+
+export interface StatsCollectionConfig {
+  usageCollection: UsageCollectionSetup;
+  callCluster: APICaller;
+  start: string | number;
+  end: string | number;
+}
+
+export interface BasicStatsPayload {
+  timestamp: string;
+  cluster_uuid: string;
+  cluster_name: string;
+  version: string;
+  cluster_stats: object;
+  collection?: string;
+  stack_stats: object;
+}
+
+export interface UsageStatsPayload extends BasicStatsPayload {
+  license?: ESLicense;
+  collectionSource: string;
+}
+
+// From https://www.elastic.co/guide/en/elasticsearch/reference/current/get-license.html
+export interface ESLicense {
+  status: string;
+  uid: string;
+  type: string;
+  issue_date: string;
+  issue_date_in_millis: number;
+  expiry_date: string;
+  expirty_date_in_millis: number;
+  max_nodes: number;
+  issued_to: string;
+  issuer: string;
+  start_date_in_millis: number;
+}
+
+export interface StatsCollectionContext {
+  logger: Logger;
+  isDev: boolean;
+  version: string;
+}
+
+export type StatsGetterConfig = UnencryptedStatsGetterConfig | EncryptedStatsGetterConfig;
+export type ClusterDetailsGetter<CustomContext extends Record<string, any> = {}> = (
+  config: StatsCollectionConfig,
+  context: StatsCollectionContext & CustomContext
+) => Promise<ClusterDetails[]>;
+export type StatsGetter<
+  CustomContext extends Record<string, any> = {},
+  T extends BasicStatsPayload = BasicStatsPayload
+> = (
+  clustersDetails: ClusterDetails[],
+  config: StatsCollectionConfig,
+  context: StatsCollectionContext & CustomContext
+) => Promise<T[]>;
+export type LicenseGetter<CustomContext extends Record<string, any> = {}> = (
+  clustersDetails: ClusterDetails[],
+  config: StatsCollectionConfig,
+  context: StatsCollectionContext & CustomContext
+) => Promise<{ [clusterUuid: string]: ESLicense | undefined }>;
+
+export interface CollectionConfig<
+  CustomContext extends Record<string, any> = {},
+  T extends BasicStatsPayload = BasicStatsPayload
+> {
+  title: string;
+  priority: number;
+  esCluster: IClusterClient;
+  statsGetter: StatsGetter<CustomContext, T>;
+  clusterDetailsGetter: ClusterDetailsGetter<CustomContext>;
+  licenseGetter: LicenseGetter<CustomContext>;
+  customContext?: CustomContext;
+}
+
+export interface Collection<
+  CustomContext extends Record<string, any> = {},
+  T extends BasicStatsPayload = BasicStatsPayload
+> {
+  customContext?: CustomContext;
+  statsGetter: StatsGetter<CustomContext, T>;
+  licenseGetter: LicenseGetter<CustomContext>;
+  clusterDetailsGetter: ClusterDetailsGetter<CustomContext>;
+  esCluster: IClusterClient;
+  title: string;
+}
diff --git a/src/plugins/telemetry_management_section/README.md b/src/plugins/telemetry_management_section/README.md
new file mode 100644
index 0000000000000..0f795786720c9
--- /dev/null
+++ b/src/plugins/telemetry_management_section/README.md
@@ -0,0 +1,5 @@
+# Telemetry Management Section
+
+This plugin adds the Advanced Settings section for the Usage Data collection (aka Telemetry).
+
+The reason for having it separated from the `telemetry` plugin is to avoid circular dependencies. The plugin `advancedSettings` depends on the `home` app that depends on the `telemetry` plugin because of the telemetry banner in the welcome screen.
diff --git a/src/plugins/telemetry_management_section/kibana.json b/src/plugins/telemetry_management_section/kibana.json
new file mode 100644
index 0000000000000..3364833def4d6
--- /dev/null
+++ b/src/plugins/telemetry_management_section/kibana.json
@@ -0,0 +1,10 @@
+{
+  "id": "telemetryManagementSection",
+  "version": "kibana",
+  "server": false,
+  "ui": true,
+  "requiredPlugins": [
+    "advancedSettings",
+    "telemetry"
+  ]
+}
diff --git a/src/plugins/telemetry/public/components/__snapshots__/opt_in_example_flyout.test.tsx.snap b/src/plugins/telemetry_management_section/public/components/__snapshots__/opt_in_example_flyout.test.tsx.snap
similarity index 100%
rename from src/plugins/telemetry/public/components/__snapshots__/opt_in_example_flyout.test.tsx.snap
rename to src/plugins/telemetry_management_section/public/components/__snapshots__/opt_in_example_flyout.test.tsx.snap
diff --git a/src/plugins/telemetry_management_section/public/components/index.ts b/src/plugins/telemetry_management_section/public/components/index.ts
new file mode 100644
index 0000000000000..86954744e7a01
--- /dev/null
+++ b/src/plugins/telemetry_management_section/public/components/index.ts
@@ -0,0 +1,22 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { OptInExampleFlyout } from './opt_in_example_flyout';
+export { telemetryManagementSectionWrapper } from './telemetry_management_section_wrapper';
+export { TelemetryManagementSection } from './telemetry_management_section';
diff --git a/src/plugins/telemetry/public/components/opt_in_example_flyout.test.tsx b/src/plugins/telemetry_management_section/public/components/opt_in_example_flyout.test.tsx
similarity index 100%
rename from src/plugins/telemetry/public/components/opt_in_example_flyout.test.tsx
rename to src/plugins/telemetry_management_section/public/components/opt_in_example_flyout.test.tsx
diff --git a/src/plugins/telemetry/public/components/opt_in_example_flyout.tsx b/src/plugins/telemetry_management_section/public/components/opt_in_example_flyout.tsx
similarity index 100%
rename from src/plugins/telemetry/public/components/opt_in_example_flyout.tsx
rename to src/plugins/telemetry_management_section/public/components/opt_in_example_flyout.tsx
diff --git a/src/plugins/telemetry/public/components/telemetry_management_section.tsx b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx
similarity index 96%
rename from src/plugins/telemetry/public/components/telemetry_management_section.tsx
rename to src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx
index bf14c33a48048..26e075b666593 100644
--- a/src/plugins/telemetry/public/components/telemetry_management_section.tsx
+++ b/src/plugins/telemetry_management_section/public/components/telemetry_management_section.tsx
@@ -31,11 +31,14 @@ import {
 
 import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
-import { PRIVACY_STATEMENT_URL } from '../../common/constants';
+import { TelemetryPluginSetup } from 'src/plugins/telemetry/public';
+import { PRIVACY_STATEMENT_URL } from '../../../telemetry/common/constants';
 import { OptInExampleFlyout } from './opt_in_example_flyout';
 import { Field } from '../../../advanced_settings/public';
-import { ToastsStart } from '../../../../core/public/';
-import { TelemetryService } from '../services/telemetry_service';
+import { ToastsStart } from '../../../../core/public';
+
+type TelemetryService = TelemetryPluginSetup['telemetryService'];
+
 const SEARCH_TERMS = ['telemetry', 'usage', 'data', 'usage data'];
 
 interface Props {
diff --git a/src/plugins/telemetry_management_section/public/components/telemetry_management_section_wrapper.tsx b/src/plugins/telemetry_management_section/public/components/telemetry_management_section_wrapper.tsx
new file mode 100644
index 0000000000000..b8b20b68f666e
--- /dev/null
+++ b/src/plugins/telemetry_management_section/public/components/telemetry_management_section_wrapper.tsx
@@ -0,0 +1,40 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import React from 'react';
+import { TelemetryPluginSetup } from 'src/plugins/telemetry/public';
+import { TelemetryManagementSection } from './telemetry_management_section';
+
+// It should be this but the types are way too vague in the AdvancedSettings plugin `Record<string, any>`
+// type Props = Omit<TelemetryManagementSection['props'], 'telemetryService'>;
+type Props = any;
+
+export function telemetryManagementSectionWrapper(
+  telemetryService: TelemetryPluginSetup['telemetryService']
+) {
+  const TelemetryManagementSectionWrapper = (props: Props) => (
+    <TelemetryManagementSection
+      showAppliesSettingMessage={true}
+      telemetryService={telemetryService}
+      {...props}
+    />
+  );
+
+  return TelemetryManagementSectionWrapper;
+}
diff --git a/src/legacy/core_plugins/data/public/index.ts b/src/plugins/telemetry_management_section/public/index.ts
similarity index 87%
rename from src/legacy/core_plugins/data/public/index.ts
rename to src/plugins/telemetry_management_section/public/index.ts
index 27a3dd825485d..6a80cdd98b1a3 100644
--- a/src/legacy/core_plugins/data/public/index.ts
+++ b/src/plugins/telemetry_management_section/public/index.ts
@@ -17,10 +17,8 @@
  * under the License.
  */
 
-import { DataPlugin as Plugin } from './plugin';
+import { TelemetryManagementSectionPlugin } from './plugin';
 
 export function plugin() {
-  return new Plugin();
+  return new TelemetryManagementSectionPlugin();
 }
-
-export { DataSetup, DataStart } from './plugin';
diff --git a/src/plugins/telemetry_management_section/public/plugin.ts b/src/plugins/telemetry_management_section/public/plugin.ts
new file mode 100644
index 0000000000000..738b38c36d30d
--- /dev/null
+++ b/src/plugins/telemetry_management_section/public/plugin.ts
@@ -0,0 +1,54 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { AdvancedSettingsSetup } from 'src/plugins/advanced_settings/public';
+import { TelemetryPluginSetup } from 'src/plugins/telemetry/public';
+import { Plugin, CoreStart, CoreSetup } from '../../../core/public';
+
+import { telemetryManagementSectionWrapper } from './components/telemetry_management_section_wrapper';
+
+export interface TelemetryPluginConfig {
+  enabled: boolean;
+  url: string;
+  banner: boolean;
+  allowChangingOptInStatus: boolean;
+  optIn: boolean | null;
+  optInStatusUrl: string;
+  sendUsageFrom: 'browser' | 'server';
+  telemetryNotifyUserAboutOptInDefault?: boolean;
+}
+
+export interface TelemetryManagementSectionPluginDepsSetup {
+  telemetry: TelemetryPluginSetup;
+  advancedSettings: AdvancedSettingsSetup;
+}
+
+export class TelemetryManagementSectionPlugin implements Plugin {
+  public setup(
+    core: CoreSetup,
+    { advancedSettings, telemetry: { telemetryService } }: TelemetryManagementSectionPluginDepsSetup
+  ) {
+    advancedSettings.component.register(
+      advancedSettings.component.componentType.PAGE_FOOTER_COMPONENT,
+      telemetryManagementSectionWrapper(telemetryService),
+      true
+    );
+  }
+
+  public start(core: CoreStart) {}
+}
diff --git a/src/plugins/usage_collection/README.md b/src/plugins/usage_collection/README.md
index 4b81fe9b22083..1c97c9c63c0e2 100644
--- a/src/plugins/usage_collection/README.md
+++ b/src/plugins/usage_collection/README.md
@@ -10,37 +10,100 @@ To integrate with the telemetry services for usage collection of your feature, t
 
 All you need to provide is a `type` for organizing your fields, and a `fetch` method for returning your usage data. Then you need to make the Telemetry service aware of the collector by registering it.
 
-### New Platform:
+### New Platform
 
 1. Make sure `usageCollection` is in your optional Plugins:
 
-```json
-// plugin/kibana.json
-{
-  "id": "...",
-  "optionalPlugins": ["usageCollection"]
-}
-```
+    ```json
+    // plugin/kibana.json
+    {
+      "id": "...",
+      "optionalPlugins": ["usageCollection"]
+    }
+    ```
 
 2. Register Usage collector in the `setup` function:
 
+    ```ts
+    // server/plugin.ts
+    import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+    import { CoreSetup, CoreStart } from 'kibana/server';
+
+    class Plugin {
+      public setup(core: CoreSetup, plugins: { usageCollection?: UsageCollectionSetup }) {
+        registerMyPluginUsageCollector(plugins.usageCollection);
+      }
+
+      public start(core: CoreStart) {}
+    }
+    ```
+
+3. Creating and registering a Usage Collector. Ideally collectors would be defined in a separate directory `server/collectors/register.ts`.
+
+    ```ts
+    // server/collectors/register.ts
+    import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+    import { APICluster } from 'kibana/server';
+
+    export function registerMyPluginUsageCollector(usageCollection?: UsageCollectionSetup): void {
+      // usageCollection is an optional dependency, so make sure to return if it is not registered.
+      if (!usageCollection) {
+        return;
+      }
+
+      // create usage collector
+      const myCollector = usageCollection.makeUsageCollector({
+        type: MY_USAGE_TYPE,
+        fetch: async (callCluster: APICluster) => {
+
+        // query ES and get some data
+        // summarize the data into a model
+        // return the modeled object that includes whatever you want to track
+
+          return {
+            my_objects: {
+              total: SOME_NUMBER
+            }
+          };
+        },
+      });
+
+      // register usage collector
+      usageCollection.registerCollector(myCollector);
+    }
+    ```
+
+Some background: The `callCluster` that gets passed to the `fetch` method is created in a way that's a bit tricky, to support multiple contexts the `fetch` method could be called. Your `fetch` method could get called as a result of an HTTP API request: in this case, the `callCluster` function wraps `callWithRequest`, and the request headers are expected to have read privilege on the entire `.kibana` index. The use case for this is stats pulled from a Kibana Metricbeat module, where the Beat calls Kibana's stats API in Kibana to invoke collection.
+
+Note: there will be many cases where you won't need to use the `callCluster` function that gets passed in to your `fetch` method at all. Your feature might have an accumulating value in server memory, or read something from the OS, or use other clients like a custom SavedObjects client. In that case it's up to the plugin to initialize those clients like the example below:
+
 ```ts
 // server/plugin.ts
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import { CoreSetup, CoreStart } from 'kibana/server';
+
 class Plugin {
-  setup(core, plugins) {
-    registerMyPluginUsageCollector(plugins.usageCollection);
+  private savedObjectsClient?: ISavedObjectsRepository;
+
+  public setup(core: CoreSetup, plugins: { usageCollection?: UsageCollectionSetup }) {
+    registerMyPluginUsageCollector(() => this.savedObjectsClient, plugins.usageCollection);
+  }
+
+  public start(core: CoreStart) {
+    this.savedObjectsClient = core.savedObjects.client
   }
 }
 ```
 
-3. Creating and registering a Usage Collector. Ideally collectors would be defined in a separate directory `server/collectors/register.ts`.
-
 ```ts
 // server/collectors/register.ts
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { ISavedObjectsRepository } from 'kibana/server';
 
-export function registerMyPluginUsageCollector(usageCollection?: UsageCollectionSetup): void {
+export function registerMyPluginUsageCollector(
+  getSavedObjectsClient: () => ISavedObjectsRepository | undefined,
+  usageCollection?: UsageCollectionSetup
+  ): void {
   // usageCollection is an optional dependency, so make sure to return if it is not registered.
   if (!usageCollection) {
     return;
@@ -49,17 +112,12 @@ export function registerMyPluginUsageCollector(usageCollection?: UsageCollection
   // create usage collector
   const myCollector = usageCollection.makeUsageCollector({
     type: MY_USAGE_TYPE,
-    fetch: async (callCluster: CallCluster) => {
+    isReady: () => typeof getSavedObjectsClient() !== 'undefined',
+    fetch: async () => {
+      const savedObjectsClient = getSavedObjectsClient()!;
+      // get something from the savedObjects
 
-    // query ES and get some data
-    // summarize the data into a model
-    // return the modeled object that includes whatever you want to track
-
-      return {
-        my_objects: {
-          total: SOME_NUMBER
-        }
-      };
+      return { my_objects };
     },
   });
 
@@ -68,11 +126,7 @@ export function registerMyPluginUsageCollector(usageCollection?: UsageCollection
 }
 ```
 
-Some background: The `callCluster` that gets passed to the `fetch` method is created in a way that's a bit tricky, to support multiple contexts the `fetch` method could be called. Your `fetch` method could get called as a result of an HTTP API request: in this case, the `callCluster` function wraps `callWithRequest`, and the request headers are expected to have read privilege on the entire `.kibana` index. The use case for this is stats pulled from a Kibana Metricbeat module, where the Beat calls Kibana's stats API in Kibana to invoke collection.
-
-Note: there will be many cases where you won't need to use the `callCluster` function that gets passed in to your `fetch` method at all. Your feature might have an accumulating value in server memory, or read something from the OS.
-
-### Migrating to NP from Legacy Plugins:
+### Migrating to NP from Legacy Plugins
 
 Pass `usageCollection` to the setup NP plugin setup function under plugins. Inside the `setup` function call the `registerCollector` like what you'd do in the NP example above.
 
@@ -91,7 +145,7 @@ export const myPlugin = (kibana: any) => {
 }
 ```
 
-### Legacy Plugins:
+### Legacy Plugins
 
 Typically, a plugin will create the collector object and register it with the Telemetry service from the `init` method of the plugin definition, or a helper module called from `init`.
 
@@ -109,7 +163,7 @@ export const myPlugin = (kibana: any) => {
 
 ## Update the telemetry payload and telemetry cluster field mappings
 
-There is a module in the telemetry service that creates the payload of data that gets sent up to the telemetry cluster. 
+There is a module in the telemetry service that creates the payload of data that gets sent up to the telemetry cluster.
 
 New fields added to the telemetry payload currently mean that telemetry cluster field mappings have to be updated, so they can be searched and aggregated in Kibana visualizations. This is also a short-term obligation. In the next refactoring phase, collectors will need to use a proscribed data model that eliminates maintenance of mappings in the telemetry cluster.
 
@@ -122,12 +176,14 @@ There are a few ways you can test that your usage collector is working properly.
     - The `.monitoring-*` indices, when Monitoring is enabled. Monitoring enhances the sent payload of telemetry by producing usage data potentially of multiple clusters that exist in the monitoring data. Monitoring data is time-based, and the time frame of collection is the last 15 minutes.
     - Live-pulled from ES API endpoints. This will get just real-time stats without context of historical data.
     - The dev script in x-pack can be run on the command-line with:
-      ```
+
+      ```shell
       cd x-pack
       node scripts/api_debug.js telemetry --host=http://localhost:5601
       ```
+
       Where `http://localhost:5601` is a Kibana server running in dev mode. If needed, authentication and basePath info can be provided in the command as well.
-    - Automatic inclusion of all the stats fetched by collectors is added in https://github.com/elastic/kibana/pull/22336 / 6.5.0
+    - Automatic inclusion of all the stats fetched by collectors is added in [#22336](https://github.com/elastic/kibana/pull/22336) / 6.5.0
 3. In Dev mode, Kibana will send telemetry data to a staging telemetry cluster. Assuming you have access to the staging cluster, you can log in and check the latest documents for your new fields.
 4. If you catch the network traffic coming from your browser when a telemetry payload is sent, you can examine the request payload body to see the data. This can be tricky as telemetry payloads are sent only once per day per browser. Use incognito mode or clear your localStorage data to force a telemetry payload.
 
@@ -157,7 +213,33 @@ the name of a dashboard they've viewed, or the timestamp of the interaction.
 
 ## How to use it
 
-To track a user interaction, import the `createUiStatsReporter` helper function from UI Metric app:
+To track a user interaction, use the `reportUiStats` method exposed by the plugin `usageCollection` in the public side:
+
+1. Similarly to the server-side usage collection, make sure `usageCollection` is in your optional Plugins:
+
+    ```json
+    // plugin/kibana.json
+    {
+      "id": "...",
+      "optionalPlugins": ["usageCollection"]
+    }
+    ```
+
+2. Register Usage collector in the `setup` function:
+
+    ```ts
+    // public/plugin.ts
+    class Plugin {
+      setup(core, { usageCollection }) {
+        if (usageCollection) {
+          // Call the following method as many times as you want to report an increase in the count for this event
+          usageCollection.reportUiStats(`<AppName>`, usageCollection.METRIC_TYPE.CLICK, `<EventName>`);
+        }
+      }
+    }
+    ```
+
+Alternatively, in the Legacy world you can still import the `createUiStatsReporter` helper function from UI Metric app:
 
 ```js
 import { createUiStatsReporter, METRIC_TYPE } from 'relative/path/to/src/legacy/core_plugins/ui_metric/public';
@@ -167,9 +249,10 @@ trackMetric('click', `<EventName>`);
 ```
 
 Metric Types:
-  - `METRIC_TYPE.CLICK` for tracking clicks `trackMetric(METRIC_TYPE.CLICK, 'my_button_clicked');`
-  - `METRIC_TYPE.LOADED` for a component load or page load `trackMetric(METRIC_TYPE.LOADED', 'my_component_loaded');`
-  - `METRIC_TYPE.COUNT` for a tracking a misc count `trackMetric(METRIC_TYPE.COUNT', 'my_counter', <count> });`
+
+- `METRIC_TYPE.CLICK` for tracking clicks `trackMetric(METRIC_TYPE.CLICK, 'my_button_clicked');`
+- `METRIC_TYPE.LOADED` for a component load or page load `trackMetric(METRIC_TYPE.LOADED', 'my_component_loaded');`
+- `METRIC_TYPE.COUNT` for a tracking a misc count `trackMetric(METRIC_TYPE.COUNT', 'my_counter', <count> });`
 
 Call this function whenever you would like to track a user interaction within your app. The function
 accepts two arguments, `metricType` and `eventNames`. These should be underscore-delimited strings.
@@ -196,7 +279,7 @@ use a `eventName` of  `create_vis_1m`, `create_vis_5m`, `create_vis_20m`, or `cr
 ## How it works
 
 Under the hood, your app and metric type will be stored in a saved object of type `user-metric` and the
-ID `ui-metric:my_app:my_metric`. This saved object will have a `count` property which will be incremented 
+ID `ui-metric:my_app:my_metric`. This saved object will have a `count` property which will be incremented
 every time the above URI is hit.
 
 These saved objects are automatically consumed by the stats API and surfaced under the
@@ -216,4 +299,6 @@ These saved objects are automatically consumed by the stats API and surfaced und
 ```
 
 By storing these metrics and their counts as key-value pairs, we can add more metrics without having
-to worry about exceeding the 1000-field soft limit in Elasticsearch.
\ No newline at end of file
+to worry about exceeding the 1000-field soft limit in Elasticsearch.
+
+The only caveat is that it makes it harder to consume in Kibana when analysing each entry in the array separately. In the telemetry team we are working to find a solution to this. We are building a new way of reporting telemetry called [Pulse](../../../rfcs/text/0008_pulse.md) that will help on making these UI-Metrics easier to consume.
diff --git a/src/plugins/usage_collection/server/collector/collector.ts b/src/plugins/usage_collection/server/collector/collector.ts
index 91951aa2f3edf..b4f86f67e798d 100644
--- a/src/plugins/usage_collection/server/collector/collector.ts
+++ b/src/plugins/usage_collection/server/collector/collector.ts
@@ -17,15 +17,14 @@
  * under the License.
  */
 
-import { Logger } from 'kibana/server';
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { Logger, APICaller } from 'kibana/server';
 
 export type CollectorFormatForBulkUpload<T, U> = (result: T) => { type: string; payload: U };
 
 export interface CollectorOptions<T = unknown, U = T> {
   type: string;
   init?: Function;
-  fetch: (callCluster: CallCluster) => Promise<T> | T;
+  fetch: (callCluster: APICaller) => Promise<T> | T;
   /*
    * A hook for allowing the fetched data payload to be organized into a typed
    * data model for internal bulk upload. See defaultFormatterForBulkUpload for
diff --git a/src/plugins/usage_collection/server/collector/collector_set.ts b/src/plugins/usage_collection/server/collector/collector_set.ts
index 6cc5d057b080a..64a48025be248 100644
--- a/src/plugins/usage_collection/server/collector/collector_set.ts
+++ b/src/plugins/usage_collection/server/collector/collector_set.ts
@@ -18,8 +18,7 @@
  */
 
 import { snakeCase } from 'lodash';
-import { Logger } from 'kibana/server';
-import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
+import { Logger, APICaller } from 'kibana/server';
 import { Collector, CollectorOptions } from './collector';
 import { UsageCollector } from './usage_collector';
 
@@ -31,7 +30,7 @@ interface CollectorSetConfig {
 
 export class CollectorSet {
   private _waitingForAllCollectorsTimestamp?: number;
-  private logger: Logger;
+  private readonly logger: Logger;
   private readonly maximumWaitTimeForAllCollectorsInS: number;
   private collectors: Array<Collector<any, any>> = [];
   constructor({ logger, maximumWaitTimeForAllCollectorsInS, collectors = [] }: CollectorSetConfig) {
@@ -112,7 +111,7 @@ export class CollectorSet {
   };
 
   public bulkFetch = async (
-    callCluster: CallCluster,
+    callCluster: APICaller,
     collectors: Array<Collector<any, any>> = this.collectors
   ) => {
     const responses = [];
@@ -135,13 +134,13 @@ export class CollectorSet {
   /*
    * @return {new CollectorSet}
    */
-  public getFilteredCollectorSet = (filter: any) => {
+  public getFilteredCollectorSet = (filter: (col: Collector) => boolean) => {
     const filtered = this.collectors.filter(filter);
     return this.makeCollectorSetFromArray(filtered);
   };
 
-  public bulkFetchUsage = async (callCluster: CallCluster) => {
-    const usageCollectors = this.getFilteredCollectorSet((c: any) => c instanceof UsageCollector);
+  public bulkFetchUsage = async (callCluster: APICaller) => {
+    const usageCollectors = this.getFilteredCollectorSet(c => c instanceof UsageCollector);
     return await this.bulkFetch(callCluster, usageCollectors.collectors);
   };
 
diff --git a/src/plugins/usage_collection/server/index.ts b/src/plugins/usage_collection/server/index.ts
index 6a28dba50a915..a2769c8b4b405 100644
--- a/src/plugins/usage_collection/server/index.ts
+++ b/src/plugins/usage_collection/server/index.ts
@@ -17,7 +17,7 @@
  * under the License.
  */
 
-import { PluginInitializerContext } from '../../../../src/core/server';
+import { PluginInitializerContext } from 'kibana/server';
 import { UsageCollectionPlugin } from './plugin';
 
 export { UsageCollectionSetup } from './plugin';
diff --git a/src/plugins/usage_collection/server/plugin.ts b/src/plugins/usage_collection/server/plugin.ts
index 52acb5b3fc86f..00584e1fd5d86 100644
--- a/src/plugins/usage_collection/server/plugin.ts
+++ b/src/plugins/usage_collection/server/plugin.ts
@@ -18,15 +18,21 @@
  */
 
 import { first } from 'rxjs/operators';
-import { CoreStart, ISavedObjectsRepository } from 'kibana/server';
+import {
+  PluginInitializerContext,
+  Logger,
+  CoreSetup,
+  CoreStart,
+  ISavedObjectsRepository,
+  Plugin,
+} from 'kibana/server';
 import { ConfigType } from './config';
-import { PluginInitializerContext, Logger, CoreSetup } from '../../../../src/core/server';
 import { CollectorSet } from './collector';
 import { setupRoutes } from './routes';
 
 export type UsageCollectionSetup = CollectorSet;
-export class UsageCollectionPlugin {
-  logger: Logger;
+export class UsageCollectionPlugin implements Plugin<CollectorSet> {
+  private readonly logger: Logger;
   private savedObjects?: ISavedObjectsRepository;
   constructor(private readonly initializerContext: PluginInitializerContext) {
     this.logger = this.initializerContext.logger.get();
@@ -39,7 +45,7 @@ export class UsageCollectionPlugin {
       .toPromise();
 
     const collectorSet = new CollectorSet({
-      logger: this.logger,
+      logger: this.logger.get('collector-set'),
       maximumWaitTimeForAllCollectorsInS: config.maximumWaitTimeForAllCollectorsInS,
     });
 
diff --git a/src/plugins/vis_type_timeseries/server/lib/vis_data/response_processors/series/percentile.js b/src/plugins/vis_type_timeseries/server/lib/vis_data/response_processors/series/percentile.js
index 669a96a43ff8d..00fb48c88ec3f 100644
--- a/src/plugins/vis_type_timeseries/server/lib/vis_data/response_processors/series/percentile.js
+++ b/src/plugins/vis_type_timeseries/server/lib/vis_data/response_processors/series/percentile.js
@@ -17,7 +17,6 @@
  * under the License.
  */
 
-import _ from 'lodash';
 import { getAggValue } from '../../helpers/get_agg_value';
 import { getDefaultDecoration } from '../../helpers/get_default_decoration';
 import { getSplits } from '../../helpers/get_splits';
@@ -35,41 +34,45 @@ export function percentile(resp, panel, series, meta) {
     getSplits(resp, panel, series, meta).forEach(split => {
       metric.percentiles.forEach(percentile => {
         const percentileValue = percentile.value ? percentile.value : 0;
-        const label = `${split.label} (${percentileValue})`;
+        const id = `${split.id}:${percentile.id}`;
         const data = split.timeseries.buckets.map(bucket => {
-          const m = _.assign({}, metric, { percent: percentileValue });
-          return [bucket.key, getAggValue(bucket, m)];
+          const higherMetric = { ...metric, percent: percentileValue };
+          const serieData = [bucket.key, getAggValue(bucket, higherMetric)];
+
+          if (percentile.mode === 'band') {
+            const lowerMetric = { ...metric, percent: percentile.percentile };
+            serieData.push(getAggValue(bucket, lowerMetric));
+          }
+
+          return serieData;
         });
         if (percentile.mode === 'band') {
-          const fillData = split.timeseries.buckets.map(bucket => {
-            const m = _.assign({}, metric, { percent: percentile.percentile });
-            return [bucket.key, getAggValue(bucket, m)];
-          });
           results.push({
-            id: `${split.id}:${percentile.id}`,
+            id,
             color: split.color,
-            label,
+            label: split.label,
             data,
-            lines: { show: true, fill: percentile.shade, lineWidth: 0 },
-            points: { show: false },
-            legend: false,
-            fillBetween: `${split.id}:${percentile.id}:${percentile.percentile}`,
-          });
-          results.push({
-            id: `${split.id}:${percentile.id}:${percentile.percentile}`,
-            color: split.color,
-            label,
-            data: fillData,
-            lines: { show: true, fill: false, lineWidth: 0 },
-            legend: false,
+            lines: {
+              show: series.chart_type === 'line',
+              fill: Number(percentile.shade),
+              lineWidth: 0,
+              mode: 'band',
+            },
+            bars: {
+              show: series.chart_type === 'bar',
+              fill: Number(percentile.shade),
+              mode: 'band',
+            },
             points: { show: false },
+            y1AccessorFormat: ` (${percentileValue})`,
+            y0AccessorFormat: ` (${percentile.percentile})`,
           });
         } else {
           const decoration = getDefaultDecoration(series);
           results.push({
-            id: `${split.id}:${percentile.id}`,
+            id,
             color: split.color,
-            label,
+            label: `${split.label} (${percentileValue})`,
             data,
             ...decoration,
           });
diff --git a/src/plugins/vis_type_timeseries/server/lib/vis_data/response_processors/series/percentile.test.js b/src/plugins/vis_type_timeseries/server/lib/vis_data/response_processors/series/percentile.test.js
index 9cb08de8dad23..aec1c45cf97e1 100644
--- a/src/plugins/vis_type_timeseries/server/lib/vis_data/response_processors/series/percentile.test.js
+++ b/src/plugins/vis_type_timeseries/server/lib/vis_data/response_processors/series/percentile.test.js
@@ -89,63 +89,45 @@ describe('percentile(resp, panel, series)', () => {
   test('creates a series', () => {
     const next = results => results;
     const results = percentile(resp, panel, series)(next)([]);
-    expect(results).toHaveLength(3);
+    expect(results).toHaveLength(2);
 
     expect(results[0]).toHaveProperty('id', 'test:10-90');
     expect(results[0]).toHaveProperty('color', 'rgb(255, 0, 0)');
-    expect(results[0]).toHaveProperty('fillBetween', 'test:10-90:90');
-    expect(results[0]).toHaveProperty('label', 'Percentile of cpu (10)');
-    expect(results[0]).toHaveProperty('legend', false);
+    expect(results[0]).toHaveProperty('label', 'Percentile of cpu');
     expect(results[0]).toHaveProperty('lines');
     expect(results[0].lines).toEqual({
       fill: 0.2,
       lineWidth: 0,
       show: true,
+      mode: 'band',
     });
     expect(results[0]).toHaveProperty('points');
     expect(results[0].points).toEqual({ show: false });
     expect(results[0].data).toEqual([
-      [1, 1],
-      [2, 1.2],
+      [1, 1, 5],
+      [2, 1.2, 5.3],
     ]);
 
-    expect(results[1]).toHaveProperty('id', 'test:10-90:90');
+    expect(results[1]).toHaveProperty('id', 'test:50');
     expect(results[1]).toHaveProperty('color', 'rgb(255, 0, 0)');
-    expect(results[1]).toHaveProperty('label', 'Percentile of cpu (10)');
-    expect(results[1]).toHaveProperty('legend', false);
+    expect(results[1]).toHaveProperty('label', 'Percentile of cpu (50)');
+    expect(results[1]).toHaveProperty('stack', false);
     expect(results[1]).toHaveProperty('lines');
     expect(results[1].lines).toEqual({
-      fill: false,
-      lineWidth: 0,
-      show: true,
-    });
-    expect(results[1]).toHaveProperty('points');
-    expect(results[1].points).toEqual({ show: false });
-    expect(results[1].data).toEqual([
-      [1, 5],
-      [2, 5.3],
-    ]);
-
-    expect(results[2]).toHaveProperty('id', 'test:50');
-    expect(results[2]).toHaveProperty('color', 'rgb(255, 0, 0)');
-    expect(results[2]).toHaveProperty('label', 'Percentile of cpu (50)');
-    expect(results[2]).toHaveProperty('stack', false);
-    expect(results[2]).toHaveProperty('lines');
-    expect(results[2].lines).toEqual({
       fill: 0,
       lineWidth: 1,
       show: true,
       steps: false,
     });
-    expect(results[2]).toHaveProperty('bars');
-    expect(results[2].bars).toEqual({
+    expect(results[1]).toHaveProperty('bars');
+    expect(results[1].bars).toEqual({
       fill: 0,
       lineWidth: 1,
       show: false,
     });
-    expect(results[2]).toHaveProperty('points');
-    expect(results[2].points).toEqual({ show: true, lineWidth: 1, radius: 1 });
-    expect(results[2].data).toEqual([
+    expect(results[1]).toHaveProperty('points');
+    expect(results[1].points).toEqual({ show: true, lineWidth: 1, radius: 1 });
+    expect(results[1].data).toEqual([
       [1, 2.5],
       [2, 2.7],
     ]);
diff --git a/src/plugins/visualizations/public/persisted_state/persisted_state.ts b/src/plugins/visualizations/public/persisted_state/persisted_state.ts
index b81b651c73509..3e675574fd678 100644
--- a/src/plugins/visualizations/public/persisted_state/persisted_state.ts
+++ b/src/plugins/visualizations/public/persisted_state/persisted_state.ts
@@ -85,7 +85,7 @@ export class PersistedState extends EventEmitter {
   setSilent(key: PersistedStateKey | any, value?: any) {
     const params = prepSetParams(key, value, this._path);
 
-    if (params.key) {
+    if (params.key || params.value) {
       return this.setValue(params.key, params.value, true);
     }
   }
diff --git a/test/functional/apps/dashboard/create_and_add_embeddables.js b/test/functional/apps/dashboard/create_and_add_embeddables.js
index 5ebb9fdf6330f..3ce8e353e61fc 100644
--- a/test/functional/apps/dashboard/create_and_add_embeddables.js
+++ b/test/functional/apps/dashboard/create_and_add_embeddables.js
@@ -41,9 +41,24 @@ export default function({ getService, getPageObjects }) {
     });
 
     describe('add new visualization link', () => {
-      it('adds a new visualization', async () => {
+      it('adds new visualiztion via the top nav link', async () => {
         const originalPanelCount = await PageObjects.dashboard.getPanelCount();
         await PageObjects.dashboard.switchToEditMode();
+        await dashboardAddPanel.clickCreateNewLink();
+        await PageObjects.visualize.clickAreaChart();
+        await PageObjects.visualize.clickNewSearch();
+        await PageObjects.visualize.saveVisualizationExpectSuccess(
+          'visualization from top nav add new panel'
+        );
+        await retry.try(async () => {
+          const panelCount = await PageObjects.dashboard.getPanelCount();
+          expect(panelCount).to.eql(originalPanelCount + 1);
+        });
+        await PageObjects.dashboard.waitForRenderComplete();
+      });
+
+      it('adds a new visualization', async () => {
+        const originalPanelCount = await PageObjects.dashboard.getPanelCount();
         await dashboardAddPanel.ensureAddPanelIsShowing();
         await dashboardAddPanel.clickAddNewEmbeddableLink('visualization');
         await PageObjects.visualize.clickAreaChart();
diff --git a/test/functional/apps/management/_import_objects.js b/test/functional/apps/management/_import_objects.js
index 8aabe42ccc3db..cd39f1cf25ccc 100644
--- a/test/functional/apps/management/_import_objects.js
+++ b/test/functional/apps/management/_import_objects.js
@@ -19,12 +19,14 @@
 
 import expect from '@kbn/expect';
 import path from 'path';
+import { indexBy } from 'lodash';
 
 export default function({ getService, getPageObjects }) {
   const kibanaServer = getService('kibanaServer');
   const esArchiver = getService('esArchiver');
   const PageObjects = getPageObjects(['common', 'settings', 'header']);
   const testSubjects = getService('testSubjects');
+  const log = getService('log');
 
   describe('import objects', function describeIndexTests() {
     describe('.ndjson file', () => {
@@ -33,6 +35,7 @@ export default function({ getService, getPageObjects }) {
         await kibanaServer.uiSettings.replace({});
         await PageObjects.settings.navigateTo();
         await esArchiver.load('management');
+        await PageObjects.settings.clickKibanaSavedObjects();
       });
 
       afterEach(async function() {
@@ -40,20 +43,31 @@ export default function({ getService, getPageObjects }) {
       });
 
       it('should import saved objects', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects.ndjson')
         );
         await PageObjects.settings.checkImportSucceeded();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
-        const objects = await PageObjects.settings.getSavedObjectsInTable();
-        const isSavedObjectImported = objects.includes('Log Agents');
-        expect(isSavedObjectImported).to.be(true);
+
+        // get all the elements in the table, and index them by the 'title' visible text field
+        const elements = indexBy(
+          await PageObjects.settings.getSavedObjectElementsInTable(),
+          'title'
+        );
+        log.debug("check that 'Log Agents' is in table as a visualization");
+        expect(elements['Log Agents'].objectType).to.eql('visualization');
+
+        await elements['logstash-*'].relationshipsElement.click();
+        const flyout = indexBy(await PageObjects.settings.getRelationshipFlyout(), 'title');
+        log.debug(
+          "check that 'Shared-Item Visualization AreaChart' shows 'logstash-*' as it's Parent"
+        );
+        expect(flyout['Shared-Item Visualization AreaChart'].relationship).to.eql('Parent');
+        log.debug("check that 'Log Agents' shows 'logstash-*' as it's Parent");
+        expect(flyout['Log Agents'].relationship).to.eql('Parent');
       });
 
       it('should provide dialog to allow the importing of saved objects with index pattern conflicts', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_conflicts.ndjson')
         );
@@ -65,15 +79,12 @@ export default function({ getService, getPageObjects }) {
         await PageObjects.settings.clickConfirmChanges();
         await PageObjects.header.waitUntilLoadingHasFinished();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object with index pattern conflict');
         expect(isSavedObjectImported).to.be(true);
       });
 
       it('should allow the user to override duplicate saved objects', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
-
         // This data has already been loaded by the "visualize" esArchive. We'll load it again
         // so that we can override the existing visualization.
         await PageObjects.settings.importFile(
@@ -93,8 +104,6 @@ export default function({ getService, getPageObjects }) {
       });
 
       it('should allow the user to cancel overriding duplicate saved objects', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
-
         // This data has already been loaded by the "visualize" esArchive. We'll load it again
         // so that we can be prompted to override the existing visualization.
         await PageObjects.settings.importFile(
@@ -114,21 +123,17 @@ export default function({ getService, getPageObjects }) {
       });
 
       it('should import saved objects linked to saved searches', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_saved_search.ndjson')
         );
         await PageObjects.settings.checkImportSucceeded();
         await PageObjects.settings.clickImportDone();
 
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.ndjson')
         );
         await PageObjects.settings.checkImportSucceeded();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
@@ -136,14 +141,11 @@ export default function({ getService, getPageObjects }) {
       });
 
       it('should not import saved objects linked to saved searches when saved search does not exist', async function() {
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.ndjson')
         );
         await PageObjects.settings.checkNoneImported();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
@@ -151,12 +153,13 @@ export default function({ getService, getPageObjects }) {
       });
 
       it('should not import saved objects linked to saved searches when saved search index pattern does not exist', async function() {
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaIndexPatterns();
-        await PageObjects.settings.removeLogstashIndexPatternIfExist();
+        const elements = indexBy(
+          await PageObjects.settings.getSavedObjectElementsInTable(),
+          'title'
+        );
+        await elements['logstash-*'].checkbox.click();
+        await PageObjects.settings.clickSavedObjectsDelete();
 
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_saved_search.ndjson')
         );
@@ -164,7 +167,6 @@ export default function({ getService, getPageObjects }) {
         await PageObjects.settings.checkImportConflictsWarning();
         await PageObjects.settings.clickConfirmChanges();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
@@ -173,14 +175,11 @@ export default function({ getService, getPageObjects }) {
 
       it('should import saved objects with index patterns when index patterns already exists', async () => {
         // First, import the objects
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_index_patterns.ndjson')
         );
         await PageObjects.settings.checkImportSucceeded();
         await PageObjects.settings.clickImportDone();
-        // Wait for all the saves to happen
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object imported with index pattern');
@@ -189,19 +188,19 @@ export default function({ getService, getPageObjects }) {
 
       it('should import saved objects with index patterns when index patterns does not exists', async () => {
         // First, we need to delete the index pattern
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaIndexPatterns();
-        await PageObjects.settings.removeLogstashIndexPatternIfExist();
+        const elements = indexBy(
+          await PageObjects.settings.getSavedObjectElementsInTable(),
+          'title'
+        );
+        await elements['logstash-*'].checkbox.click();
+        await PageObjects.settings.clickSavedObjectsDelete();
 
         // Then, import the objects
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_index_patterns.ndjson')
         );
         await PageObjects.settings.checkImportSucceeded();
         await PageObjects.settings.clickImportDone();
-        // Wait for all the saves to happen
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object imported with index pattern');
@@ -215,6 +214,7 @@ export default function({ getService, getPageObjects }) {
         await kibanaServer.uiSettings.replace({});
         await PageObjects.settings.navigateTo();
         await esArchiver.load('management');
+        await PageObjects.settings.clickKibanaSavedObjects();
       });
 
       afterEach(async function() {
@@ -222,20 +222,17 @@ export default function({ getService, getPageObjects }) {
       });
 
       it('should import saved objects', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects.json')
         );
         await PageObjects.settings.checkImportSucceeded();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('Log Agents');
         expect(isSavedObjectImported).to.be(true);
       });
 
       it('should provide dialog to allow the importing of saved objects with index pattern conflicts', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects-conflicts.json')
         );
@@ -248,15 +245,12 @@ export default function({ getService, getPageObjects }) {
         await PageObjects.settings.clickConfirmChanges();
         await PageObjects.header.waitUntilLoadingHasFinished();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object with index pattern conflict');
         expect(isSavedObjectImported).to.be(true);
       });
 
       it('should allow the user to override duplicate saved objects', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
-
         // This data has already been loaded by the "visualize" esArchive. We'll load it again
         // so that we can override the existing visualization.
         await PageObjects.settings.importFile(
@@ -277,8 +271,6 @@ export default function({ getService, getPageObjects }) {
       });
 
       it('should allow the user to cancel overriding duplicate saved objects', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
-
         // This data has already been loaded by the "visualize" esArchive. We'll load it again
         // so that we can be prompted to override the existing visualization.
         await PageObjects.settings.importFile(
@@ -299,21 +291,17 @@ export default function({ getService, getPageObjects }) {
       });
 
       it('should import saved objects linked to saved searches', async function() {
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_saved_search.json')
         );
         await PageObjects.settings.checkImportSucceeded();
         await PageObjects.settings.clickImportDone();
 
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.json')
         );
         await PageObjects.settings.checkImportSucceeded();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
@@ -321,14 +309,11 @@ export default function({ getService, getPageObjects }) {
       });
 
       it('should not import saved objects linked to saved searches when saved search does not exist', async function() {
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.json')
         );
         await PageObjects.settings.checkImportFailedWarning();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
@@ -337,7 +322,6 @@ export default function({ getService, getPageObjects }) {
 
       it('should not import saved objects linked to saved searches when saved search index pattern does not exist', async function() {
         // First, import the saved search
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_saved_search.json')
         );
@@ -346,21 +330,21 @@ export default function({ getService, getPageObjects }) {
         await PageObjects.settings.clickImportDone();
 
         // Second, we need to delete the index pattern
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaIndexPatterns();
-        await PageObjects.settings.removeLogstashIndexPatternIfExist();
+        const elements = indexBy(
+          await PageObjects.settings.getSavedObjectElementsInTable(),
+          'title'
+        );
+        await elements['logstash-*'].checkbox.click();
+        await PageObjects.settings.clickSavedObjectsDelete();
 
         // Last, import a saved object connected to the saved search
         // This should NOT show the conflicts
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_connected_to_saved_search.json')
         );
         // Wait for all the saves to happen
         await PageObjects.settings.checkNoneImported();
         await PageObjects.settings.clickImportDone();
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object connected to saved search');
@@ -369,14 +353,11 @@ export default function({ getService, getPageObjects }) {
 
       it('should import saved objects with index patterns when index patterns already exists', async () => {
         // First, import the objects
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_index_patterns.json')
         );
         await PageObjects.settings.checkImportFailedWarning();
         await PageObjects.settings.clickImportDone();
-        // Wait for all the saves to happen
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object imported with index pattern');
@@ -385,19 +366,19 @@ export default function({ getService, getPageObjects }) {
 
       it('should import saved objects with index patterns when index patterns does not exists', async () => {
         // First, we need to delete the index pattern
-        await PageObjects.settings.navigateTo();
-        await PageObjects.settings.clickKibanaIndexPatterns();
-        await PageObjects.settings.removeLogstashIndexPatternIfExist();
+        const elements = indexBy(
+          await PageObjects.settings.getSavedObjectElementsInTable(),
+          'title'
+        );
+        await elements['logstash-*'].checkbox.click();
+        await PageObjects.settings.clickSavedObjectsDelete();
 
         // Then, import the objects
-        await PageObjects.settings.clickKibanaSavedObjects();
         await PageObjects.settings.importFile(
           path.join(__dirname, 'exports', '_import_objects_with_index_patterns.json')
         );
         await PageObjects.settings.checkImportSucceeded();
         await PageObjects.settings.clickImportDone();
-        // Wait for all the saves to happen
-        await PageObjects.settings.waitUntilSavedObjectsTableIsNotLoading();
 
         const objects = await PageObjects.settings.getSavedObjectsInTable();
         const isSavedObjectImported = objects.includes('saved object imported with index pattern');
diff --git a/test/functional/apps/visualize/_data_table.js b/test/functional/apps/visualize/_data_table.js
index 0a9ff1e77a2ef..a6305e158007d 100644
--- a/test/functional/apps/visualize/_data_table.js
+++ b/test/functional/apps/visualize/_data_table.js
@@ -99,9 +99,9 @@ export default function({ getService, getPageObjects }) {
       async function expectValidTableData() {
         const data = await PageObjects.visChart.getTableVisData();
         expect(data.trim().split('\n')).to.be.eql([
-          '≥ 0 and < 1000',
+          '≥ 0B and < 1,000B',
           '1,351 64.7%',
-          '≥ 1000 and < 2000',
+          '≥ 1,000B and < 1.953KB',
           '737 35.3%',
         ]);
       }
@@ -144,9 +144,9 @@ export default function({ getService, getPageObjects }) {
 
       const data = await PageObjects.visChart.getTableVisData();
       expect(data.trim().split('\n')).to.be.eql([
-        '≥ 0 and < 1000',
+        '≥ 0B and < 1,000B',
         '344.094B',
-        '≥ 1000 and < 2000',
+        '≥ 1,000B and < 1.953KB',
         '1.697KB',
       ]);
     });
@@ -248,9 +248,9 @@ export default function({ getService, getPageObjects }) {
       await PageObjects.visEditor.clickGo();
       const data = await PageObjects.visChart.getTableVisData();
       expect(data.trim().split('\n')).to.be.eql([
-        '≥ 0 and < 1000',
+        '≥ 0B and < 1,000B',
         '1,351',
-        '≥ 1000 and < 2000',
+        '≥ 1,000B and < 1.953KB',
         '737',
       ]);
     });
diff --git a/test/functional/apps/visualize/_tile_map.js b/test/functional/apps/visualize/_tile_map.js
index 397eaeb0f3013..0a7be3d682311 100644
--- a/test/functional/apps/visualize/_tile_map.js
+++ b/test/functional/apps/visualize/_tile_map.js
@@ -23,7 +23,6 @@ export default function({ getService, getPageObjects }) {
   const log = getService('log');
   const retry = getService('retry');
   const inspector = getService('inspector');
-  const find = getService('find');
   const filterBar = getService('filterBar');
   const testSubjects = getService('testSubjects');
   const browser = getService('browser');
@@ -278,7 +277,7 @@ export default function({ getService, getPageObjects }) {
       it('should suppress zoom warning if suppress warnings button clicked', async () => {
         last = true;
         await PageObjects.visChart.waitForVisualization();
-        await find.clickByCssSelector('[data-test-subj="suppressZoomWarnings"]');
+        await testSubjects.click('suppressZoomWarnings');
         await PageObjects.tileMap.clickMapZoomOut(waitForLoading);
         await testSubjects.waitForDeleted('suppressZoomWarnings');
         await PageObjects.tileMap.clickMapZoomIn(waitForLoading);
diff --git a/test/functional/fixtures/es_archiver/management/data.json.gz b/test/functional/fixtures/es_archiver/management/data.json.gz
index e4b8f7e954477..cfb08a5ee3a60 100644
Binary files a/test/functional/fixtures/es_archiver/management/data.json.gz and b/test/functional/fixtures/es_archiver/management/data.json.gz differ
diff --git a/test/functional/page_objects/common_page.ts b/test/functional/page_objects/common_page.ts
index 6ed5f16d72516..7db8285d377aa 100644
--- a/test/functional/page_objects/common_page.ts
+++ b/test/functional/page_objects/common_page.ts
@@ -100,7 +100,7 @@ export function CommonPageProvider({ getService, getPageObjects }: FtrProviderCo
     private async loginIfPrompted(appUrl: string) {
       let currentUrl = await browser.getCurrentUrl();
       log.debug(`currentUrl = ${currentUrl}\n    appUrl = ${appUrl}`);
-      await find.byCssSelector('[data-test-subj="kibanaChrome"]', 6 * defaultFindTimeout); // 60 sec waiting
+      await testSubjects.find('kibanaChrome', 6 * defaultFindTimeout); // 60 sec waiting
       const loginPage = currentUrl.includes('/login');
       const wantedLoginPage = appUrl.includes('/login') || appUrl.includes('/logout');
 
diff --git a/test/functional/page_objects/discover_page.ts b/test/functional/page_objects/discover_page.ts
index f018a1ceda507..a126cfb1bce4b 100644
--- a/test/functional/page_objects/discover_page.ts
+++ b/test/functional/page_objects/discover_page.ts
@@ -255,14 +255,14 @@ export function DiscoverPageProvider({ getService, getPageObjects }: FtrProvider
     public async clickFieldListPlusFilter(field: string, value: string) {
       // this method requires the field details to be open from clickFieldListItem()
       // testSubjects.find doesn't handle spaces in the data-test-subj value
-      await find.clickByCssSelector(`[data-test-subj="plus-${field}-${value}"]`);
+      await testSubjects.click(`plus-${field}-${value}`);
       await header.waitUntilLoadingHasFinished();
     }
 
     public async clickFieldListMinusFilter(field: string, value: string) {
       // this method requires the field details to be open from clickFieldListItem()
       // testSubjects.find doesn't handle spaces in the data-test-subj value
-      await find.clickByCssSelector('[data-test-subj="minus-' + field + '-' + value + '"]');
+      await testSubjects.click(`minus-${field}-${value}`);
       await header.waitUntilLoadingHasFinished();
     }
 
diff --git a/test/functional/page_objects/newsfeed_page.ts b/test/functional/page_objects/newsfeed_page.ts
index 24ff21f0b47de..ade3bdadf25d4 100644
--- a/test/functional/page_objects/newsfeed_page.ts
+++ b/test/functional/page_objects/newsfeed_page.ts
@@ -54,7 +54,7 @@ export function NewsfeedPageProvider({ getService, getPageObjects }: FtrProvider
 
     async getNewsfeedList() {
       const list = await testSubjects.find('NewsfeedFlyout');
-      const cells = await list.findAllByCssSelector('[data-test-subj="newsHeadAlert"]');
+      const cells = await list.findAllByTestSubject('newsHeadAlert');
 
       const objects = [];
       for (const cell of cells) {
diff --git a/test/functional/page_objects/settings_page.ts b/test/functional/page_objects/settings_page.ts
index 0ad1a1dc51321..25706fda74925 100644
--- a/test/functional/page_objects/settings_page.ts
+++ b/test/functional/page_objects/settings_page.ts
@@ -47,6 +47,7 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
 
     async clickKibanaSavedObjects() {
       await testSubjects.click('objects');
+      await this.waitUntilSavedObjectsTableIsNotLoading();
     }
 
     async clickKibanaIndexPatterns() {
@@ -211,9 +212,8 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
     }
 
     async getScriptedFieldsTabCount() {
-      const selector = '[data-test-subj="tab-count-scriptedFields"]';
       return await retry.try(async () => {
-        const theText = await (await find.byCssSelector(selector)).getVisibleText();
+        const theText = await testSubjects.getVisibleText('tab-count-scriptedFields');
         return theText.replace(/\((.*)\)/, '$1');
       });
     }
@@ -649,6 +649,7 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
 
     async clickImportDone() {
       await testSubjects.click('importSavedObjectsDoneBtn');
+      await this.waitUntilSavedObjectsTableIsNotLoading();
     }
 
     async clickConfirmChanges() {
@@ -682,9 +683,38 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
       });
     }
 
+    async getSavedObjectElementsInTable() {
+      const rows = await testSubjects.findAll('~savedObjectsTableRow');
+      return mapAsync(rows, async row => {
+        const checkbox = await row.findByCssSelector('[data-test-subj*="checkboxSelectRow"]');
+        // return the object type aria-label="index patterns"
+        const objectType = await row.findByTestSubject('objectType');
+        const titleElement = await row.findByTestSubject('savedObjectsTableRowTitle');
+        // not all rows have inspect button - Advanced Settings objects don't
+        let inspectElement;
+        const innerHtml = await row.getAttribute('innerHTML');
+        if (innerHtml.includes('Inspect')) {
+          inspectElement = await row.findByTestSubject('savedObjectsTableAction-inspect');
+        } else {
+          inspectElement = null;
+        }
+        const relationshipsElement = await row.findByTestSubject(
+          'savedObjectsTableAction-relationships'
+        );
+        return {
+          checkbox,
+          objectType: await objectType.getAttribute('aria-label'),
+          titleElement,
+          title: await titleElement.getVisibleText(),
+          inspectElement,
+          relationshipsElement,
+        };
+      });
+    }
+
     async getSavedObjectsInTable() {
       const table = await testSubjects.find('savedObjectsTable');
-      const cells = await table.findAllByCssSelector('td:nth-child(3)');
+      const cells = await table.findAllByTestSubject('savedObjectsTableRowTitle');
 
       const objects = [];
       for (const cell of cells) {
@@ -694,6 +724,23 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
       return objects;
     }
 
+    async getRelationshipFlyout() {
+      const rows = await testSubjects.findAll('relationshipsTableRow');
+      return mapAsync(rows, async row => {
+        const objectType = await row.findByTestSubject('relationshipsObjectType');
+        const relationship = await row.findByTestSubject('directRelationship');
+        const titleElement = await row.findByTestSubject('relationshipsTitle');
+        const inspectElement = await row.findByTestSubject('relationshipsTableAction-inspect');
+        return {
+          objectType: await objectType.getAttribute('aria-label'),
+          relationship: await relationship.getVisibleText(),
+          titleElement,
+          title: await titleElement.getVisibleText(),
+          inspectElement,
+        };
+      });
+    }
+
     async getSavedObjectsTableSummary() {
       const table = await testSubjects.find('savedObjectsTable');
       const rows = await table.findAllByCssSelector('tbody tr');
@@ -724,17 +771,10 @@ export function SettingsPageProvider({ getService, getPageObjects }: FtrProvider
       return await deleteButton.isEnabled();
     }
 
-    async canSavedObjectBeDeleted(id: string) {
-      const allCheckBoxes = await testSubjects.findAll('checkboxSelectRow*');
-      for (const checkBox of allCheckBoxes) {
-        if (await checkBox.isSelected()) {
-          await checkBox.click();
-        }
-      }
-
-      const checkBox = await testSubjects.find(`checkboxSelectRow-${id}`);
-      await checkBox.click();
-      return await this.canSavedObjectsBeDeleted();
+    async clickSavedObjectsDelete() {
+      await testSubjects.click('savedObjectsManagementDelete');
+      await testSubjects.click('confirmModalConfirmButton');
+      await this.waitUntilSavedObjectsTableIsNotLoading();
     }
   }
 
diff --git a/test/functional/page_objects/timelion_page.js b/test/functional/page_objects/timelion_page.js
index 4aaa654e4286a..88eda5da5ce15 100644
--- a/test/functional/page_objects/timelion_page.js
+++ b/test/functional/page_objects/timelion_page.js
@@ -19,7 +19,6 @@
 
 export function TimelionPageProvider({ getService, getPageObjects }) {
   const testSubjects = getService('testSubjects');
-  const find = getService('find');
   const log = getService('log');
   const PageObjects = getPageObjects(['common', 'header']);
   const esArchiver = getService('esArchiver');
@@ -55,12 +54,12 @@ export function TimelionPageProvider({ getService, getPageObjects }) {
     }
 
     async getSuggestionItemsText() {
-      const elements = await find.allByCssSelector('[data-test-subj="timelionSuggestionListItem"]');
+      const elements = await testSubjects.findAll('timelionSuggestionListItem');
       return await Promise.all(elements.map(async element => await element.getVisibleText()));
     }
 
     async clickSuggestion(suggestionIndex = 0, waitTime = 500) {
-      const elements = await find.allByCssSelector('[data-test-subj="timelionSuggestionListItem"]');
+      const elements = await testSubjects.findAll('timelionSuggestionListItem');
       if (suggestionIndex > elements.length) {
         throw new Error(
           `Unable to select suggestion ${suggestionIndex}, only ${elements.length} suggestions available.`
diff --git a/test/functional/page_objects/visual_builder_page.ts b/test/functional/page_objects/visual_builder_page.ts
index d95cff61d13a8..b8e6c812b46bd 100644
--- a/test/functional/page_objects/visual_builder_page.ts
+++ b/test/functional/page_objects/visual_builder_page.ts
@@ -485,7 +485,7 @@ export function VisualBuilderPageProvider({ getService, getPageObjects }: FtrPro
       const labels = await testSubjects.findAll('aggRow');
       const label = labels[aggNth];
 
-      return (await label.findAllByCssSelector('[data-test-subj = "comboBoxInput"]'))[1];
+      return (await label.findAllByTestSubject('comboBoxInput'))[1];
     }
 
     public async clickColorPicker(): Promise<void> {
@@ -533,7 +533,7 @@ export function VisualBuilderPageProvider({ getService, getPageObjects }: FtrPro
      */
     public async getAggregationCount(nth: number = 0): Promise<number> {
       const series = await this.getSeries();
-      const aggregation = await series[nth].findAllByCssSelector('[data-test-subj="draggable"]');
+      const aggregation = await series[nth].findAllByTestSubject('draggable');
       return aggregation.length;
     }
 
diff --git a/test/functional/page_objects/visualize_editor_page.ts b/test/functional/page_objects/visualize_editor_page.ts
index cdc16babc4189..b1c3e924b3c1b 100644
--- a/test/functional/page_objects/visualize_editor_page.ts
+++ b/test/functional/page_objects/visualize_editor_page.ts
@@ -110,7 +110,7 @@ export function VisualizeEditorPageProvider({ getService, getPageObjects }: FtrP
      */
     public async clickBucket(bucketName: string, type = 'buckets') {
       await testSubjects.click(`visEditorAdd_${type}`);
-      await find.clickByCssSelector(`[data-test-subj="visEditorAdd_${type}_${bucketName}"`);
+      await testSubjects.click(`visEditorAdd_${type}_${bucketName}`);
     }
 
     public async clickEnableCustomRanges() {
diff --git a/test/functional/services/combo_box.ts b/test/functional/services/combo_box.ts
index 33610e64f1c79..2c12490ccd436 100644
--- a/test/functional/services/combo_box.ts
+++ b/test/functional/services/combo_box.ts
@@ -218,7 +218,7 @@ export function ComboBoxProvider({ getService, getPageObjects }: FtrProviderCont
           return;
         }
 
-        const clearBtn = await comboBox.findByCssSelector('[data-test-subj="comboBoxClearButton"]');
+        const clearBtn = await comboBox.findByTestSubject('comboBoxClearButton');
         await clearBtn.click();
 
         const clearButtonStillExists = await this.doesClearButtonExist(comboBox);
@@ -230,8 +230,8 @@ export function ComboBoxProvider({ getService, getPageObjects }: FtrProviderCont
     }
 
     public async doesClearButtonExist(comboBoxElement: WebElementWrapper): Promise<boolean> {
-      const found = await comboBoxElement.findAllByCssSelector(
-        '[data-test-subj="comboBoxClearButton"]',
+      const found = await comboBoxElement.findAllByTestSubject(
+        'comboBoxClearButton',
         WAIT_FOR_EXISTS_TIME
       );
       return found.length > 0;
@@ -264,9 +264,7 @@ export function ComboBoxProvider({ getService, getPageObjects }: FtrProviderCont
     public async openOptionsList(comboBoxElement: WebElementWrapper): Promise<void> {
       const isOptionsListOpen = await testSubjects.exists('~comboBoxOptionsList');
       if (!isOptionsListOpen) {
-        const toggleBtn = await comboBoxElement.findByCssSelector(
-          '[data-test-subj="comboBoxToggleListButton"]'
-        );
+        const toggleBtn = await comboBoxElement.findByTestSubject('comboBoxToggleListButton');
         await toggleBtn.click();
       }
     }
diff --git a/test/functional/services/dashboard/add_panel.js b/test/functional/services/dashboard/add_panel.js
index b2dbeba68d131..9f05982fc78d9 100644
--- a/test/functional/services/dashboard/add_panel.js
+++ b/test/functional/services/dashboard/add_panel.js
@@ -30,6 +30,13 @@ export function DashboardAddPanelProvider({ getService, getPageObjects }) {
       await testSubjects.click('dashboardAddPanelButton');
     }
 
+    async clickCreateNewLink() {
+      log.debug('DashboardAddPanel.clickAddNewPanelButton');
+      await testSubjects.click('dashboardAddNewPanelButton');
+      // Give some time for the animation to complete
+      await PageObjects.common.sleep(500);
+    }
+
     async clickAddNewEmbeddableLink(type) {
       await testSubjects.click('createNew');
       await testSubjects.click(`createNew-${type}`);
diff --git a/test/functional/services/doc_table.ts b/test/functional/services/doc_table.ts
index cb3daf20c641a..69650f123d99d 100644
--- a/test/functional/services/doc_table.ts
+++ b/test/functional/services/doc_table.ts
@@ -48,12 +48,12 @@ export function DocTableProvider({ getService, getPageObjects }: FtrProviderCont
 
     public async getBodyRows(): Promise<WebElementWrapper[]> {
       const table = await this.getTable();
-      return await table.findAllByCssSelector('[data-test-subj~="docTableRow"]');
+      return await table.findAllByTestSubject('~docTableRow');
     }
 
     public async getAnchorRow(): Promise<WebElementWrapper> {
       const table = await this.getTable();
-      return await table.findByCssSelector('[data-test-subj~="docTableAnchorRow"]');
+      return await table.findByTestSubject('~docTableAnchorRow');
     }
 
     public async getRow(options: SelectOptions): Promise<WebElementWrapper> {
@@ -73,7 +73,7 @@ export function DocTableProvider({ getService, getPageObjects }: FtrProviderCont
       options: SelectOptions = { isAnchorRow: false, rowIndex: 0 }
     ): Promise<void> {
       const row = await this.getRow(options);
-      const toggle = await row.findByCssSelector('[data-test-subj~="docTableExpandToggleColumn"]');
+      const toggle = await row.findByTestSubject('~docTableExpandToggleColumn');
       await toggle.click();
     }
 
@@ -90,7 +90,7 @@ export function DocTableProvider({ getService, getPageObjects }: FtrProviderCont
       const detailsRow = options.isAnchorRow
         ? await this.getAnchorDetailsRow()
         : (await this.getDetailsRows())[options.rowIndex];
-      return await detailsRow.findAllByCssSelector('[data-test-subj~="docTableRowAction"]');
+      return await detailsRow.findAllByTestSubject('~docTableRowAction');
     }
 
     public async getFields(options: { isAnchorRow: boolean } = { isAnchorRow: false }) {
@@ -122,15 +122,13 @@ export function DocTableProvider({ getService, getPageObjects }: FtrProviderCont
       detailsRow: WebElementWrapper,
       fieldName: WebElementWrapper
     ): Promise<WebElementWrapper> {
-      return await detailsRow.findByCssSelector(`[data-test-subj~="tableDocViewRow-${fieldName}"]`);
+      return await detailsRow.findByTestSubject(`~tableDocViewRow-${fieldName}`);
     }
 
     public async getAddInclusiveFilterButton(
       tableDocViewRow: WebElementWrapper
     ): Promise<WebElementWrapper> {
-      return await tableDocViewRow.findByCssSelector(
-        `[data-test-subj~="addInclusiveFilterButton"]`
-      );
+      return await tableDocViewRow.findByTestSubject(`~addInclusiveFilterButton`);
     }
 
     public async addInclusiveFilter(
@@ -146,7 +144,7 @@ export function DocTableProvider({ getService, getPageObjects }: FtrProviderCont
     public async getAddExistsFilterButton(
       tableDocViewRow: WebElementWrapper
     ): Promise<WebElementWrapper> {
-      return await tableDocViewRow.findByCssSelector(`[data-test-subj~="addExistsFilterButton"]`);
+      return await tableDocViewRow.findByTestSubject(`~addExistsFilterButton`);
     }
 
     public async addExistsFilter(
@@ -171,7 +169,7 @@ export function DocTableProvider({ getService, getPageObjects }: FtrProviderCont
         const detailsRow = await row.findByXpath(
           './following-sibling::*[@data-test-subj="docTableDetailsRow"]'
         );
-        return detailsRow.findByCssSelector('[data-test-subj~="docViewer"]');
+        return detailsRow.findByTestSubject('~docViewer');
       });
     }
   }
diff --git a/test/functional/services/lib/web_element_wrapper/web_element_wrapper.ts b/test/functional/services/lib/web_element_wrapper/web_element_wrapper.ts
index fe781c2ac02b6..157918df874c8 100644
--- a/test/functional/services/lib/web_element_wrapper/web_element_wrapper.ts
+++ b/test/functional/services/lib/web_element_wrapper/web_element_wrapper.ts
@@ -537,6 +537,40 @@ export class WebElementWrapper {
     });
   }
 
+  /**
+   * Gets the first element inside this element matching the given data-test-subj selector.
+   *
+   * @param {string} selector
+   * @return {Promise<WebElementWrapper>}
+   */
+  public async findByTestSubject(selector: string) {
+    return await this.retryCall(async function find(wrapper) {
+      return wrapper._wrap(
+        await wrapper._webElement.findElement(wrapper.By.css(testSubjSelector(selector))),
+        wrapper.By.css(selector)
+      );
+    });
+  }
+
+  /**
+   * Gets all elements inside this element matching the given data-test-subj selector.
+   *
+   * @param {string} selector
+   * @param {number} timeout
+   * @return {Promise<WebElementWrapper[]>}
+   */
+  public async findAllByTestSubject(selector: string, timeout?: number) {
+    return await this.retryCall(async function findAll(wrapper) {
+      return wrapper._wrapAll(
+        await wrapper._findWithCustomTimeout(
+          async () =>
+            await wrapper._webElement.findElements(wrapper.By.css(testSubjSelector(selector))),
+          timeout
+        )
+      );
+    });
+  }
+
   /**
    * Gets the first element inside this element matching the given CSS class name.
    * https://seleniumhq.github.io/selenium/docs/api/javascript/module/selenium-webdriver/lib/webdriver_exports_WebElement.html#findElement
diff --git a/test/plugin_functional/config.js b/test/plugin_functional/config.js
index e63054f1b6912..7017c01cc5634 100644
--- a/test/plugin_functional/config.js
+++ b/test/plugin_functional/config.js
@@ -39,6 +39,7 @@ export default async function({ readConfigFile }) {
       require.resolve('./test_suites/core_plugins'),
       require.resolve('./test_suites/management'),
       require.resolve('./test_suites/bfetch_explorer'),
+      require.resolve('./test_suites/doc_views'),
     ],
     services: {
       ...functionalConfig.get('services'),
diff --git a/test/plugin_functional/plugins/doc_views_plugin/kibana.json b/test/plugin_functional/plugins/doc_views_plugin/kibana.json
new file mode 100644
index 0000000000000..f8596aad01e87
--- /dev/null
+++ b/test/plugin_functional/plugins/doc_views_plugin/kibana.json
@@ -0,0 +1,8 @@
+{
+  "id": "docViewPlugin",
+  "version": "0.0.1",
+  "kibanaVersion": "kibana",
+  "server": false,
+  "ui": true,
+  "requiredPlugins": ["discover"]
+}
diff --git a/test/plugin_functional/plugins/doc_views_plugin/package.json b/test/plugin_functional/plugins/doc_views_plugin/package.json
new file mode 100644
index 0000000000000..0cef1bf65c0e8
--- /dev/null
+++ b/test/plugin_functional/plugins/doc_views_plugin/package.json
@@ -0,0 +1,17 @@
+{
+  "name": "docViewPlugin",
+  "version": "1.0.0",
+  "main": "target/test/plugin_functional/plugins/doc_views_plugin",
+  "kibana": {
+    "version": "kibana",
+    "templateVersion": "1.0.0"
+  },
+  "license": "Apache-2.0",
+  "scripts": {
+    "kbn": "node ../../../../scripts/kbn.js",
+    "build": "rm -rf './target' && tsc"
+  },
+  "devDependencies": {
+    "typescript": "3.7.2"
+  }
+}
diff --git a/src/legacy/core_plugins/vis_type_timeseries/public/legacy_imports.ts b/test/plugin_functional/plugins/doc_views_plugin/public/index.ts
similarity index 89%
rename from src/legacy/core_plugins/vis_type_timeseries/public/legacy_imports.ts
rename to test/plugin_functional/plugins/doc_views_plugin/public/index.ts
index 7cf0a12e8567c..8097226180763 100644
--- a/src/legacy/core_plugins/vis_type_timeseries/public/legacy_imports.ts
+++ b/test/plugin_functional/plugins/doc_views_plugin/public/index.ts
@@ -17,5 +17,6 @@
  * under the License.
  */
 
-// @ts-ignore
-export { timezoneProvider } from 'ui/vis/lib/timezone';
+import { DocViewsPlugin } from './plugin';
+
+export const plugin = () => new DocViewsPlugin();
diff --git a/test/plugin_functional/plugins/doc_views_plugin/public/plugin.tsx b/test/plugin_functional/plugins/doc_views_plugin/public/plugin.tsx
new file mode 100644
index 0000000000000..4b9823fda3673
--- /dev/null
+++ b/test/plugin_functional/plugins/doc_views_plugin/public/plugin.tsx
@@ -0,0 +1,60 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import angular from 'angular';
+import React from 'react';
+import { Plugin, CoreSetup } from 'kibana/public';
+import { DiscoverSetup } from '../../../../../src/plugins/discover/public';
+
+angular.module('myDocView', []).directive('myHit', () => ({
+  restrict: 'E',
+  scope: {
+    hit: '=hit',
+  },
+  template: '<h1 data-test-subj="angular-docview">{{hit._index}}</h1>',
+}));
+
+function MyHit(props: { index: string }) {
+  return <h1 data-test-subj="react-docview">{props.index}</h1>;
+}
+
+export class DocViewsPlugin implements Plugin<void, void> {
+  public setup(core: CoreSetup, { discover }: { discover: DiscoverSetup }) {
+    discover.docViews.addDocView({
+      directive: {
+        controller: function MyController($injector: any) {
+          $injector.loadNewModules(['myDocView']);
+        },
+        template: `<my-hit hit="hit"></my-hit>`,
+      },
+      order: 1,
+      title: 'Angular doc view',
+    });
+
+    discover.docViews.addDocView({
+      component: props => {
+        return <MyHit index={props.hit._index as string} />;
+      },
+      order: 2,
+      title: 'React doc view',
+    });
+  }
+
+  public start() {}
+}
diff --git a/test/plugin_functional/plugins/doc_views_plugin/tsconfig.json b/test/plugin_functional/plugins/doc_views_plugin/tsconfig.json
new file mode 100644
index 0000000000000..4a564ee1e5578
--- /dev/null
+++ b/test/plugin_functional/plugins/doc_views_plugin/tsconfig.json
@@ -0,0 +1,14 @@
+{
+  "extends": "../../../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./target",
+    "skipLibCheck": true
+  },
+  "include": [
+    "index.ts",
+    "public/**/*.ts",
+    "public/**/*.tsx",
+    "../../../../typings/**/*"
+  ],
+  "exclude": []
+}
diff --git a/test/plugin_functional/test_suites/doc_views/doc_views.ts b/test/plugin_functional/test_suites/doc_views/doc_views.ts
new file mode 100644
index 0000000000000..8764f45c2c076
--- /dev/null
+++ b/test/plugin_functional/test_suites/doc_views/doc_views.ts
@@ -0,0 +1,57 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import expect from '@kbn/expect';
+import { PluginFunctionalProviderContext } from '../../services';
+
+// eslint-disable-next-line import/no-default-export
+export default function({ getService, getPageObjects }: PluginFunctionalProviderContext) {
+  const testSubjects = getService('testSubjects');
+  const find = getService('find');
+  const PageObjects = getPageObjects(['common', 'discover', 'timePicker']);
+
+  describe('custom doc views', function() {
+    before(async () => {
+      await PageObjects.common.navigateToApp('discover');
+      await PageObjects.timePicker.setDefaultAbsoluteRange();
+    });
+
+    it('should show custom doc views', async () => {
+      await testSubjects.click('docTableExpandToggleColumn');
+      const angularTab = await find.byButtonText('Angular doc view');
+      const reactTab = await find.byButtonText('React doc view');
+      expect(await angularTab.isDisplayed()).to.be(true);
+      expect(await reactTab.isDisplayed()).to.be(true);
+    });
+
+    it('should render angular doc view', async () => {
+      const angularTab = await find.byButtonText('Angular doc view');
+      await angularTab.click();
+      const angularContent = await testSubjects.find('angular-docview');
+      expect(await angularContent.getVisibleText()).to.be('logstash-2015.09.22');
+    });
+
+    it('should render react doc view', async () => {
+      const reactTab = await find.byButtonText('React doc view');
+      await reactTab.click();
+      const reactContent = await testSubjects.find('react-docview');
+      expect(await reactContent.getVisibleText()).to.be('logstash-2015.09.22');
+    });
+  });
+}
diff --git a/src/legacy/core_plugins/application_usage/index.ts b/test/plugin_functional/test_suites/doc_views/index.ts
similarity index 66%
rename from src/legacy/core_plugins/application_usage/index.ts
rename to test/plugin_functional/test_suites/doc_views/index.ts
index 752d6eaa19bb0..dee3a72e3f2c6 100644
--- a/src/legacy/core_plugins/application_usage/index.ts
+++ b/test/plugin_functional/test_suites/doc_views/index.ts
@@ -16,16 +16,16 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { PluginFunctionalProviderContext } from '../../services';
 
-import { Legacy } from '../../../../kibana';
-import { mappings } from './mappings';
+export default function({ getService, loadTestFile }: PluginFunctionalProviderContext) {
+  const esArchiver = getService('esArchiver');
 
-// eslint-disable-next-line import/no-default-export
-export default function ApplicationUsagePlugin(kibana: any) {
-  const config: Legacy.PluginSpecOptions = {
-    id: 'application_usage',
-    uiExports: { mappings }, // Needed to define the mappings for the SavedObjects
-  };
+  describe('doc views', function() {
+    before(async () => {
+      await esArchiver.loadIfNeeded('../functional/fixtures/es_archiver/discover');
+    });
 
-  return new kibana.Plugin(config);
+    loadTestFile(require.resolve('./doc_views'));
+  });
 }
diff --git a/test/tsconfig.json b/test/tsconfig.json
index 71c9e375a4124..285d3db64a874 100644
--- a/test/tsconfig.json
+++ b/test/tsconfig.json
@@ -14,9 +14,10 @@
     "**/*.ts",
     "**/*.tsx",
     "../typings/lodash.topath/*.ts",
+    "../typings/elastic__node_crypto.d.ts",
     "typings/**/*"
   ],
   "exclude": [
     "plugin_functional/plugins/**/*"
   ]
-}
\ No newline at end of file
+}
diff --git a/vars/githubPr.groovy b/vars/githubPr.groovy
index 0176424452d07..965fb1d4e108e 100644
--- a/vars/githubPr.groovy
+++ b/vars/githubPr.groovy
@@ -169,7 +169,20 @@ def getNextCommentMessage(previousCommentInfo = [:]) {
       ## :broken_heart: Build Failed
       * [continuous-integration/kibana-ci/pull-request](${env.BUILD_URL})
       * Commit: ${getCommitHash()}
+      * [Pipeline Steps](${env.BUILD_URL}flowGraphTable) (look for red circles / failed steps)
+      * [Interpreting CI Failures](https://www.elastic.co/guide/en/kibana/current/interpreting-ci-failures.html)
     """
+
+    try {
+      def steps = getFailedSteps()
+      if (steps?.size() > 0) {
+        def list = steps.collect { "* [${it.displayName}](${it.logs})" }.join("\n")
+        messages << "### Failed CI Steps\n${list}"
+      }
+    } catch (ex) {
+      buildUtils.printStacktrace(ex)
+      print "Error retrieving failed pipeline steps for PR comment, will skip this section"
+    }
   }
 
   messages << getTestFailuresMessage()
@@ -220,3 +233,9 @@ def deleteComment(commentId) {
 def getCommitHash() {
   return env.ghprbActualCommit
 }
+
+def getFailedSteps() {
+  return jenkinsApi.getFailedSteps()?.findAll { step ->
+    step.displayName != 'Check out from version control'
+  }
+}
diff --git a/vars/jenkinsApi.groovy b/vars/jenkinsApi.groovy
new file mode 100644
index 0000000000000..1ea4c3dd76b8d
--- /dev/null
+++ b/vars/jenkinsApi.groovy
@@ -0,0 +1,21 @@
+def getSteps() {
+  def url = "${env.BUILD_URL}api/json?tree=actions[nodes[iconColor,running,displayName,id,parents]]"
+  def responseRaw = httpRequest([ method: "GET", url: url ])
+  def response = toJSON(responseRaw)
+
+  def graphAction = response?.actions?.find { it._class == "org.jenkinsci.plugins.workflow.job.views.FlowGraphAction" }
+
+  return graphAction?.nodes
+}
+
+def getFailedSteps() {
+  def steps = getSteps()
+  def failedSteps = steps?.findAll { it.iconColor == "red" && it._class == "org.jenkinsci.plugins.workflow.cps.nodes.StepAtomNode" }
+  failedSteps.each { step ->
+    step.logs = "${env.BUILD_URL}execution/node/${step.id}/log".toString()
+  }
+
+  return failedSteps
+}
+
+return this
diff --git a/vars/prChanges.groovy b/vars/prChanges.groovy
index a9eb9027a0597..d7f46ee7be23e 100644
--- a/vars/prChanges.groovy
+++ b/vars/prChanges.groovy
@@ -1,3 +1,6 @@
+import groovy.transform.Field
+
+public static @Field PR_CHANGES_CACHE = null
 
 def getSkippablePaths() {
   return [
@@ -36,9 +39,13 @@ def areChangesSkippable() {
 }
 
 def getChanges() {
-  withGithubCredentials {
-    return githubPrs.getChanges(env.ghprbPullId)
+  if (!PR_CHANGES_CACHE && env.ghprbPullId) {
+    withGithubCredentials {
+      PR_CHANGES_CACHE = githubPrs.getChanges(env.ghprbPullId)
+    }
   }
+
+  return PR_CHANGES_CACHE
 }
 
 def getChangedFiles() {
diff --git a/vars/whenChanged.groovy b/vars/whenChanged.groovy
new file mode 100644
index 0000000000000..c58ec83f2b051
--- /dev/null
+++ b/vars/whenChanged.groovy
@@ -0,0 +1,57 @@
+/*
+  whenChanged('some/path') { yourCode() } can be used to execute pipeline code in PRs only when changes are detected on paths that you specify.
+  The specified code blocks will also always be executed during the non-PR jobs for tracked branches.
+
+  You have the option of passing in path prefixes, or regexes. Single or multiple.
+  Path specifications are NOT globby, they are only prefixes.
+  Specifying multiple will treat them as ORs.
+
+  Example Usages:
+    whenChanged('a/path/prefix/') { someCode() }
+    whenChanged(startsWith: 'a/path/prefix/') { someCode() } // Same as above
+    whenChanged(['prefix1/', 'prefix2/']) { someCode() }
+    whenChanged(regex: /\.test\.js$/) { someCode() }
+    whenChanged(regex: [/abc/, /xyz/]) { someCode() }
+*/
+
+def call(String startsWithString, Closure closure) {
+  return whenChanged([ startsWith: startsWithString ], closure)
+}
+
+def call(List<String> startsWithStrings, Closure closure) {
+  return whenChanged([ startsWith: startsWithStrings ], closure)
+}
+
+def call(Map params, Closure closure) {
+  if (!githubPr.isPr()) {
+    return closure()
+  }
+
+  def files = prChanges.getChangedFiles()
+  def hasMatch = false
+
+  if (params.regex) {
+    params.regex = [] + params.regex
+    print "Checking PR for changes that match: ${params.regex.join(', ')}"
+    hasMatch = !!files.find { file ->
+      params.regex.find { regex -> file =~ regex }
+    }
+  }
+
+  if (!hasMatch && params.startsWith) {
+    params.startsWith = [] + params.startsWith
+    print "Checking PR for changes that start with: ${params.startsWith.join(', ')}"
+    hasMatch = !!files.find { file ->
+      params.startsWith.find { str -> file.startsWith(str) }
+    }
+  }
+
+  if (hasMatch) {
+    print "Changes found, executing pipeline."
+    closure()
+  } else {
+    print "No changes found, skipping."
+  }
+}
+
+return this
diff --git a/x-pack/.i18nrc.json b/x-pack/.i18nrc.json
index a8bb989f6bff3..2a28e349ace99 100644
--- a/x-pack/.i18nrc.json
+++ b/x-pack/.i18nrc.json
@@ -30,6 +30,7 @@
     "xpack.ml": ["plugins/ml", "legacy/plugins/ml"],
     "xpack.monitoring": ["plugins/monitoring", "legacy/plugins/monitoring"],
     "xpack.remoteClusters": "plugins/remote_clusters",
+    "xpack.painlessLab": "plugins/painless_lab",
     "xpack.reporting": ["plugins/reporting", "legacy/plugins/reporting"],
     "xpack.rollupJobs": "legacy/plugins/rollup",
     "xpack.searchProfiler": "plugins/searchprofiler",
diff --git a/x-pack/legacy/plugins/apm/index.ts b/x-pack/legacy/plugins/apm/index.ts
index 0107997f233fe..d1f7ce325d23e 100644
--- a/x-pack/legacy/plugins/apm/index.ts
+++ b/x-pack/legacy/plugins/apm/index.ts
@@ -14,7 +14,13 @@ import mappings from './mappings.json';
 
 export const apm: LegacyPluginInitializer = kibana => {
   return new kibana.Plugin({
-    require: ['kibana', 'elasticsearch', 'xpack_main', 'apm_oss'],
+    require: [
+      'kibana',
+      'elasticsearch',
+      'xpack_main',
+      'apm_oss',
+      'task_manager'
+    ],
     id: 'apm',
     configPrefix: 'xpack.apm',
     publicDir: resolve(__dirname, 'public'),
@@ -71,7 +77,15 @@ export const apm: LegacyPluginInitializer = kibana => {
         autocreateApmIndexPattern: Joi.boolean().default(true),
 
         // service map
-        serviceMapEnabled: Joi.boolean().default(true)
+        serviceMapEnabled: Joi.boolean().default(true),
+        serviceMapFingerprintBucketSize: Joi.number().default(100),
+        serviceMapTraceIdBucketSize: Joi.number().default(65),
+        serviceMapFingerprintGlobalBucketSize: Joi.number().default(1000),
+        serviceMapTraceIdGlobalBucketSize: Joi.number().default(6),
+        serviceMapMaxTracesPerRequest: Joi.number().default(50),
+
+        // telemetry
+        telemetryCollectionEnabled: Joi.boolean().default(true)
       }).default();
     },
 
@@ -82,35 +96,50 @@ export const apm: LegacyPluginInitializer = kibana => {
         name: i18n.translate('xpack.apm.featureRegistry.apmFeatureName', {
           defaultMessage: 'APM'
         }),
+        order: 900,
         icon: 'apmApp',
         navLinkId: 'apm',
         app: ['apm', 'kibana'],
         catalogue: ['apm'],
+        // see x-pack/plugins/features/common/feature_kibana_privileges.ts
         privileges: {
           all: {
-            api: ['apm', 'apm_write'],
+            app: ['apm', 'kibana'],
+            api: ['apm', 'apm_write', 'actions-read', 'alerting-read'],
             catalogue: ['apm'],
             savedObject: {
-              all: [],
+              all: ['action', 'action_task_params'],
               read: []
             },
-            ui: ['show', 'save']
+            ui: [
+              'show',
+              'save',
+              'alerting:show',
+              'actions:show',
+              'alerting:save',
+              'actions:save',
+              'alerting:delete',
+              'actions:delete'
+            ]
           },
           read: {
-            api: ['apm'],
+            app: ['apm', 'kibana'],
+            api: ['apm', 'actions-read', 'alerting-read'],
             catalogue: ['apm'],
             savedObject: {
-              all: [],
+              all: ['action', 'action_task_params'],
               read: []
             },
-            ui: ['show']
+            ui: ['show', 'alerting:show', 'actions:show']
           }
         }
       });
-
       const apmPlugin = server.newPlatform.setup.plugins
         .apm as APMPluginContract;
-      apmPlugin.registerLegacyAPI({ server });
+
+      apmPlugin.registerLegacyAPI({
+        server
+      });
     }
   });
 };
diff --git a/x-pack/legacy/plugins/apm/mappings.json b/x-pack/legacy/plugins/apm/mappings.json
index 61bc90da28756..ba4c7a89ceaa8 100644
--- a/x-pack/legacy/plugins/apm/mappings.json
+++ b/x-pack/legacy/plugins/apm/mappings.json
@@ -1,20 +1,659 @@
 {
-  "apm-services-telemetry": {
+  "apm-telemetry": {
     "properties": {
+      "agents": {
+        "properties": {
+          "dotnet": {
+            "properties": {
+              "agent": {
+                "properties": {
+                  "version": {
+                    "type": "keyword",
+                    "ignore_above": 256
+                  }
+                }
+              },
+              "service": {
+                "properties": {
+                  "framework": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "language": {
+                    "properties": {
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "runtime": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "go": {
+            "properties": {
+              "agent": {
+                "properties": {
+                  "version": {
+                    "type": "keyword",
+                    "ignore_above": 256
+                  }
+                }
+              },
+              "service": {
+                "properties": {
+                  "framework": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "language": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "runtime": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "java": {
+            "properties": {
+              "agent": {
+                "properties": {
+                  "version": {
+                    "type": "keyword",
+                    "ignore_above": 256
+                  }
+                }
+              },
+              "service": {
+                "properties": {
+                  "framework": {
+                    "type": "object"
+                  },
+                  "language": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "runtime": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "js-base": {
+            "properties": {
+              "agent": {
+                "properties": {
+                  "version": {
+                    "type": "keyword",
+                    "ignore_above": 256
+                  }
+                }
+              },
+              "service": {
+                "properties": {
+                  "framework": {
+                    "type": "object"
+                  },
+                  "language": {
+                    "properties": {
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "runtime": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          },
+          "nodejs": {
+            "properties": {
+              "agent": {
+                "properties": {
+                  "version": {
+                    "type": "keyword",
+                    "ignore_above": 256
+                  }
+                }
+              },
+              "service": {
+                "properties": {
+                  "framework": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "language": {
+                    "properties": {
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "runtime": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "python": {
+            "properties": {
+              "agent": {
+                "properties": {
+                  "version": {
+                    "type": "keyword",
+                    "ignore_above": 256
+                  }
+                }
+              },
+              "service": {
+                "properties": {
+                  "framework": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "language": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "runtime": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "ruby": {
+            "properties": {
+              "agent": {
+                "properties": {
+                  "version": {
+                    "type": "keyword",
+                    "ignore_above": 256
+                  }
+                }
+              },
+              "service": {
+                "properties": {
+                  "framework": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "language": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  },
+                  "runtime": {
+                    "properties": {
+                      "composite": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "name": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      },
+                      "version": {
+                        "type": "keyword",
+                        "ignore_above": 256
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "rum-js": {
+            "properties": {
+              "agent": {
+                "type": "object"
+              },
+              "service": {
+                "properties": {
+                  "framework": {
+                    "type": "object"
+                  },
+                  "language": {
+                    "type": "object"
+                  },
+                  "runtime": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "counts": {
+        "properties": {
+          "agent_configuration": {
+            "properties": {
+              "all": {
+                "type": "long"
+              }
+            }
+          },
+          "error": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              },
+              "all": {
+                "type": "long"
+              }
+            }
+          },
+          "max_error_groups_per_service": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              }
+            }
+          },
+          "max_transaction_groups_per_service": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              }
+            }
+          },
+          "metric": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              },
+              "all": {
+                "type": "long"
+              }
+            }
+          },
+          "onboarding": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              },
+              "all": {
+                "type": "long"
+              }
+            }
+          },
+          "services": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              }
+            }
+          },
+          "sourcemap": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              },
+              "all": {
+                "type": "long"
+              }
+            }
+          },
+          "span": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              },
+              "all": {
+                "type": "long"
+              }
+            }
+          },
+          "traces": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              }
+            }
+          },
+          "transaction": {
+            "properties": {
+              "1d": {
+                "type": "long"
+              },
+              "all": {
+                "type": "long"
+              }
+            }
+          }
+        }
+      },
+      "cardinality": {
+        "properties": {
+          "user_agent": {
+            "properties": {
+              "original": {
+                "properties": {
+                  "all_agents": {
+                    "properties": {
+                      "1d": {
+                        "type": "long"
+                      }
+                    }
+                  },
+                  "rum": {
+                    "properties": {
+                      "1d": {
+                        "type": "long"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "transaction": {
+            "properties": {
+              "name": {
+                "properties": {
+                  "all_agents": {
+                    "properties": {
+                      "1d": {
+                        "type": "long"
+                      }
+                    }
+                  },
+                  "rum": {
+                    "properties": {
+                      "1d": {
+                        "type": "long"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
       "has_any_services": {
         "type": "boolean"
       },
+      "indices": {
+        "properties": {
+          "all": {
+            "properties": {
+              "total": {
+                "properties": {
+                  "docs": {
+                    "properties": {
+                      "count": {
+                        "type": "long"
+                      }
+                    }
+                  },
+                  "store": {
+                    "properties": {
+                      "size_in_bytes": {
+                        "type": "long"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "shards": {
+            "properties": {
+              "total": {
+                "type": "long"
+              }
+            }
+          }
+        }
+      },
+      "integrations": {
+        "properties": {
+          "ml": {
+            "properties": {
+              "all_jobs_count": {
+                "type": "long"
+              }
+            }
+          }
+        }
+      },
+      "retainment": {
+        "properties": {
+          "error": {
+            "properties": {
+              "ms": {
+                "type": "long"
+              }
+            }
+          },
+          "metric": {
+            "properties": {
+              "ms": {
+                "type": "long"
+              }
+            }
+          },
+          "onboarding": {
+            "properties": {
+              "ms": {
+                "type": "long"
+              }
+            }
+          },
+          "span": {
+            "properties": {
+              "ms": {
+                "type": "long"
+              }
+            }
+          },
+          "transaction": {
+            "properties": {
+              "ms": {
+                "type": "long"
+              }
+            }
+          }
+        }
+      },
       "services_per_agent": {
         "properties": {
-          "python": {
+          "dotnet": {
             "type": "long",
             "null_value": 0
           },
-          "java": {
+          "go": {
             "type": "long",
             "null_value": 0
           },
-          "nodejs": {
+          "java": {
             "type": "long",
             "null_value": 0
           },
@@ -22,11 +661,11 @@
             "type": "long",
             "null_value": 0
           },
-          "rum-js": {
+          "nodejs": {
             "type": "long",
             "null_value": 0
           },
-          "dotnet": {
+          "python": {
             "type": "long",
             "null_value": 0
           },
@@ -34,11 +673,131 @@
             "type": "long",
             "null_value": 0
           },
-          "go": {
+          "rum-js": {
             "type": "long",
             "null_value": 0
           }
         }
+      },
+      "tasks": {
+        "properties": {
+          "agent_configuration": {
+            "properties": {
+              "took": {
+                "properties": {
+                  "ms": {
+                    "type": "long"
+                  }
+                }
+              }
+            }
+          },
+          "agents": {
+            "properties": {
+              "took": {
+                "properties": {
+                  "ms": {
+                    "type": "long"
+                  }
+                }
+              }
+            }
+          },
+          "cardinality": {
+            "properties": {
+              "took": {
+                "properties": {
+                  "ms": {
+                    "type": "long"
+                  }
+                }
+              }
+            }
+          },
+          "groupings": {
+            "properties": {
+              "took": {
+                "properties": {
+                  "ms": {
+                    "type": "long"
+                  }
+                }
+              }
+            }
+          },
+          "indices_stats": {
+            "properties": {
+              "took": {
+                "properties": {
+                  "ms": {
+                    "type": "long"
+                  }
+                }
+              }
+            }
+          },
+          "integrations": {
+            "properties": {
+              "took": {
+                "properties": {
+                  "ms": {
+                    "type": "long"
+                  }
+                }
+              }
+            }
+          },
+          "processor_events": {
+            "properties": {
+              "took": {
+                "properties": {
+                  "ms": {
+                    "type": "long"
+                  }
+                }
+              }
+            }
+          },
+          "services": {
+            "properties": {
+              "took": {
+                "properties": {
+                  "ms": {
+                    "type": "long"
+                  }
+                }
+              }
+            }
+          },
+          "versions": {
+            "properties": {
+              "took": {
+                "properties": {
+                  "ms": {
+                    "type": "long"
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "version": {
+        "properties": {
+          "apm_server": {
+            "properties": {
+              "major": {
+                "type": "long"
+              },
+              "minor": {
+                "type": "long"
+              },
+              "patch": {
+                "type": "long"
+              }
+            }
+          }
+        }
       }
     }
   },
diff --git a/x-pack/legacy/plugins/apm/public/components/app/APMIndicesPermission/__test__/APMIndicesPermission.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/APMIndicesPermission/__test__/APMIndicesPermission.test.tsx
index c2c396d5b8951..68acaee4abe5d 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/APMIndicesPermission/__test__/APMIndicesPermission.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/APMIndicesPermission/__test__/APMIndicesPermission.test.tsx
@@ -11,9 +11,9 @@ import { APMIndicesPermission } from '../';
 import * as hooks from '../../../../hooks/useFetcher';
 import {
   expectTextsInDocument,
-  MockApmPluginContextWrapper,
   expectTextsNotInDocument
 } from '../../../../utils/testHelpers';
+import { MockApmPluginContextWrapper } from '../../../../context/ApmPluginContext/MockApmPluginContext';
 
 describe('APMIndicesPermission', () => {
   it('returns empty component when api status is loading', () => {
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ErrorGroupOverview/List/__test__/List.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/ErrorGroupOverview/List/__test__/List.test.tsx
index 68d19a41f33a4..a09482d663f65 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ErrorGroupOverview/List/__test__/List.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ErrorGroupOverview/List/__test__/List.test.tsx
@@ -9,25 +9,7 @@ import React from 'react';
 import { mockMoment, toJson } from '../../../../../utils/testHelpers';
 import { ErrorGroupList } from '../index';
 import props from './props.json';
-import { IUrlParams } from '../../../../../context/UrlParamsContext/types';
-import {
-  useUiFilters,
-  UrlParamsContext
-} from '../../../../../context/UrlParamsContext';
-
-const mockRefreshTimeRange = jest.fn();
-const MockUrlParamsProvider: React.FC<{
-  params?: IUrlParams;
-}> = ({ params = props.urlParams, children }) => (
-  <UrlParamsContext.Provider
-    value={{
-      urlParams: params,
-      refreshTimeRange: mockRefreshTimeRange,
-      uiFilters: useUiFilters(params)
-    }}
-    children={children}
-  />
-);
+import { MockUrlParamsContextProvider } from '../../../../../context/UrlParamsContext/MockUrlParamsContextProvider';
 
 describe('ErrorGroupOverview -> List', () => {
   beforeAll(() => {
@@ -37,9 +19,9 @@ describe('ErrorGroupOverview -> List', () => {
   it('should render empty state', () => {
     const storeState = {};
     const wrapper = mount(
-      <MockUrlParamsProvider>
+      <MockUrlParamsContextProvider>
         <ErrorGroupList items={[]} />
-      </MockUrlParamsProvider>,
+      </MockUrlParamsContextProvider>,
       storeState
     );
 
@@ -48,9 +30,9 @@ describe('ErrorGroupOverview -> List', () => {
 
   it('should render with data', () => {
     const wrapper = mount(
-      <MockUrlParamsProvider>
+      <MockUrlParamsContextProvider>
         <ErrorGroupList items={props.items} />
-      </MockUrlParamsProvider>
+      </MockUrlParamsContextProvider>
     );
 
     expect(toJson(wrapper)).toMatchSnapshot();
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ErrorGroupOverview/List/__test__/props.json b/x-pack/legacy/plugins/apm/public/components/app/ErrorGroupOverview/List/__test__/props.json
index 92198220628d1..431a6c71b103b 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ErrorGroupOverview/List/__test__/props.json
+++ b/x-pack/legacy/plugins/apm/public/components/app/ErrorGroupOverview/List/__test__/props.json
@@ -1,11 +1,4 @@
 {
-  "urlParams": {
-    "page": 0,
-    "serviceName": "opbeans-python",
-    "transactionType": "request",
-    "start": "2018-01-10T09:51:41.050Z",
-    "end": "2018-01-10T10:06:41.050Z"
-  },
   "items": [
     {
       "message": "About to blow up!",
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Home/Home.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/Home/Home.test.tsx
index 711290942cea1..ab4ca1dfbb49d 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Home/Home.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Home/Home.test.tsx
@@ -7,7 +7,7 @@
 import { shallow } from 'enzyme';
 import React from 'react';
 import { Home } from '../Home';
-import { MockApmPluginContextWrapper } from '../../../utils/testHelpers';
+import { MockApmPluginContextWrapper } from '../../../context/ApmPluginContext/MockApmPluginContext';
 
 describe('Home component', () => {
   it('should render services', () => {
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Main/UpdateBreadcrumbs.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/Main/UpdateBreadcrumbs.test.tsx
index 5bf8cb8271fa4..e610f3b84899b 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Main/UpdateBreadcrumbs.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Main/UpdateBreadcrumbs.test.tsx
@@ -8,12 +8,12 @@ import { mount } from 'enzyme';
 import React from 'react';
 import { MemoryRouter } from 'react-router-dom';
 import { ApmPluginContextValue } from '../../../context/ApmPluginContext';
-import {
-  mockApmPluginContextValue,
-  MockApmPluginContextWrapper
-} from '../../../utils/testHelpers';
 import { routes } from './route_config';
 import { UpdateBreadcrumbs } from './UpdateBreadcrumbs';
+import {
+  MockApmPluginContextWrapper,
+  mockApmPluginContextValue
+} from '../../../context/ApmPluginContext/MockApmPluginContext';
 
 const setBreadcrumbs = jest.fn();
 
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/index.tsx
index 2e737382c67a5..c87e56fe9eff6 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/index.tsx
@@ -23,6 +23,10 @@ import { resolveUrlParams } from '../../../../context/UrlParamsContext/resolveUr
 import { UNIDENTIFIED_SERVICE_NODES_LABEL } from '../../../../../../../../plugins/apm/common/i18n';
 import { TraceLink } from '../../TraceLink';
 import { CustomizeUI } from '../../Settings/CustomizeUI';
+import {
+  EditAgentConfigurationRouteHandler,
+  CreateAgentConfigurationRouteHandler
+} from './route_handlers/agent_configuration';
 
 const metricsBreadcrumb = i18n.translate('xpack.apm.breadcrumb.metricsTitle', {
   defaultMessage: 'Metrics'
@@ -101,12 +105,31 @@ export const routes: BreadcrumbRoute[] = [
     ),
     breadcrumb: i18n.translate(
       'xpack.apm.breadcrumb.settings.agentConfigurationTitle',
-      {
-        defaultMessage: 'Agent Configuration'
-      }
+      { defaultMessage: 'Agent Configuration' }
     ),
     name: RouteName.AGENT_CONFIGURATION
   },
+
+  {
+    exact: true,
+    path: '/settings/agent-configuration/create',
+    breadcrumb: i18n.translate(
+      'xpack.apm.breadcrumb.settings.createAgentConfigurationTitle',
+      { defaultMessage: 'Create Agent Configuration' }
+    ),
+    name: RouteName.AGENT_CONFIGURATION_CREATE,
+    component: () => <CreateAgentConfigurationRouteHandler />
+  },
+  {
+    exact: true,
+    path: '/settings/agent-configuration/edit',
+    breadcrumb: i18n.translate(
+      'xpack.apm.breadcrumb.settings.editAgentConfigurationTitle',
+      { defaultMessage: 'Edit Agent Configuration' }
+    ),
+    name: RouteName.AGENT_CONFIGURATION_EDIT,
+    component: () => <EditAgentConfigurationRouteHandler />
+  },
   {
     exact: true,
     path: '/services/:serviceName',
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/route_handlers/agent_configuration.tsx b/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/route_handlers/agent_configuration.tsx
new file mode 100644
index 0000000000000..58087f0d8be42
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/route_handlers/agent_configuration.tsx
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { useFetcher } from '../../../../../hooks/useFetcher';
+import { history } from '../../../../../utils/history';
+import { Settings } from '../../../Settings';
+import { AgentConfigurationCreateEdit } from '../../../Settings/AgentConfigurations/AgentConfigurationCreateEdit';
+import { toQuery } from '../../../../shared/Links/url_helpers';
+
+export function EditAgentConfigurationRouteHandler() {
+  const { search } = history.location;
+
+  // typescript complains because `pageStop` does not exist in `APMQueryParams`
+  // Going forward we should move away from globally declared query params and this is a first step
+  // @ts-ignore
+  const { name, environment, pageStep } = toQuery(search);
+
+  const res = useFetcher(
+    callApmApi => {
+      return callApmApi({
+        pathname: '/api/apm/settings/agent-configuration/view',
+        params: { query: { name, environment } }
+      });
+    },
+    [name, environment]
+  );
+
+  return (
+    <Settings>
+      <AgentConfigurationCreateEdit
+        pageStep={pageStep || 'choose-settings-step'}
+        existingConfigResult={res}
+      />
+    </Settings>
+  );
+}
+
+export function CreateAgentConfigurationRouteHandler() {
+  const { search } = history.location;
+
+  // Ignoring here because we specifically DO NOT want to add the query params to the global route handler
+  // @ts-ignore
+  const { pageStep } = toQuery(search);
+
+  return (
+    <Settings>
+      <AgentConfigurationCreateEdit
+        pageStep={pageStep || 'choose-service-step'}
+      />
+    </Settings>
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/route_names.tsx b/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/route_names.tsx
index db57e8356f39b..33a4990cb549e 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/route_names.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Main/route_config/route_names.tsx
@@ -20,6 +20,8 @@ export enum RouteName {
   TRANSACTION_NAME = 'transaction_name',
   SETTINGS = 'settings',
   AGENT_CONFIGURATION = 'agent_configuration',
+  AGENT_CONFIGURATION_CREATE = 'agent_configuration_create',
+  AGENT_CONFIGURATION_EDIT = 'agent_configuration_edit',
   INDICES = 'indices',
   SERVICE_NODES = 'nodes',
   LINK_TO_TRACE = 'link_to_trace',
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/AlertingFlyout/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/AlertingFlyout/index.tsx
new file mode 100644
index 0000000000000..7e8d057a7be6c
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/AlertingFlyout/index.tsx
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { AlertType } from '../../../../../../../../../plugins/apm/common/alert_types';
+import { AlertAdd } from '../../../../../../../../../plugins/triggers_actions_ui/public';
+
+type AlertAddProps = React.ComponentProps<typeof AlertAdd>;
+
+interface Props {
+  addFlyoutVisible: AlertAddProps['addFlyoutVisible'];
+  setAddFlyoutVisibility: AlertAddProps['setAddFlyoutVisibility'];
+  alertType: AlertType | null;
+}
+
+export function AlertingFlyout(props: Props) {
+  const { addFlyoutVisible, setAddFlyoutVisibility, alertType } = props;
+
+  return alertType ? (
+    <AlertAdd
+      addFlyoutVisible={addFlyoutVisible}
+      setAddFlyoutVisibility={setAddFlyoutVisibility}
+      consumer="apm"
+      alertTypeId={alertType}
+      canChangeTrigger={false}
+    />
+  ) : null;
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/index.tsx
new file mode 100644
index 0000000000000..92b325ab00d35
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/AlertIntegrations/index.tsx
@@ -0,0 +1,146 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  EuiButtonEmpty,
+  EuiContextMenu,
+  EuiPopover,
+  EuiContextMenuPanelDescriptor
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import React, { useState } from 'react';
+import { AlertType } from '../../../../../../../../plugins/apm/common/alert_types';
+import { AlertingFlyout } from './AlertingFlyout';
+import { useApmPluginContext } from '../../../../hooks/useApmPluginContext';
+
+const alertLabel = i18n.translate(
+  'xpack.apm.serviceDetails.alertsMenu.alerts',
+  {
+    defaultMessage: 'Alerts'
+  }
+);
+
+const createThresholdAlertLabel = i18n.translate(
+  'xpack.apm.serviceDetails.alertsMenu.createThresholdAlert',
+  {
+    defaultMessage: 'Create threshold alert'
+  }
+);
+
+const CREATE_THRESHOLD_ALERT_PANEL_ID = 'create_threshold';
+
+interface Props {
+  canReadAlerts: boolean;
+  canSaveAlerts: boolean;
+}
+
+export function AlertIntegrations(props: Props) {
+  const { canSaveAlerts, canReadAlerts } = props;
+
+  const plugin = useApmPluginContext();
+
+  const [popoverOpen, setPopoverOpen] = useState(false);
+
+  const [alertType, setAlertType] = useState<AlertType | null>(null);
+
+  const button = (
+    <EuiButtonEmpty
+      iconType="arrowDown"
+      iconSide="right"
+      onClick={() => setPopoverOpen(true)}
+    >
+      {i18n.translate('xpack.apm.serviceDetails.alertsMenu.alerts', {
+        defaultMessage: 'Alerts'
+      })}
+    </EuiButtonEmpty>
+  );
+
+  const panels: EuiContextMenuPanelDescriptor[] = [
+    {
+      id: 0,
+      title: alertLabel,
+      items: [
+        ...(canSaveAlerts
+          ? [
+              {
+                name: createThresholdAlertLabel,
+                panel: CREATE_THRESHOLD_ALERT_PANEL_ID,
+                icon: 'bell'
+              }
+            ]
+          : []),
+        ...(canReadAlerts
+          ? [
+              {
+                name: i18n.translate(
+                  'xpack.apm.serviceDetails.alertsMenu.viewActiveAlerts',
+                  {
+                    defaultMessage: 'View active alerts'
+                  }
+                ),
+                href: plugin.core.http.basePath.prepend(
+                  '/app/kibana#/management/kibana/triggersActions/alerts'
+                ),
+                icon: 'tableOfContents'
+              }
+            ]
+          : [])
+      ]
+    },
+    {
+      id: CREATE_THRESHOLD_ALERT_PANEL_ID,
+      title: createThresholdAlertLabel,
+      items: [
+        {
+          name: i18n.translate(
+            'xpack.apm.serviceDetails.alertsMenu.transactionDuration',
+            {
+              defaultMessage: 'Transaction duration'
+            }
+          ),
+          onClick: () => {
+            setAlertType(AlertType.TransactionDuration);
+          }
+        },
+        {
+          name: i18n.translate(
+            'xpack.apm.serviceDetails.alertsMenu.errorRate',
+            {
+              defaultMessage: 'Error rate'
+            }
+          ),
+          onClick: () => {
+            setAlertType(AlertType.ErrorRate);
+          }
+        }
+      ]
+    }
+  ];
+
+  return (
+    <>
+      <EuiPopover
+        id="integrations-menu"
+        button={button}
+        isOpen={popoverOpen}
+        closePopover={() => setPopoverOpen(false)}
+        panelPaddingSize="none"
+        anchorPosition="downRight"
+      >
+        <EuiContextMenu initialPanelId={0} panels={panels} />
+      </EuiPopover>
+      <AlertingFlyout
+        alertType={alertType}
+        addFlyoutVisible={!!alertType}
+        setAddFlyoutVisibility={visible => {
+          if (!visible) {
+            setAlertType(null);
+          }
+        }}
+      />
+    </>
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/index.tsx
index ac7dfd49d4f3d..77ae67b71e1b6 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceDetails/index.tsx
@@ -10,15 +10,27 @@ import { ApmHeader } from '../../shared/ApmHeader';
 import { ServiceDetailTabs } from './ServiceDetailTabs';
 import { ServiceIntegrations } from './ServiceIntegrations';
 import { useUrlParams } from '../../../hooks/useUrlParams';
+import { AlertIntegrations } from './AlertIntegrations';
+import { useApmPluginContext } from '../../../hooks/useApmPluginContext';
 
 interface Props {
   tab: React.ComponentProps<typeof ServiceDetailTabs>['tab'];
 }
 
 export function ServiceDetails({ tab }: Props) {
+  const plugin = useApmPluginContext();
   const { urlParams } = useUrlParams();
   const { serviceName } = urlParams;
 
+  const canReadAlerts = !!plugin.core.application.capabilities.apm[
+    'alerting:show'
+  ];
+  const canSaveAlerts = !!plugin.core.application.capabilities.apm[
+    'alerting:save'
+  ];
+
+  const isAlertingAvailable = canReadAlerts || canSaveAlerts;
+
   return (
     <div>
       <ApmHeader>
@@ -31,6 +43,14 @@ export function ServiceDetails({ tab }: Props) {
           <EuiFlexItem grow={false}>
             <ServiceIntegrations urlParams={urlParams} />
           </EuiFlexItem>
+          {isAlertingAvailable && (
+            <EuiFlexItem grow={false}>
+              <AlertIntegrations
+                canReadAlerts={canReadAlerts}
+                canSaveAlerts={canSaveAlerts}
+              />
+            </EuiFlexItem>
+          )}
         </EuiFlexGroup>
       </ApmHeader>
 
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.stories.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.stories.tsx
index 155695f7596dd..46754c8c7cb6b 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.stories.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.stories.tsx
@@ -77,6 +77,14 @@ storiesOf('app/ServiceMap/Cytoscape', module)
         { data: { id: 'default' } },
         { data: { id: 'cache', label: 'cache', 'span.type': 'cache' } },
         { data: { id: 'database', label: 'database', 'span.type': 'db' } },
+        {
+          data: {
+            id: 'elasticsearch',
+            label: 'elasticsearch',
+            'span.type': 'db',
+            'span.subtype': 'elasticsearch'
+          }
+        },
         {
           data: { id: 'external', label: 'external', 'span.type': 'external' }
         },
@@ -186,6 +194,7 @@ storiesOf('app/ServiceMap/Cytoscape', module)
       const height = 640;
       const width = 1340;
       const serviceName = undefined; // global service map
+
       return (
         <Cytoscape
           elements={elementsFromResponses}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx
index 3197c269fd90c..a4cd6f4ed09a9 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Cytoscape.tsx
@@ -9,7 +9,6 @@ import React, {
   createContext,
   CSSProperties,
   ReactNode,
-  useCallback,
   useEffect,
   useRef,
   useState
@@ -57,6 +56,20 @@ function useCytoscape(options: cytoscape.CytoscapeOptions) {
   return [ref, cy] as [React.MutableRefObject<any>, cytoscape.Core | undefined];
 }
 
+function rotatePoint(
+  { x, y }: { x: number; y: number },
+  degreesRotated: number
+) {
+  const radiansPerDegree = Math.PI / 180;
+  const θ = radiansPerDegree * degreesRotated;
+  const cosθ = Math.cos(θ);
+  const sinθ = Math.sin(θ);
+  return {
+    x: x * cosθ - y * sinθ,
+    y: x * sinθ + y * cosθ
+  };
+}
+
 function getLayoutOptions(
   selectedRoots: string[],
   height: number,
@@ -71,10 +84,11 @@ function getLayoutOptions(
     animate: true,
     animationEasing: animationOptions.easing,
     animationDuration: animationOptions.duration,
-    // Rotate nodes from top -> bottom to display left -> right
     // @ts-ignore
-    transform: (node: any, { x, y }: cytoscape.Position) => ({ x: y, y: -x }),
-    // swap width/height of boundingBox to compensation for the rotation
+    // Rotate nodes counter-clockwise to transform layout from top→bottom to left→right.
+    // The extra 5° achieves the effect of separating overlapping taxi-styled edges.
+    transform: (node: any, pos: cytoscape.Position) => rotatePoint(pos, -95),
+    // swap width/height of boundingBox to compensate for the rotation
     boundingBox: { x1: 0, y1: 0, w: height, h: width }
   };
 }
@@ -94,59 +108,18 @@ export function Cytoscape({
   serviceName,
   style
 }: CytoscapeProps) {
-  const initialElements = elements.map(element => ({
-    ...element,
-    // prevents flash of unstyled elements
-    classes: [element.classes, 'invisible'].join(' ').trim()
-  }));
-
   const [ref, cy] = useCytoscape({
     ...cytoscapeOptions,
-    elements: initialElements
+    elements
   });
 
   // Add the height to the div style. The height is a separate prop because it
   // is required and can trigger rendering when changed.
   const divStyle = { ...style, height };
 
-  const dataHandler = useCallback<cytoscape.EventHandler>(
-    event => {
-      if (cy) {
-        cy.edges().removeClass('highlight');
-
-        if (serviceName) {
-          const focusedNode = cy.getElementById(serviceName);
-          focusedNode.connectedEdges().addClass('highlight');
-        }
-
-        // Add the "primary" class to the node if its id matches the serviceName.
-        if (cy.nodes().length > 0 && serviceName) {
-          cy.nodes().removeClass('primary');
-          cy.getElementById(serviceName).addClass('primary');
-        }
-        if (event.cy.elements().length > 0) {
-          const selectedRoots = selectRoots(event.cy);
-          const layout = cy.layout(
-            getLayoutOptions(selectedRoots, height, width)
-          );
-          layout.one('layoutstop', () => {
-            if (serviceName) {
-              const focusedNode = cy.getElementById(serviceName);
-              cy.center(focusedNode);
-            }
-            // show elements after layout is applied
-            cy.elements().removeClass('invisible');
-          });
-          layout.run();
-        }
-      }
-    },
-    [cy, serviceName, height, width]
-  );
-
   // Trigger a custom "data" event when data changes
   useEffect(() => {
-    if (cy) {
+    if (cy && elements.length > 0) {
       cy.add(elements);
       cy.trigger('data');
     }
@@ -154,6 +127,47 @@ export function Cytoscape({
 
   // Set up cytoscape event handlers
   useEffect(() => {
+    const resetConnectedEdgeStyle = (node?: cytoscape.NodeSingular) => {
+      if (cy) {
+        cy.edges().removeClass('highlight');
+
+        if (node) {
+          node.connectedEdges().addClass('highlight');
+        }
+      }
+    };
+
+    const dataHandler: cytoscape.EventHandler = event => {
+      if (cy) {
+        if (serviceName) {
+          resetConnectedEdgeStyle(cy.getElementById(serviceName));
+          // Add the "primary" class to the node if its id matches the serviceName.
+          if (cy.nodes().length > 0) {
+            cy.nodes().removeClass('primary');
+            cy.getElementById(serviceName).addClass('primary');
+          }
+        } else {
+          resetConnectedEdgeStyle();
+        }
+
+        const selectedRoots = selectRoots(event.cy);
+        const layout = cy.layout(
+          getLayoutOptions(selectedRoots, height, width)
+        );
+
+        layout.run();
+      }
+    };
+    const layoutstopHandler: cytoscape.EventHandler = event => {
+      event.cy.animate({
+        ...animationOptions,
+        center: {
+          eles: serviceName
+            ? event.cy.getElementById(serviceName)
+            : event.cy.collection()
+        }
+      });
+    };
     const mouseoverHandler: cytoscape.EventHandler = event => {
       event.target.addClass('hover');
       event.target.connectedEdges().addClass('nodeHover');
@@ -162,26 +176,46 @@ export function Cytoscape({
       event.target.removeClass('hover');
       event.target.connectedEdges().removeClass('nodeHover');
     };
+    const selectHandler: cytoscape.EventHandler = event => {
+      resetConnectedEdgeStyle(event.target);
+    };
+    const unselectHandler: cytoscape.EventHandler = event => {
+      resetConnectedEdgeStyle();
+    };
+    const debugHandler: cytoscape.EventHandler = event => {
+      const debugEnabled = sessionStorage.getItem('apm_debug') === 'true';
+      if (debugEnabled) {
+        // eslint-disable-next-line no-console
+        console.debug('cytoscape:', event);
+      }
+    };
 
     if (cy) {
+      cy.on('data layoutstop select unselect', debugHandler);
       cy.on('data', dataHandler);
-      cy.ready(dataHandler);
+      cy.on('layoutstop', layoutstopHandler);
       cy.on('mouseover', 'edge, node', mouseoverHandler);
       cy.on('mouseout', 'edge, node', mouseoutHandler);
+      cy.on('select', 'node', selectHandler);
+      cy.on('unselect', 'node', unselectHandler);
     }
 
     return () => {
       if (cy) {
         cy.removeListener(
-          'data',
+          'data layoutstop select unselect',
           undefined,
-          dataHandler as cytoscape.EventHandler
+          debugHandler
         );
+        cy.removeListener('data', undefined, dataHandler);
+        cy.removeListener('layoutstop', undefined, layoutstopHandler);
         cy.removeListener('mouseover', 'edge, node', mouseoverHandler);
         cy.removeListener('mouseout', 'edge, node', mouseoutHandler);
+        cy.removeListener('select', 'node', selectHandler);
+        cy.removeListener('unselect', 'node', unselectHandler);
       }
     };
-  }, [cy, dataHandler, serviceName]);
+  }, [cy, height, serviceName, width]);
 
   return (
     <CytoscapeContext.Provider value={cy}>
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/EmptyBanner.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/EmptyBanner.test.tsx
index d61dea80666a0..f05ff0246b9e4 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/EmptyBanner.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/EmptyBanner.test.tsx
@@ -7,9 +7,9 @@
 import { act, render, wait } from '@testing-library/react';
 import cytoscape from 'cytoscape';
 import React, { FunctionComponent } from 'react';
-import { MockApmPluginContextWrapper } from '../../../utils/testHelpers';
 import { CytoscapeContext } from './Cytoscape';
 import { EmptyBanner } from './EmptyBanner';
+import { MockApmPluginContextWrapper } from '../../../context/ApmPluginContext/MockApmPluginContext';
 
 const cy = cytoscape({});
 
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/PlatinumLicensePrompt.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/PlatinumLicensePrompt.tsx
deleted file mode 100644
index 77f0b64ba0fb1..0000000000000
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/PlatinumLicensePrompt.tsx
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  EuiButton,
-  EuiPanel,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiTitle,
-  EuiText,
-  EuiSpacer
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import React from 'react';
-import { invalidLicenseMessage } from '../../../../../../../plugins/apm/common/service_map';
-import { useKibanaUrl } from '../../../hooks/useKibanaUrl';
-
-export function PlatinumLicensePrompt() {
-  // Set the height to give it some top margin
-  const flexGroupStyle = { height: '60vh' };
-  const flexItemStyle = { width: 600, textAlign: 'center' as const };
-
-  const licensePageUrl = useKibanaUrl(
-    '/app/kibana',
-    '/management/elasticsearch/license_management/home'
-  );
-
-  return (
-    <EuiFlexGroup
-      alignItems="center"
-      justifyContent="spaceAround"
-      style={flexGroupStyle}
-    >
-      <EuiFlexItem grow={false} style={flexItemStyle}>
-        <EuiPanel grow={false} hasShadow={true} paddingSize="none">
-          <EuiPanel
-            betaBadgeLabel={i18n.translate('xpack.apm.serviceMap.betaBadge', {
-              defaultMessage: 'Beta'
-            })}
-            betaBadgeTooltipContent={i18n.translate(
-              'xpack.apm.serviceMap.betaTooltipMessage',
-              {
-                defaultMessage:
-                  'This feature is currently in beta. If you encounter any bugs or have feedback, please open an issue or visit our discussion forum.'
-              }
-            )}
-          >
-            <EuiSpacer size="l" />
-            <EuiTitle>
-              <h2>
-                {i18n.translate('xpack.apm.serviceMap.licensePromptTitle', {
-                  defaultMessage: 'Service maps is available in Platinum.'
-                })}
-              </h2>
-            </EuiTitle>
-            <EuiSpacer size="m" />
-            <EuiText grow={false}>
-              <p>{invalidLicenseMessage}</p>
-            </EuiText>
-            <EuiSpacer size="l" />
-            <EuiButton href={licensePageUrl} fill={true}>
-              {i18n.translate('xpack.apm.serviceMap.licensePromptButtonText', {
-                defaultMessage: 'Start 30-day Platinum trial'
-              })}
-            </EuiButton>
-          </EuiPanel>
-        </EuiPanel>
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
-}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
index 35f68b84fabed..a9cc6457b4e31 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/Popover/index.tsx
@@ -17,6 +17,7 @@ import React, {
 import { SERVICE_NAME } from '../../../../../../../../plugins/apm/common/elasticsearch_fieldnames';
 import { CytoscapeContext } from '../Cytoscape';
 import { Contents } from './Contents';
+import { animationOptions } from '../cytoscapeOptions';
 
 interface PopoverProps {
   focusedServiceName?: string;
@@ -89,7 +90,10 @@ export function Popover({ focusedServiceName }: PopoverProps) {
 
   const centerSelectedNode = useCallback(() => {
     if (cy) {
-      cy.center(cy.getElementById(selectedNodeServiceName));
+      cy.animate({
+        ...animationOptions,
+        center: { eles: cy.getElementById(selectedNodeServiceName) }
+      });
     }
   }, [cy, selectedNodeServiceName]);
 
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts
index 30b36b58cb001..413458f336e6f 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/cytoscapeOptions.ts
@@ -7,8 +7,8 @@ import theme from '@elastic/eui/dist/eui_theme_light.json';
 import cytoscape from 'cytoscape';
 import { CSSProperties } from 'react';
 import {
-  DESTINATION_ADDRESS,
-  SERVICE_NAME
+  SERVICE_NAME,
+  SPAN_DESTINATION_SERVICE_RESOURCE
 } from '../../../../../../../plugins/apm/common/elasticsearch_fieldnames';
 import { defaultIcon, iconForNode } from './icons';
 
@@ -59,7 +59,9 @@ const style: cytoscape.Stylesheet[] = [
       'ghost-opacity': 0.15,
       height: nodeHeight,
       label: (el: cytoscape.NodeSingular) =>
-        isService(el) ? el.data(SERVICE_NAME) : el.data(DESTINATION_ADDRESS),
+        isService(el)
+          ? el.data(SERVICE_NAME)
+          : el.data(SPAN_DESTINATION_SERVICE_RESOURCE),
       'min-zoomed-font-size': theme.euiSizeL,
       'overlay-opacity': 0,
       shape: (el: cytoscape.NodeSingular) =>
@@ -113,23 +115,21 @@ const style: cytoscape.Stylesheet[] = [
     selector: 'edge[isInverseEdge]',
     style: { visibility: 'hidden' }
   },
-  // @ts-ignore
-  {
-    selector: '.invisible',
-    style: { visibility: 'hidden' }
-  },
   {
     selector: 'edge.nodeHover',
     style: {
-      width: 4,
+      width: 2,
       // @ts-ignore
-      'z-index': zIndexEdgeHover
+      'z-index': zIndexEdgeHover,
+      'line-color': theme.euiColorDarkShade,
+      'source-arrow-color': theme.euiColorDarkShade,
+      'target-arrow-color': theme.euiColorDarkShade
     }
   },
   {
     selector: 'node.hover',
     style: {
-      'border-width': 4
+      'border-width': 2
     }
   },
   {
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons.ts b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons.ts
index 5102dfc02f757..4925ffba310b5 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons.ts
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons.ts
@@ -8,12 +8,14 @@ import cytoscape from 'cytoscape';
 import {
   AGENT_NAME,
   SERVICE_NAME,
-  SPAN_TYPE
+  SPAN_TYPE,
+  SPAN_SUBTYPE
 } from '../../../../../../../plugins/apm/common/elasticsearch_fieldnames';
 import databaseIcon from './icons/database.svg';
 import defaultIconImport from './icons/default.svg';
 import documentsIcon from './icons/documents.svg';
 import dotNetIcon from './icons/dot-net.svg';
+import elasticsearchIcon from './icons/elasticsearch.svg';
 import globeIcon from './icons/globe.svg';
 import goIcon from './icons/go.svg';
 import javaIcon from './icons/java.svg';
@@ -63,6 +65,11 @@ export function iconForNode(node: cytoscape.NodeSingular) {
     return serviceIcons[node.data(AGENT_NAME) as string];
   } else if (isIE11) {
     return defaultIcon;
+  } else if (
+    node.data(SPAN_TYPE) === 'db' &&
+    node.data(SPAN_SUBTYPE) === 'elasticsearch'
+  ) {
+    return elasticsearchIcon;
   } else if (icons[type]) {
     return icons[type];
   } else {
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons/elasticsearch.svg b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons/elasticsearch.svg
new file mode 100644
index 0000000000000..4f9fda36ba06a
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/icons/elasticsearch.svg
@@ -0,0 +1 @@
+<svg width="32" height="32" viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg" class="euiIcon euiIcon--xLarge euiIcon-isLoaded" focusable="false" role="img" aria-hidden="true"><g fill="black" fill-rule="evenodd"><path class="euiIcon__fillNegative" d="M2 16c0 1.384.194 2.72.524 4H22a4 4 0 000-8H2.524A15.984 15.984 0 002 16"></path><path fill="#FEC514" d="M28.924 7.662A15.381 15.381 0 0030.48 6C27.547 2.346 23.05 0 18 0 11.679 0 6.239 3.678 3.644 9H25.51a5.039 5.039 0 003.413-1.338"></path><path fill="#00BFB3" d="M25.51 23H3.645C6.24 28.323 11.679 32 18 32c5.05 0 9.547-2.346 12.48-6a15.381 15.381 0 00-1.556-1.662A5.034 5.034 0 0025.51 23"></path></g></svg>
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/index.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/index.test.tsx
index 926f53954e7c6..d93caa601f0b6 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/index.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/index.test.tsx
@@ -8,8 +8,8 @@ import { render } from '@testing-library/react';
 import React, { FunctionComponent } from 'react';
 import { License } from '../../../../../../../plugins/licensing/common/license';
 import { LicenseContext } from '../../../context/LicenseContext';
-import { MockApmPluginContextWrapper } from '../../../utils/testHelpers';
 import { ServiceMap } from './';
+import { MockApmPluginContextWrapper } from '../../../context/ApmPluginContext/MockApmPluginContext';
 
 const expiredLicense = new License({
   signature: 'test signature',
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/index.tsx
index 5770771e01905..715e4d172adcd 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/index.tsx
@@ -3,20 +3,23 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
-import theme from '@elastic/eui/dist/eui_theme_light.json';
 import React from 'react';
-import { isValidPlatinumLicense } from '../../../../../../../plugins/apm/common/service_map';
+import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import theme from '@elastic/eui/dist/eui_theme_light.json';
+import {
+  invalidLicenseMessage,
+  isValidPlatinumLicense
+} from '../../../../../../../plugins/apm/common/service_map';
 import { useFetcher } from '../../../hooks/useFetcher';
 import { useLicense } from '../../../hooks/useLicense';
 import { useUrlParams } from '../../../hooks/useUrlParams';
 import { callApmApi } from '../../../services/rest/createCallApmApi';
 import { BetaBadge } from './BetaBadge';
+import { LicensePrompt } from '../../shared/LicensePrompt';
 import { Controls } from './Controls';
 import { Cytoscape } from './Cytoscape';
 import { cytoscapeDivStyle } from './cytoscapeOptions';
 import { EmptyBanner } from './EmptyBanner';
-import { PlatinumLicensePrompt } from './PlatinumLicensePrompt';
 import { Popover } from './Popover';
 import { useRefDimensions } from './useRefDimensions';
 
@@ -74,6 +77,18 @@ export function ServiceMap({ serviceName }: ServiceMapProps) {
       </Cytoscape>
     </div>
   ) : (
-    <PlatinumLicensePrompt />
+    <EuiFlexGroup
+      alignItems="center"
+      justifyContent="spaceAround"
+      // Set the height to give it some top margin
+      style={{ height: '60vh' }}
+    >
+      <EuiFlexItem
+        grow={false}
+        style={{ width: 600, textAlign: 'center' as const }}
+      >
+        <LicensePrompt text={invalidLicenseMessage} showBetaBadge />
+      </EuiFlexItem>
+    </EuiFlexGroup>
   );
 }
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceNodeMetrics/index.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceNodeMetrics/index.test.tsx
index 0ec9e90a31659..eced7457318d8 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceNodeMetrics/index.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceNodeMetrics/index.test.tsx
@@ -7,7 +7,7 @@
 import React from 'react';
 import { shallow } from 'enzyme';
 import { ServiceNodeMetrics } from '.';
-import { MockApmPluginContextWrapper } from '../../../utils/testHelpers';
+import { MockApmPluginContextWrapper } from '../../../context/ApmPluginContext/MockApmPluginContext';
 
 describe('ServiceNodeMetrics', () => {
   describe('render', () => {
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceOverview/__test__/ServiceOverview.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/ServiceOverview/__test__/ServiceOverview.test.tsx
index 241f272b54a1d..b286d33ca74e9 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceOverview/__test__/ServiceOverview.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/ServiceOverview/__test__/ServiceOverview.test.tsx
@@ -11,11 +11,11 @@ import * as urlParamsHooks from '../../../../hooks/useUrlParams';
 import * as useLocalUIFilters from '../../../../hooks/useLocalUIFilters';
 import { FETCH_STATUS } from '../../../../hooks/useFetcher';
 import { SessionStorageMock } from '../../../../services/__test__/SessionStorageMock';
+import { ApmPluginContextValue } from '../../../../context/ApmPluginContext';
 import {
   MockApmPluginContextWrapper,
   mockApmPluginContextValue
-} from '../../../../utils/testHelpers';
-import { ApmPluginContextValue } from '../../../../context/ApmPluginContext';
+} from '../../../../context/ApmPluginContext/MockApmPluginContext';
 
 jest.mock('ui/new_platform');
 
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/DeleteButton.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/DeleteButton.tsx
deleted file mode 100644
index 997df371b51ed..0000000000000
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/DeleteButton.tsx
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { useState } from 'react';
-import { EuiButtonEmpty } from '@elastic/eui';
-import { NotificationsStart } from 'kibana/public';
-import { i18n } from '@kbn/i18n';
-import { Config } from '../index';
-import { getOptionLabel } from '../../../../../../../../../plugins/apm/common/agent_configuration_constants';
-import { callApmApi } from '../../../../../services/rest/createCallApmApi';
-import { useApmPluginContext } from '../../../../../hooks/useApmPluginContext';
-
-interface Props {
-  onDeleted: () => void;
-  selectedConfig: Config;
-}
-
-export function DeleteButton({ onDeleted, selectedConfig }: Props) {
-  const [isDeleting, setIsDeleting] = useState(false);
-  const { toasts } = useApmPluginContext().core.notifications;
-
-  return (
-    <EuiButtonEmpty
-      color="danger"
-      isLoading={isDeleting}
-      iconSide="right"
-      onClick={async () => {
-        setIsDeleting(true);
-        await deleteConfig(selectedConfig, toasts);
-        setIsDeleting(false);
-        onDeleted();
-      }}
-    >
-      {i18n.translate(
-        'xpack.apm.settings.agentConf.flyout.deleteSection.buttonLabel',
-        { defaultMessage: 'Delete' }
-      )}
-    </EuiButtonEmpty>
-  );
-}
-
-async function deleteConfig(
-  selectedConfig: Config,
-  toasts: NotificationsStart['toasts']
-) {
-  try {
-    await callApmApi({
-      pathname: '/api/apm/settings/agent-configuration',
-      method: 'DELETE',
-      params: {
-        body: {
-          service: {
-            name: selectedConfig.service.name,
-            environment: selectedConfig.service.environment
-          }
-        }
-      }
-    });
-
-    toasts.addSuccess({
-      title: i18n.translate(
-        'xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigSucceededTitle',
-        { defaultMessage: 'Configuration was deleted' }
-      ),
-      text: i18n.translate(
-        'xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigSucceededText',
-        {
-          defaultMessage:
-            'You have successfully deleted a configuration for "{serviceName}". It will take some time to propagate to the agents.',
-          values: { serviceName: getOptionLabel(selectedConfig.service.name) }
-        }
-      )
-    });
-  } catch (error) {
-    toasts.addDanger({
-      title: i18n.translate(
-        'xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigFailedTitle',
-        { defaultMessage: 'Configuration could not be deleted' }
-      ),
-      text: i18n.translate(
-        'xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigFailedText',
-        {
-          defaultMessage:
-            'Something went wrong when deleting a configuration for "{serviceName}". Error: "{errorMessage}"',
-          values: {
-            serviceName: getOptionLabel(selectedConfig.service.name),
-            errorMessage: error.message
-          }
-        }
-      )
-    });
-  }
-}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/ServiceSection.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/ServiceSection.tsx
deleted file mode 100644
index 537bdace50e24..0000000000000
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/ServiceSection.tsx
+++ /dev/null
@@ -1,159 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { EuiTitle, EuiSpacer, EuiFormRow, EuiText } from '@elastic/eui';
-import React from 'react';
-import { i18n } from '@kbn/i18n';
-import {
-  omitAllOption,
-  getOptionLabel
-} from '../../../../../../../../../plugins/apm/common/agent_configuration_constants';
-import { useFetcher } from '../../../../../hooks/useFetcher';
-import { SelectWithPlaceholder } from '../../../../shared/SelectWithPlaceholder';
-
-const SELECT_PLACEHOLDER_LABEL = `- ${i18n.translate(
-  'xpack.apm.settings.agentConf.flyOut.serviceSection.selectPlaceholder',
-  { defaultMessage: 'Select' }
-)} -`;
-
-interface Props {
-  isReadOnly: boolean;
-  serviceName: string;
-  onServiceNameChange: (env: string) => void;
-  environment: string;
-  onEnvironmentChange: (env: string) => void;
-}
-
-export function ServiceSection({
-  isReadOnly,
-  serviceName,
-  onServiceNameChange,
-  environment,
-  onEnvironmentChange
-}: Props) {
-  const { data: serviceNames = [], status: serviceNamesStatus } = useFetcher(
-    callApmApi => {
-      if (!isReadOnly) {
-        return callApmApi({
-          pathname: '/api/apm/settings/agent-configuration/services',
-          forceCache: true
-        });
-      }
-    },
-    [isReadOnly],
-    { preservePreviousData: false }
-  );
-  const { data: environments = [], status: environmentStatus } = useFetcher(
-    callApmApi => {
-      if (!isReadOnly && serviceName) {
-        return callApmApi({
-          pathname: '/api/apm/settings/agent-configuration/environments',
-          params: { query: { serviceName: omitAllOption(serviceName) } }
-        });
-      }
-    },
-    [isReadOnly, serviceName],
-    { preservePreviousData: false }
-  );
-
-  const ALREADY_CONFIGURED_TRANSLATED = i18n.translate(
-    'xpack.apm.settings.agentConf.flyOut.serviceSection.alreadyConfiguredOption',
-    { defaultMessage: 'already configured' }
-  );
-
-  const serviceNameOptions = serviceNames.map(name => ({
-    text: getOptionLabel(name),
-    value: name
-  }));
-  const environmentOptions = environments.map(
-    ({ name, alreadyConfigured }) => ({
-      disabled: alreadyConfigured,
-      text: `${getOptionLabel(name)} ${
-        alreadyConfigured ? `(${ALREADY_CONFIGURED_TRANSLATED})` : ''
-      }`,
-      value: name
-    })
-  );
-
-  return (
-    <>
-      <EuiTitle size="xs">
-        <h3>
-          {i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.serviceSection.title',
-            { defaultMessage: 'Service' }
-          )}
-        </h3>
-      </EuiTitle>
-
-      <EuiSpacer size="m" />
-
-      <EuiFormRow
-        label={i18n.translate(
-          'xpack.apm.settings.agentConf.flyOut.serviceSection.serviceNameSelectLabel',
-          { defaultMessage: 'Name' }
-        )}
-        helpText={
-          !isReadOnly &&
-          i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.serviceSection.serviceNameSelectHelpText',
-            { defaultMessage: 'Choose the service you want to configure.' }
-          )
-        }
-      >
-        {isReadOnly ? (
-          <EuiText>{getOptionLabel(serviceName)}</EuiText>
-        ) : (
-          <SelectWithPlaceholder
-            placeholder={SELECT_PLACEHOLDER_LABEL}
-            isLoading={serviceNamesStatus === 'loading'}
-            options={serviceNameOptions}
-            value={serviceName}
-            disabled={serviceNamesStatus === 'loading'}
-            onChange={e => {
-              e.preventDefault();
-              onServiceNameChange(e.target.value);
-              onEnvironmentChange('');
-            }}
-          />
-        )}
-      </EuiFormRow>
-
-      <EuiFormRow
-        label={i18n.translate(
-          'xpack.apm.settings.agentConf.flyOut.serviceSection.serviceEnvironmentSelectLabel',
-          { defaultMessage: 'Environment' }
-        )}
-        helpText={
-          !isReadOnly &&
-          i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.serviceSection.serviceEnvironmentSelectHelpText',
-            {
-              defaultMessage:
-                'Only a single environment per configuration is supported.'
-            }
-          )
-        }
-      >
-        {isReadOnly ? (
-          <EuiText>{getOptionLabel(environment)}</EuiText>
-        ) : (
-          <SelectWithPlaceholder
-            placeholder={SELECT_PLACEHOLDER_LABEL}
-            isLoading={environmentStatus === 'loading'}
-            options={environmentOptions}
-            value={environment}
-            disabled={!serviceName || environmentStatus === 'loading'}
-            onChange={e => {
-              e.preventDefault();
-              onEnvironmentChange(e.target.value);
-            }}
-          />
-        )}
-      </EuiFormRow>
-    </>
-  );
-}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/SettingsSection.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/SettingsSection.tsx
deleted file mode 100644
index 24c8222d4cd99..0000000000000
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/SettingsSection.tsx
+++ /dev/null
@@ -1,174 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import {
-  EuiFormRow,
-  EuiFieldText,
-  EuiTitle,
-  EuiSpacer,
-  EuiFieldNumber
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { isEmpty } from 'lodash';
-import { SelectWithPlaceholder } from '../../../../shared/SelectWithPlaceholder';
-
-interface Props {
-  isRumService: boolean;
-
-  // sampleRate
-  sampleRate: string;
-  setSampleRate: (value: string) => void;
-  isSampleRateValid?: boolean;
-
-  // captureBody
-  captureBody: string;
-  setCaptureBody: (value: string) => void;
-
-  // transactionMaxSpans
-  transactionMaxSpans: string;
-  setTransactionMaxSpans: (value: string) => void;
-  isTransactionMaxSpansValid?: boolean;
-}
-
-export function SettingsSection({
-  isRumService,
-
-  // sampleRate
-  sampleRate,
-  setSampleRate,
-  isSampleRateValid,
-
-  // captureBody
-  captureBody,
-  setCaptureBody,
-
-  // transactionMaxSpans
-  transactionMaxSpans,
-  setTransactionMaxSpans,
-  isTransactionMaxSpansValid
-}: Props) {
-  return (
-    <>
-      <EuiTitle size="xs">
-        <h3>
-          {i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.settingsSection.title',
-            { defaultMessage: 'Options' }
-          )}
-        </h3>
-      </EuiTitle>
-
-      <EuiSpacer size="m" />
-
-      <EuiFormRow
-        label={i18n.translate(
-          'xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputLabel',
-          { defaultMessage: 'Transaction sample rate' }
-        )}
-        helpText={i18n.translate(
-          'xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputHelpText',
-          {
-            defaultMessage:
-              'Choose a rate between 0.000 and 1.0. Default is 1.0 (100% of traces).'
-          }
-        )}
-        error={i18n.translate(
-          'xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputErrorText',
-          { defaultMessage: 'Sample rate must be between 0.000 and 1' }
-        )}
-        isInvalid={!isEmpty(sampleRate) && !isSampleRateValid}
-      >
-        <EuiFieldText
-          placeholder={i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputPlaceholderText',
-            { defaultMessage: 'Set sample rate' }
-          )}
-          value={sampleRate}
-          onChange={e => {
-            e.preventDefault();
-            setSampleRate(e.target.value);
-          }}
-        />
-      </EuiFormRow>
-
-      <EuiSpacer size="m" />
-
-      {!isRumService && (
-        <EuiFormRow
-          label={i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.settingsSection.captureBodyInputLabel',
-            { defaultMessage: 'Capture body' }
-          )}
-          helpText={i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.settingsSection.captureBodyInputHelpText',
-            {
-              defaultMessage:
-                'For transactions that are HTTP requests, the agent can optionally capture the request body (e.g. POST variables). Default is "off".'
-            }
-          )}
-        >
-          <SelectWithPlaceholder
-            placeholder={i18n.translate(
-              'xpack.apm.settings.agentConf.flyOut.settingsSection.captureBodyInputPlaceholderText',
-              { defaultMessage: 'Select option' }
-            )}
-            options={[
-              { text: 'off' },
-              { text: 'errors' },
-              { text: 'transactions' },
-              { text: 'all' }
-            ]}
-            value={captureBody}
-            onChange={e => {
-              e.preventDefault();
-              setCaptureBody(e.target.value);
-            }}
-          />
-        </EuiFormRow>
-      )}
-
-      {!isRumService && (
-        <EuiFormRow
-          label={i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputLabel',
-            { defaultMessage: 'Transaction max spans' }
-          )}
-          helpText={i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputHelpText',
-            {
-              defaultMessage:
-                'Limits the amount of spans that are recorded per transaction. Default is 500.'
-            }
-          )}
-          error={i18n.translate(
-            'xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputErrorText',
-            { defaultMessage: 'Must be between 0 and 32000' }
-          )}
-          isInvalid={
-            !isEmpty(transactionMaxSpans) && !isTransactionMaxSpansValid
-          }
-        >
-          <EuiFieldNumber
-            placeholder={i18n.translate(
-              'xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputPlaceholderText',
-              { defaultMessage: 'Set transaction max spans' }
-            )}
-            value={
-              transactionMaxSpans === '' ? '' : Number(transactionMaxSpans)
-            }
-            min={0}
-            max={32000}
-            onChange={e => {
-              e.preventDefault();
-              setTransactionMaxSpans(e.target.value);
-            }}
-          />
-        </EuiFormRow>
-      )}
-    </>
-  );
-}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/index.tsx
deleted file mode 100644
index a034ca543390f..0000000000000
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/index.tsx
+++ /dev/null
@@ -1,256 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  EuiButton,
-  EuiButtonEmpty,
-  EuiFlexGroup,
-  EuiFlexItem,
-  EuiFlyout,
-  EuiFlyoutBody,
-  EuiFlyoutFooter,
-  EuiFlyoutHeader,
-  EuiForm,
-  EuiPortal,
-  EuiTitle,
-  EuiText,
-  EuiSpacer
-} from '@elastic/eui';
-import React, { useState } from 'react';
-import { i18n } from '@kbn/i18n';
-import { isRight } from 'fp-ts/lib/Either';
-import { transactionSampleRateRt } from '../../../../../../../../../plugins/apm/common/runtime_types/transaction_sample_rate_rt';
-import { Config } from '../index';
-import { SettingsSection } from './SettingsSection';
-import { ServiceSection } from './ServiceSection';
-import { DeleteButton } from './DeleteButton';
-import { transactionMaxSpansRt } from '../../../../../../../../../plugins/apm/common/runtime_types/transaction_max_spans_rt';
-import { useFetcher } from '../../../../../hooks/useFetcher';
-import { isRumAgentName } from '../../../../../../../../../plugins/apm/common/agent_name';
-import { ALL_OPTION_VALUE } from '../../../../../../../../../plugins/apm/common/agent_configuration_constants';
-import { saveConfig } from './saveConfig';
-import { useApmPluginContext } from '../../../../../hooks/useApmPluginContext';
-import { useUiTracker } from '../../../../../../../../../plugins/observability/public';
-
-const defaultSettings = {
-  TRANSACTION_SAMPLE_RATE: '1.0',
-  CAPTURE_BODY: 'off',
-  TRANSACTION_MAX_SPANS: '500'
-};
-
-interface Props {
-  onClose: () => void;
-  onSaved: () => void;
-  onDeleted: () => void;
-  selectedConfig: Config | null;
-}
-
-export function AddEditFlyout({
-  onClose,
-  onSaved,
-  onDeleted,
-  selectedConfig
-}: Props) {
-  const { toasts } = useApmPluginContext().core.notifications;
-  const [isSaving, setIsSaving] = useState(false);
-
-  // get a telemetry UI event tracker
-  const trackApmEvent = useUiTracker({ app: 'apm' });
-
-  // config conditions (service)
-  const [serviceName, setServiceName] = useState<string>(
-    selectedConfig ? selectedConfig.service.name || ALL_OPTION_VALUE : ''
-  );
-  const [environment, setEnvironment] = useState<string>(
-    selectedConfig ? selectedConfig.service.environment || ALL_OPTION_VALUE : ''
-  );
-
-  const { data: { agentName } = { agentName: undefined } } = useFetcher(
-    callApmApi => {
-      if (serviceName === ALL_OPTION_VALUE) {
-        return Promise.resolve({ agentName: undefined });
-      }
-
-      if (serviceName) {
-        return callApmApi({
-          pathname: '/api/apm/settings/agent-configuration/agent_name',
-          params: { query: { serviceName } }
-        });
-      }
-    },
-    [serviceName],
-    { preservePreviousData: false }
-  );
-
-  // config settings
-  const [sampleRate, setSampleRate] = useState<string>(
-    (
-      selectedConfig?.settings.transaction_sample_rate ||
-      defaultSettings.TRANSACTION_SAMPLE_RATE
-    ).toString()
-  );
-  const [captureBody, setCaptureBody] = useState<string>(
-    selectedConfig?.settings.capture_body || defaultSettings.CAPTURE_BODY
-  );
-  const [transactionMaxSpans, setTransactionMaxSpans] = useState<string>(
-    (
-      selectedConfig?.settings.transaction_max_spans ||
-      defaultSettings.TRANSACTION_MAX_SPANS
-    ).toString()
-  );
-
-  const isRumService = isRumAgentName(agentName);
-  const isSampleRateValid = isRight(transactionSampleRateRt.decode(sampleRate));
-  const isTransactionMaxSpansValid = isRight(
-    transactionMaxSpansRt.decode(transactionMaxSpans)
-  );
-
-  const isFormValid =
-    !!serviceName &&
-    !!environment &&
-    isSampleRateValid &&
-    // captureBody and isTransactionMaxSpansValid are required except if service is RUM
-    (isRumService || (!!captureBody && isTransactionMaxSpansValid)) &&
-    // agent name is required, except if serviceName is "all"
-    (serviceName === ALL_OPTION_VALUE || agentName !== undefined);
-
-  const handleSubmitEvent = async (
-    event:
-      | React.FormEvent<HTMLFormElement>
-      | React.MouseEvent<HTMLButtonElement>
-  ) => {
-    event.preventDefault();
-    setIsSaving(true);
-
-    await saveConfig({
-      serviceName,
-      environment,
-      sampleRate,
-      captureBody,
-      transactionMaxSpans,
-      agentName,
-      isExistingConfig: Boolean(selectedConfig),
-      toasts,
-      trackApmEvent
-    });
-    setIsSaving(false);
-    onSaved();
-  };
-
-  return (
-    <EuiPortal>
-      <EuiFlyout size="s" onClose={onClose} ownFocus={true}>
-        <EuiFlyoutHeader hasBorder>
-          <EuiTitle>
-            <h2>
-              {selectedConfig
-                ? i18n.translate(
-                    'xpack.apm.settings.agentConf.editConfigTitle',
-                    { defaultMessage: 'Edit configuration' }
-                  )
-                : i18n.translate(
-                    'xpack.apm.settings.agentConf.createConfigTitle',
-                    { defaultMessage: 'Create configuration' }
-                  )}
-            </h2>
-          </EuiTitle>
-        </EuiFlyoutHeader>
-        <EuiFlyoutBody>
-          <EuiText size="s">
-            This allows you to fine-tune your agent configuration directly in
-            Kibana. Best of all, changes are automatically propagated to your
-            APM agents so there’s no need to redeploy.
-          </EuiText>
-
-          <EuiSpacer size="m" />
-
-          <EuiForm>
-            {/* eslint-disable-next-line jsx-a11y/no-noninteractive-element-interactions */}
-            <form
-              onKeyPress={e => {
-                const didClickEnter = e.which === 13;
-                if (didClickEnter) {
-                  handleSubmitEvent(e);
-                }
-              }}
-            >
-              <ServiceSection
-                isReadOnly={Boolean(selectedConfig)}
-                //
-                // environment
-                environment={environment}
-                onEnvironmentChange={setEnvironment}
-                //
-                // serviceName
-                serviceName={serviceName}
-                onServiceNameChange={setServiceName}
-              />
-
-              <EuiSpacer />
-
-              <SettingsSection
-                isRumService={isRumService}
-                //
-                // sampleRate
-                sampleRate={sampleRate}
-                setSampleRate={setSampleRate}
-                isSampleRateValid={isSampleRateValid}
-                //
-                // captureBody
-                captureBody={captureBody}
-                setCaptureBody={setCaptureBody}
-                //
-                // transactionMaxSpans
-                transactionMaxSpans={transactionMaxSpans}
-                setTransactionMaxSpans={setTransactionMaxSpans}
-                isTransactionMaxSpansValid={isTransactionMaxSpansValid}
-              />
-            </form>
-          </EuiForm>
-        </EuiFlyoutBody>
-        <EuiFlyoutFooter>
-          <EuiFlexGroup justifyContent="spaceBetween">
-            <EuiFlexItem grow={false}>
-              {selectedConfig ? (
-                <DeleteButton
-                  selectedConfig={selectedConfig}
-                  onDeleted={onDeleted}
-                />
-              ) : null}
-            </EuiFlexItem>
-            <EuiFlexItem grow={false}>
-              <EuiFlexGroup justifyContent="flexEnd">
-                <EuiFlexItem grow={false}>
-                  <EuiButtonEmpty onClick={onClose}>
-                    {i18n.translate(
-                      'xpack.apm.settings.agentConf.cancelButtonLabel',
-                      { defaultMessage: 'Cancel' }
-                    )}
-                  </EuiButtonEmpty>
-                </EuiFlexItem>
-                <EuiFlexItem grow={false}>
-                  <EuiButton
-                    type="submit"
-                    fill
-                    isLoading={isSaving}
-                    iconSide="right"
-                    isDisabled={!isFormValid}
-                    onClick={handleSubmitEvent}
-                  >
-                    {i18n.translate(
-                      'xpack.apm.settings.agentConf.saveConfigurationButtonLabel',
-                      { defaultMessage: 'Save' }
-                    )}
-                  </EuiButton>
-                </EuiFlexItem>
-              </EuiFlexGroup>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiFlyoutFooter>
-      </EuiFlyout>
-    </EuiPortal>
-  );
-}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/saveConfig.ts b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/saveConfig.ts
deleted file mode 100644
index 229394cb5da8c..0000000000000
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AddEditFlyout/saveConfig.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { i18n } from '@kbn/i18n';
-import { NotificationsStart } from 'kibana/public';
-import { callApmApi } from '../../../../../services/rest/createCallApmApi';
-import { isRumAgentName } from '../../../../../../../../../plugins/apm/common/agent_name';
-import {
-  getOptionLabel,
-  omitAllOption
-} from '../../../../../../../../../plugins/apm/common/agent_configuration_constants';
-import { UiTracker } from '../../../../../../../../../plugins/observability/public';
-
-interface Settings {
-  transaction_sample_rate: number;
-  capture_body?: string;
-  transaction_max_spans?: number;
-}
-
-export async function saveConfig({
-  serviceName,
-  environment,
-  sampleRate,
-  captureBody,
-  transactionMaxSpans,
-  agentName,
-  isExistingConfig,
-  toasts,
-  trackApmEvent
-}: {
-  serviceName: string;
-  environment: string;
-  sampleRate: string;
-  captureBody: string;
-  transactionMaxSpans: string;
-  agentName?: string;
-  isExistingConfig: boolean;
-  toasts: NotificationsStart['toasts'];
-  trackApmEvent: UiTracker;
-}) {
-  trackApmEvent({ metric: 'save_agent_configuration' });
-
-  try {
-    const settings: Settings = {
-      transaction_sample_rate: Number(sampleRate)
-    };
-
-    if (!isRumAgentName(agentName)) {
-      settings.capture_body = captureBody;
-      settings.transaction_max_spans = Number(transactionMaxSpans);
-    }
-
-    const configuration = {
-      agent_name: agentName,
-      service: {
-        name: omitAllOption(serviceName),
-        environment: omitAllOption(environment)
-      },
-      settings
-    };
-
-    await callApmApi({
-      pathname: '/api/apm/settings/agent-configuration',
-      method: 'PUT',
-      params: {
-        query: { overwrite: isExistingConfig },
-        body: configuration
-      }
-    });
-
-    toasts.addSuccess({
-      title: i18n.translate(
-        'xpack.apm.settings.agentConf.saveConfig.succeeded.title',
-        { defaultMessage: 'Configuration saved' }
-      ),
-      text: i18n.translate(
-        'xpack.apm.settings.agentConf.saveConfig.succeeded.text',
-        {
-          defaultMessage:
-            'The configuration for "{serviceName}" was saved. It will take some time to propagate to the agents.',
-          values: { serviceName: getOptionLabel(serviceName) }
-        }
-      )
-    });
-  } catch (error) {
-    toasts.addDanger({
-      title: i18n.translate(
-        'xpack.apm.settings.agentConf.saveConfig.failed.title',
-        { defaultMessage: 'Configuration could not be saved' }
-      ),
-      text: i18n.translate(
-        'xpack.apm.settings.agentConf.saveConfig.failed.text',
-        {
-          defaultMessage:
-            'Something went wrong when saving the configuration for "{serviceName}". Error: "{errorMessage}"',
-          values: {
-            serviceName: getOptionLabel(serviceName),
-            errorMessage: error.message
-          }
-        }
-      )
-    });
-  }
-}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/ServicePage/FormRowSelect.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/ServicePage/FormRowSelect.tsx
new file mode 100644
index 0000000000000..30d3f9580db48
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/ServicePage/FormRowSelect.tsx
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import {
+  EuiDescribedFormGroup,
+  EuiSelectOption,
+  EuiFormRow
+} from '@elastic/eui';
+import { SelectWithPlaceholder } from '../../../../../shared/SelectWithPlaceholder';
+
+interface Props {
+  title: string;
+  description: string;
+  fieldLabel: string;
+  isLoading: boolean;
+  options?: EuiSelectOption[];
+  value?: string;
+  disabled: boolean;
+  onChange: (event: React.ChangeEvent<HTMLSelectElement>) => void;
+}
+
+export function FormRowSelect({
+  title,
+  description,
+  fieldLabel,
+  isLoading,
+  options,
+  value,
+  disabled,
+  onChange
+}: Props) {
+  return (
+    <EuiDescribedFormGroup
+      fullWidth
+      title={<h3>{title}</h3>}
+      description={description}
+    >
+      <EuiFormRow label={fieldLabel}>
+        <SelectWithPlaceholder
+          isLoading={isLoading}
+          options={options}
+          value={value}
+          disabled={disabled}
+          onChange={onChange}
+        />
+      </EuiFormRow>
+    </EuiDescribedFormGroup>
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/ServicePage/ServicePage.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/ServicePage/ServicePage.tsx
new file mode 100644
index 0000000000000..b9f8fd86d067b
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/ServicePage/ServicePage.tsx
@@ -0,0 +1,208 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  EuiTitle,
+  EuiSpacer,
+  EuiPanel,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButton
+} from '@elastic/eui';
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { isString } from 'lodash';
+import { EuiButtonEmpty } from '@elastic/eui';
+import { AgentConfigurationIntake } from '../../../../../../../../../../plugins/apm/common/agent_configuration/configuration_types';
+import {
+  omitAllOption,
+  getOptionLabel
+} from '../../../../../../../../../../plugins/apm/common/agent_configuration/all_option';
+import { useFetcher, FETCH_STATUS } from '../../../../../../hooks/useFetcher';
+import { FormRowSelect } from './FormRowSelect';
+import { APMLink } from '../../../../../shared/Links/apm/APMLink';
+
+interface Props {
+  newConfig: AgentConfigurationIntake;
+  setNewConfig: React.Dispatch<React.SetStateAction<AgentConfigurationIntake>>;
+  onClickNext: () => void;
+}
+
+export function ServicePage({ newConfig, setNewConfig, onClickNext }: Props) {
+  const { data: serviceNames = [], status: serviceNamesStatus } = useFetcher(
+    callApmApi => {
+      return callApmApi({
+        pathname: '/api/apm/settings/agent-configuration/services',
+        forceCache: true
+      });
+    },
+    [],
+    { preservePreviousData: false }
+  );
+
+  const { data: environments = [], status: environmentStatus } = useFetcher(
+    callApmApi => {
+      if (newConfig.service.name) {
+        return callApmApi({
+          pathname: '/api/apm/settings/agent-configuration/environments',
+          params: {
+            query: { serviceName: omitAllOption(newConfig.service.name) }
+          }
+        });
+      }
+    },
+    [newConfig.service.name],
+    { preservePreviousData: false }
+  );
+
+  const { status: agentNameStatus } = useFetcher(
+    async callApmApi => {
+      const serviceName = newConfig.service.name;
+
+      if (!isString(serviceName) || serviceName.length === 0) {
+        return;
+      }
+
+      const { agentName } = await callApmApi({
+        pathname: '/api/apm/settings/agent-configuration/agent_name',
+        params: { query: { serviceName } }
+      });
+
+      setNewConfig(prev => ({ ...prev, agent_name: agentName }));
+    },
+    [newConfig.service.name, setNewConfig]
+  );
+
+  const ALREADY_CONFIGURED_TRANSLATED = i18n.translate(
+    'xpack.apm.agentConfig.servicePage.alreadyConfiguredOption',
+    { defaultMessage: 'already configured' }
+  );
+
+  const serviceNameOptions = serviceNames.map(name => ({
+    text: getOptionLabel(name),
+    value: name
+  }));
+  const environmentOptions = environments.map(
+    ({ name, alreadyConfigured }) => ({
+      disabled: alreadyConfigured,
+      text: `${getOptionLabel(name)} ${
+        alreadyConfigured ? `(${ALREADY_CONFIGURED_TRANSLATED})` : ''
+      }`,
+      value: name
+    })
+  );
+
+  return (
+    <EuiPanel paddingSize="m">
+      <EuiTitle size="xs">
+        <h3>
+          {i18n.translate('xpack.apm.agentConfig.servicePage.title', {
+            defaultMessage: 'Choose service'
+          })}
+        </h3>
+      </EuiTitle>
+
+      <EuiSpacer size="m" />
+
+      {/* Service name options */}
+      <FormRowSelect
+        title={i18n.translate(
+          'xpack.apm.agentConfig.servicePage.service.title',
+          { defaultMessage: 'Service' }
+        )}
+        description={i18n.translate(
+          'xpack.apm.agentConfig.servicePage.service.description',
+          { defaultMessage: 'Choose the service you want to configure.' }
+        )}
+        fieldLabel={i18n.translate(
+          'xpack.apm.agentConfig.servicePage.service.fieldLabel',
+          { defaultMessage: 'Service name' }
+        )}
+        isLoading={serviceNamesStatus === FETCH_STATUS.LOADING}
+        options={serviceNameOptions}
+        value={newConfig.service.name}
+        disabled={serviceNamesStatus === FETCH_STATUS.LOADING}
+        onChange={e => {
+          e.preventDefault();
+          const name = e.target.value;
+          setNewConfig(prev => ({
+            ...prev,
+            service: { name, environment: '' }
+          }));
+        }}
+      />
+
+      {/* Environment options */}
+      <FormRowSelect
+        title={i18n.translate(
+          'xpack.apm.agentConfig.servicePage.environment.title',
+          { defaultMessage: 'Environment' }
+        )}
+        description={i18n.translate(
+          'xpack.apm.agentConfig.servicePage.environment.description',
+          {
+            defaultMessage:
+              'Only a single environment per configuration is supported.'
+          }
+        )}
+        fieldLabel={i18n.translate(
+          'xpack.apm.agentConfig.servicePage.environment.fieldLabel',
+          { defaultMessage: 'Service environment' }
+        )}
+        isLoading={environmentStatus === FETCH_STATUS.LOADING}
+        options={environmentOptions}
+        value={newConfig.service.environment}
+        disabled={
+          !newConfig.service.name || environmentStatus === FETCH_STATUS.LOADING
+        }
+        onChange={e => {
+          e.preventDefault();
+          const environment = e.target.value;
+          setNewConfig(prev => ({
+            ...prev,
+            service: { name: prev.service.name, environment }
+          }));
+        }}
+      />
+
+      <EuiSpacer />
+
+      <EuiFlexGroup justifyContent="flexEnd">
+        {/* Cancel button */}
+        <EuiFlexItem grow={false}>
+          <APMLink path="/settings/agent-configuration">
+            <EuiButtonEmpty color="primary">
+              {i18n.translate(
+                'xpack.apm.agentConfig.servicePage.cancelButton',
+                { defaultMessage: 'Cancel' }
+              )}
+            </EuiButtonEmpty>
+          </APMLink>
+        </EuiFlexItem>
+
+        {/* Next button */}
+        <EuiFlexItem grow={false}>
+          <EuiButton
+            type="submit"
+            fill
+            onClick={onClickNext}
+            isLoading={agentNameStatus === FETCH_STATUS.LOADING}
+            isDisabled={
+              !newConfig.service.name ||
+              !newConfig.service.environment ||
+              agentNameStatus === FETCH_STATUS.LOADING
+            }
+          >
+            {i18n.translate(
+              'xpack.apm.agentConfig.saveConfigurationButtonLabel',
+              { defaultMessage: 'Next step' }
+            )}
+          </EuiButton>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiPanel>
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingFormRow.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingFormRow.tsx
new file mode 100644
index 0000000000000..b1959e4d68aa4
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingFormRow.tsx
@@ -0,0 +1,178 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import {
+  EuiFormRow,
+  EuiFieldText,
+  EuiFieldNumber,
+  EuiDescribedFormGroup,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiCode,
+  EuiSpacer,
+  EuiIconTip
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { SettingDefinition } from '../../../../../../../../../../plugins/apm/common/agent_configuration/setting_definitions/types';
+import { isValid } from '../../../../../../../../../../plugins/apm/common/agent_configuration/setting_definitions';
+import {
+  amountAndUnitToString,
+  amountAndUnitToObject
+} from '../../../../../../../../../../plugins/apm/common/agent_configuration/amount_and_unit';
+import { SelectWithPlaceholder } from '../../../../../shared/SelectWithPlaceholder';
+
+function FormRow({
+  setting,
+  value,
+  onChange
+}: {
+  setting: SettingDefinition;
+  value?: string;
+  onChange: (key: string, value: string) => void;
+}) {
+  switch (setting.type) {
+    case 'float':
+    case 'text': {
+      return (
+        <EuiFieldText
+          placeholder={setting.placeholder}
+          value={value || ''}
+          onChange={e => onChange(setting.key, e.target.value)}
+        />
+      );
+    }
+
+    case 'integer': {
+      return (
+        <EuiFieldNumber
+          placeholder={setting.placeholder}
+          value={(value as any) || ''}
+          min={setting.min}
+          max={setting.max}
+          onChange={e => onChange(setting.key, e.target.value)}
+        />
+      );
+    }
+
+    case 'select': {
+      return (
+        <SelectWithPlaceholder
+          placeholder={setting.placeholder}
+          options={setting.options}
+          value={value}
+          onChange={e => onChange(setting.key, e.target.value)}
+        />
+      );
+    }
+
+    case 'boolean': {
+      return (
+        <SelectWithPlaceholder
+          placeholder={setting.placeholder}
+          options={[{ text: 'true' }, { text: 'false' }]}
+          value={value}
+          onChange={e => onChange(setting.key, e.target.value)}
+        />
+      );
+    }
+
+    case 'bytes':
+    case 'duration': {
+      const { amount, unit } = amountAndUnitToObject(value ?? '');
+
+      return (
+        <EuiFlexGroup gutterSize="s">
+          <EuiFlexItem grow={false}>
+            <EuiFieldNumber
+              placeholder={setting.placeholder}
+              value={(amount as unknown) as number}
+              onChange={e =>
+                onChange(
+                  setting.key,
+                  amountAndUnitToString({ amount: e.target.value, unit })
+                )
+              }
+            />
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <SelectWithPlaceholder
+              placeholder={i18n.translate('xpack.apm.unitLabel', {
+                defaultMessage: 'Select unit'
+              })}
+              value={unit}
+              options={setting.units?.map(text => ({ text }))}
+              onChange={e =>
+                onChange(
+                  setting.key,
+                  amountAndUnitToString({ amount, unit: e.target.value })
+                )
+              }
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      );
+    }
+
+    default:
+      throw new Error(`Unknown type "${(setting as SettingDefinition).type}"`);
+  }
+}
+
+export function SettingFormRow({
+  isUnsaved,
+  setting,
+  value,
+  onChange
+}: {
+  isUnsaved: boolean;
+  setting: SettingDefinition;
+  value?: string;
+  onChange: (key: string, value: string) => void;
+}) {
+  const isInvalid = value != null && value !== '' && !isValid(setting, value);
+
+  return (
+    <EuiDescribedFormGroup
+      fullWidth
+      title={
+        <h3>
+          {setting.label}{' '}
+          {isUnsaved && (
+            <EuiIconTip
+              type={'dot'}
+              color={'warning'}
+              content={i18n.translate(
+                'xpack.apm.agentConfig.unsavedSetting.tooltip',
+                { defaultMessage: 'Unsaved' }
+              )}
+            />
+          )}
+        </h3>
+      }
+      description={
+        <>
+          {setting.description}
+
+          {setting.defaultValue && (
+            <>
+              <EuiSpacer />
+              <EuiCode>Default: {setting.defaultValue}</EuiCode>
+            </>
+          )}
+        </>
+      }
+    >
+      <EuiFormRow
+        label={setting.key}
+        error={setting.validationError}
+        isInvalid={isInvalid}
+      >
+        <FormRow onChange={onChange} setting={setting} value={value} />
+      </EuiFormRow>
+    </EuiDescribedFormGroup>
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingsPage.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingsPage.tsx
new file mode 100644
index 0000000000000..6d76b69600333
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/SettingsPage.tsx
@@ -0,0 +1,301 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  EuiButton,
+  EuiForm,
+  EuiTitle,
+  EuiSpacer,
+  EuiPanel,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiStat,
+  EuiBottomBar,
+  EuiText,
+  EuiHealth,
+  EuiLoadingSpinner
+} from '@elastic/eui';
+import React, { useState, useMemo } from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiButtonEmpty } from '@elastic/eui';
+import { EuiCallOut } from '@elastic/eui';
+import { FETCH_STATUS } from '../../../../../../hooks/useFetcher';
+import { AgentName } from '../../../../../../../../../../plugins/apm/typings/es_schemas/ui/fields/agent';
+import { history } from '../../../../../../utils/history';
+import { AgentConfigurationIntake } from '../../../../../../../../../../plugins/apm/common/agent_configuration/configuration_types';
+import {
+  filterByAgent,
+  settingDefinitions,
+  isValid
+} from '../../../../../../../../../../plugins/apm/common/agent_configuration/setting_definitions';
+import { saveConfig } from './saveConfig';
+import { useApmPluginContext } from '../../../../../../hooks/useApmPluginContext';
+import { useUiTracker } from '../../../../../../../../../../plugins/observability/public';
+import { SettingFormRow } from './SettingFormRow';
+import { getOptionLabel } from '../../../../../../../../../../plugins/apm/common/agent_configuration/all_option';
+
+function removeEmpty<T>(obj: T): T {
+  return Object.fromEntries(
+    Object.entries(obj).filter(([k, v]) => v != null && v !== '')
+  );
+}
+
+export function SettingsPage({
+  status,
+  unsavedChanges,
+  newConfig,
+  setNewConfig,
+  resetSettings,
+  isEditMode,
+  onClickEdit
+}: {
+  status?: FETCH_STATUS;
+  unsavedChanges: Record<string, string>;
+  newConfig: AgentConfigurationIntake;
+  setNewConfig: React.Dispatch<React.SetStateAction<AgentConfigurationIntake>>;
+  resetSettings: () => void;
+  isEditMode: boolean;
+  onClickEdit: () => void;
+}) {
+  // get a telemetry UI event tracker
+  const trackApmEvent = useUiTracker({ app: 'apm' });
+  const { toasts } = useApmPluginContext().core.notifications;
+  const [isSaving, setIsSaving] = useState(false);
+  const unsavedChangesCount = Object.keys(unsavedChanges).length;
+  const isLoading = status === FETCH_STATUS.LOADING;
+
+  const isFormValid = useMemo(() => {
+    return (
+      settingDefinitions
+        // only validate settings that are not empty
+        .filter(({ key }) => {
+          const value = newConfig.settings[key];
+          return value != null && value !== '';
+        })
+
+        // every setting must be valid for the form to be valid
+        .every(def => {
+          const value = newConfig.settings[def.key];
+          return isValid(def, value);
+        })
+    );
+  }, [newConfig.settings]);
+
+  const handleSubmitEvent = async () => {
+    trackApmEvent({ metric: 'save_agent_configuration' });
+    const config = { ...newConfig, settings: removeEmpty(newConfig.settings) };
+
+    setIsSaving(true);
+    await saveConfig({ config, isEditMode, toasts });
+    setIsSaving(false);
+
+    // go back to overview
+    history.push({
+      pathname: '/settings/agent-configuration',
+      search: history.location.search
+    });
+  };
+
+  if (status === FETCH_STATUS.FAILURE) {
+    return (
+      <EuiCallOut
+        title={i18n.translate(
+          'xpack.apm.agentConfig.settingsPage.notFound.title',
+          { defaultMessage: 'Sorry, there was an error' }
+        )}
+        color="danger"
+        iconType="alert"
+      >
+        <p>
+          {i18n.translate(
+            'xpack.apm.agentConfig.settingsPage.notFound.message',
+            { defaultMessage: 'The requested configuration does not exist' }
+          )}
+        </p>
+      </EuiCallOut>
+    );
+  }
+
+  return (
+    <>
+      <EuiForm>
+        {/* Since the submit button is placed outside the form we cannot use `onSubmit` and have to use `onKeyPress` to submit the form on enter */}
+        {/* eslint-disable-next-line jsx-a11y/no-noninteractive-element-interactions */}
+        <form
+          onKeyPress={e => {
+            const didClickEnter = e.which === 13;
+            if (didClickEnter && isFormValid) {
+              e.preventDefault();
+              handleSubmitEvent();
+            }
+          }}
+        >
+          {/* Selected Service panel */}
+          <EuiPanel paddingSize="m">
+            <EuiTitle size="s">
+              <h3>
+                {i18n.translate('xpack.apm.agentConfig.chooseService.title', {
+                  defaultMessage: 'Choose service'
+                })}
+              </h3>
+            </EuiTitle>
+
+            <EuiSpacer size="m" />
+
+            <EuiFlexGroup>
+              <EuiFlexItem>
+                <EuiStat
+                  titleSize="xs"
+                  title={
+                    isLoading ? '-' : getOptionLabel(newConfig.service.name)
+                  }
+                  description={i18n.translate(
+                    'xpack.apm.agentConfig.chooseService.service.name.label',
+                    { defaultMessage: 'Service name' }
+                  )}
+                />
+              </EuiFlexItem>
+              <EuiFlexItem>
+                <EuiStat
+                  titleSize="xs"
+                  title={
+                    isLoading
+                      ? '-'
+                      : getOptionLabel(newConfig.service.environment)
+                  }
+                  description={i18n.translate(
+                    'xpack.apm.agentConfig.chooseService.service.environment.label',
+                    { defaultMessage: 'Environment' }
+                  )}
+                />
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                {!isEditMode && (
+                  <EuiButton onClick={onClickEdit} iconType="pencil">
+                    {i18n.translate(
+                      'xpack.apm.agentConfig.chooseService.editButton',
+                      { defaultMessage: 'Edit' }
+                    )}
+                  </EuiButton>
+                )}
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiPanel>
+
+          <EuiSpacer size="m" />
+
+          {/* Settings panel */}
+          <EuiPanel paddingSize="m">
+            <EuiTitle size="s">
+              <h3>
+                {i18n.translate('xpack.apm.agentConfig.settings.title', {
+                  defaultMessage: 'Configuration options'
+                })}
+              </h3>
+            </EuiTitle>
+
+            <EuiSpacer size="m" />
+
+            {isLoading ? (
+              <div style={{ textAlign: 'center' }}>
+                <EuiLoadingSpinner size="m" />
+              </div>
+            ) : (
+              renderSettings({ unsavedChanges, newConfig, setNewConfig })
+            )}
+          </EuiPanel>
+        </form>
+      </EuiForm>
+      <EuiSpacer size="xxl" />
+
+      {/* Bottom bar with save button */}
+      {unsavedChangesCount > 0 && (
+        <EuiBottomBar paddingSize="s">
+          <EuiFlexGroup justifyContent="spaceBetween" alignItems="center">
+            <EuiFlexItem
+              grow={false}
+              style={{
+                flexDirection: 'row',
+                alignItems: 'center'
+              }}
+            >
+              <EuiHealth color="warning" />
+              <EuiText>
+                {i18n.translate('xpack.apm.unsavedChanges', {
+                  defaultMessage:
+                    '{unsavedChangesCount, plural, =0{0 unsaved changes} one {1 unsaved change} other {# unsaved changes}} ',
+                  values: { unsavedChangesCount }
+                })}
+              </EuiText>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <EuiFlexGroup justifyContent="flexEnd">
+                <EuiFlexItem grow={false}>
+                  <EuiButtonEmpty color="ghost" onClick={resetSettings}>
+                    {i18n.translate(
+                      'xpack.apm.agentConfig.settingsPage.discardChangesButton',
+                      { defaultMessage: 'Discard changes' }
+                    )}
+                  </EuiButtonEmpty>
+                </EuiFlexItem>
+                <EuiFlexItem grow={false}>
+                  <EuiButton
+                    onClick={handleSubmitEvent}
+                    fill
+                    isLoading={isSaving}
+                    isDisabled={!isFormValid}
+                    color="secondary"
+                    iconType="check"
+                  >
+                    {i18n.translate(
+                      'xpack.apm.agentConfig.settingsPage.saveButton',
+                      { defaultMessage: 'Save configuration' }
+                    )}
+                  </EuiButton>
+                </EuiFlexItem>
+              </EuiFlexGroup>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiBottomBar>
+      )}
+    </>
+  );
+}
+
+function renderSettings({
+  newConfig,
+  unsavedChanges,
+  setNewConfig
+}: {
+  newConfig: AgentConfigurationIntake;
+  unsavedChanges: Record<string, string>;
+  setNewConfig: React.Dispatch<React.SetStateAction<AgentConfigurationIntake>>;
+}) {
+  return (
+    settingDefinitions
+
+      // filter out agent specific items that are not applicable
+      // to the selected service
+      .filter(filterByAgent(newConfig.agent_name as AgentName))
+      .map(setting => (
+        <SettingFormRow
+          isUnsaved={unsavedChanges.hasOwnProperty(setting.key)}
+          key={setting.key}
+          setting={setting}
+          value={newConfig.settings[setting.key]}
+          onChange={(key, value) => {
+            setNewConfig(prev => ({
+              ...prev,
+              settings: {
+                ...prev.settings,
+                [key]: value
+              }
+            }));
+          }}
+        />
+      ))
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/saveConfig.ts b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/saveConfig.ts
new file mode 100644
index 0000000000000..7e3bcd68699be
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/SettingsPage/saveConfig.ts
@@ -0,0 +1,68 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { NotificationsStart } from 'kibana/public';
+import { AgentConfigurationIntake } from '../../../../../../../../../../plugins/apm/common/agent_configuration/configuration_types';
+import {
+  getOptionLabel,
+  omitAllOption
+} from '../../../../../../../../../../plugins/apm/common/agent_configuration/all_option';
+import { callApmApi } from '../../../../../../services/rest/createCallApmApi';
+
+export async function saveConfig({
+  config,
+  isEditMode,
+  toasts
+}: {
+  config: AgentConfigurationIntake;
+  agentName?: string;
+  isEditMode: boolean;
+  toasts: NotificationsStart['toasts'];
+}) {
+  try {
+    await callApmApi({
+      pathname: '/api/apm/settings/agent-configuration',
+      method: 'PUT',
+      params: {
+        query: { overwrite: isEditMode },
+        body: {
+          ...config,
+          service: {
+            name: omitAllOption(config.service.name),
+            environment: omitAllOption(config.service.environment)
+          }
+        }
+      }
+    });
+
+    toasts.addSuccess({
+      title: i18n.translate(
+        'xpack.apm.agentConfig.saveConfig.succeeded.title',
+        { defaultMessage: 'Configuration saved' }
+      ),
+      text: i18n.translate('xpack.apm.agentConfig.saveConfig.succeeded.text', {
+        defaultMessage:
+          'The configuration for "{serviceName}" was saved. It will take some time to propagate to the agents.',
+        values: { serviceName: getOptionLabel(config.service.name) }
+      })
+    });
+  } catch (error) {
+    toasts.addDanger({
+      title: i18n.translate('xpack.apm.agentConfig.saveConfig.failed.title', {
+        defaultMessage: 'Configuration could not be saved'
+      }),
+      text: i18n.translate('xpack.apm.agentConfig.saveConfig.failed.text', {
+        defaultMessage:
+          'Something went wrong when saving the configuration for "{serviceName}". Error: "{errorMessage}"',
+        values: {
+          serviceName: getOptionLabel(config.service.name),
+          errorMessage: error.message
+        }
+      })
+    });
+  }
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/index.stories.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/index.stories.tsx
new file mode 100644
index 0000000000000..531e557b6ef86
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/index.stories.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { storiesOf } from '@storybook/react';
+import React from 'react';
+import { HttpSetup } from 'kibana/public';
+import { AgentConfiguration } from '../../../../../../../../../plugins/apm/common/agent_configuration/configuration_types';
+import { FETCH_STATUS } from '../../../../../hooks/useFetcher';
+import { createCallApmApi } from '../../../../../services/rest/createCallApmApi';
+import { AgentConfigurationCreateEdit } from './index';
+import {
+  ApmPluginContext,
+  ApmPluginContextValue
+} from '../../../../../context/ApmPluginContext';
+
+storiesOf(
+  'app/Settings/AgentConfigurations/AgentConfigurationCreateEdit',
+  module
+).add(
+  'with config',
+  () => {
+    const httpMock = {};
+
+    // mock
+    createCallApmApi((httpMock as unknown) as HttpSetup);
+
+    const contextMock = {
+      core: {
+        notifications: { toasts: { addWarning: () => {}, addDanger: () => {} } }
+      }
+    };
+    return (
+      <ApmPluginContext.Provider
+        value={(contextMock as unknown) as ApmPluginContextValue}
+      >
+        <AgentConfigurationCreateEdit
+          pageStep="choose-settings-step"
+          existingConfigResult={{
+            status: FETCH_STATUS.SUCCESS,
+            data: {
+              service: { name: 'opbeans-node', environment: 'production' },
+              settings: {}
+            } as AgentConfiguration
+          }}
+        />
+      </ApmPluginContext.Provider>
+    );
+  },
+  {
+    info: {
+      source: false
+    }
+  }
+);
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/index.tsx
new file mode 100644
index 0000000000000..638e518563f8c
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationCreateEdit/index.tsx
@@ -0,0 +1,157 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { isEmpty } from 'lodash';
+import { EuiTitle, EuiText, EuiSpacer } from '@elastic/eui';
+import React, { useState, useEffect, useCallback } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FetcherResult } from '../../../../../hooks/useFetcher';
+import { history } from '../../../../../utils/history';
+import {
+  AgentConfigurationIntake,
+  AgentConfiguration
+} from '../../../../../../../../../plugins/apm/common/agent_configuration/configuration_types';
+import { ServicePage } from './ServicePage/ServicePage';
+import { SettingsPage } from './SettingsPage/SettingsPage';
+import { fromQuery, toQuery } from '../../../../shared/Links/url_helpers';
+
+type PageStep = 'choose-service-step' | 'choose-settings-step' | 'review-step';
+
+function getInitialNewConfig(
+  existingConfig: AgentConfigurationIntake | undefined
+) {
+  return {
+    agent_name: existingConfig?.agent_name,
+    service: existingConfig?.service || {},
+    settings: existingConfig?.settings || {}
+  };
+}
+
+function setPage(pageStep: PageStep) {
+  history.push({
+    ...history.location,
+    search: fromQuery({
+      ...toQuery(history.location.search),
+      pageStep
+    })
+  });
+}
+
+function getUnsavedChanges({
+  newConfig,
+  existingConfig
+}: {
+  newConfig: AgentConfigurationIntake;
+  existingConfig?: AgentConfigurationIntake;
+}) {
+  return Object.fromEntries(
+    Object.entries(newConfig.settings).filter(([key, value]) => {
+      const existingValue = existingConfig?.settings?.[key];
+
+      // don't highlight changes that were added and removed
+      if (value === '' && existingValue == null) {
+        return false;
+      }
+
+      return existingValue !== value;
+    })
+  );
+}
+
+export function AgentConfigurationCreateEdit({
+  pageStep,
+  existingConfigResult
+}: {
+  pageStep: PageStep;
+  existingConfigResult?: FetcherResult<AgentConfiguration>;
+}) {
+  const existingConfig = existingConfigResult?.data;
+  const isEditMode = Boolean(existingConfigResult);
+  const [newConfig, setNewConfig] = useState<AgentConfigurationIntake>(
+    getInitialNewConfig(existingConfig)
+  );
+
+  const resetSettings = useCallback(() => {
+    setNewConfig(_newConfig => ({
+      ..._newConfig,
+      settings: existingConfig?.settings || {}
+    }));
+  }, [existingConfig]);
+
+  // update newConfig when existingConfig has loaded
+  useEffect(() => {
+    setNewConfig(getInitialNewConfig(existingConfig));
+  }, [existingConfig]);
+
+  useEffect(() => {
+    // the user tried to edit the service of an existing config
+    if (pageStep === 'choose-service-step' && isEditMode) {
+      setPage('choose-settings-step');
+    }
+
+    // the user skipped the first step (select service)
+    if (
+      pageStep === 'choose-settings-step' &&
+      !isEditMode &&
+      isEmpty(newConfig.service)
+    ) {
+      setPage('choose-service-step');
+    }
+  }, [isEditMode, newConfig, pageStep]);
+
+  const unsavedChanges = getUnsavedChanges({ newConfig, existingConfig });
+
+  return (
+    <>
+      <EuiTitle>
+        <h2>
+          {isEditMode
+            ? i18n.translate('xpack.apm.agentConfig.editConfigTitle', {
+                defaultMessage: 'Edit configuration'
+              })
+            : i18n.translate('xpack.apm.agentConfig.createConfigTitle', {
+                defaultMessage: 'Create configuration'
+              })}
+        </h2>
+      </EuiTitle>
+
+      <EuiText size="s">
+        {i18n.translate('xpack.apm.agentConfig.newConfig.description', {
+          defaultMessage: `This allows you to fine-tune your agent configuration directly in
+        Kibana. Best of all, changes are automatically propagated to your APM
+        agents so there’s no need to redeploy.`
+        })}
+      </EuiText>
+
+      <EuiSpacer size="m" />
+
+      {pageStep === 'choose-service-step' && (
+        <ServicePage
+          newConfig={newConfig}
+          setNewConfig={setNewConfig}
+          onClickNext={() => setPage('choose-settings-step')}
+        />
+      )}
+
+      {pageStep === 'choose-settings-step' && (
+        <SettingsPage
+          status={existingConfigResult?.status}
+          unsavedChanges={unsavedChanges}
+          onClickEdit={() => setPage('choose-service-step')}
+          newConfig={newConfig}
+          setNewConfig={setNewConfig}
+          resetSettings={resetSettings}
+          isEditMode={isEditMode}
+        />
+      )}
+
+      {/*
+      TODO: Add review step
+      {pageStep === 'review-step' && <div>Review will be here </div>}
+      */}
+    </>
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationList.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationList.tsx
deleted file mode 100644
index 557945e9ba67a..0000000000000
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/AgentConfigurationList.tsx
+++ /dev/null
@@ -1,232 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { i18n } from '@kbn/i18n';
-import {
-  EuiEmptyPrompt,
-  EuiButton,
-  EuiButtonEmpty,
-  EuiHealth,
-  EuiToolTip
-} from '@elastic/eui';
-import { isEmpty } from 'lodash';
-import theme from '@elastic/eui/dist/eui_theme_light.json';
-import { FETCH_STATUS } from '../../../../hooks/useFetcher';
-import { ITableColumn, ManagedTable } from '../../../shared/ManagedTable';
-import { LoadingStatePrompt } from '../../../shared/LoadingStatePrompt';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { AgentConfigurationListAPIResponse } from '../../../../../../../../plugins/apm/server/lib/settings/agent_configuration/list_configurations';
-import { Config } from '.';
-import { TimestampTooltip } from '../../../shared/TimestampTooltip';
-import { px, units } from '../../../../style/variables';
-import { getOptionLabel } from '../../../../../../../../plugins/apm/common/agent_configuration_constants';
-
-export function AgentConfigurationList({
-  status,
-  data,
-  setIsFlyoutOpen,
-  setSelectedConfig
-}: {
-  status: FETCH_STATUS;
-  data: AgentConfigurationListAPIResponse;
-  setIsFlyoutOpen: (val: boolean) => void;
-  setSelectedConfig: (val: Config | null) => void;
-}) {
-  const columns: Array<ITableColumn<Config>> = [
-    {
-      field: 'applied_by_agent',
-      align: 'center',
-      width: px(units.double),
-      name: '',
-      sortable: true,
-      render: (isApplied: boolean) => (
-        <EuiToolTip
-          content={
-            isApplied
-              ? i18n.translate(
-                  'xpack.apm.settings.agentConf.configTable.appliedTooltipMessage',
-                  { defaultMessage: 'Applied by at least one agent' }
-                )
-              : i18n.translate(
-                  'xpack.apm.settings.agentConf.configTable.notAppliedTooltipMessage',
-                  { defaultMessage: 'Not yet applied by any agents' }
-                )
-          }
-        >
-          <EuiHealth color={isApplied ? 'success' : theme.euiColorLightShade} />
-        </EuiToolTip>
-      )
-    },
-    {
-      field: 'service.name',
-      name: i18n.translate(
-        'xpack.apm.settings.agentConf.configTable.serviceNameColumnLabel',
-        { defaultMessage: 'Service name' }
-      ),
-      sortable: true,
-      render: (_, config: Config) => (
-        <EuiButtonEmpty
-          flush="left"
-          size="s"
-          color="primary"
-          onClick={() => {
-            setSelectedConfig(config);
-            setIsFlyoutOpen(true);
-          }}
-        >
-          {getOptionLabel(config.service.name)}
-        </EuiButtonEmpty>
-      )
-    },
-    {
-      field: 'service.environment',
-      name: i18n.translate(
-        'xpack.apm.settings.agentConf.configTable.environmentColumnLabel',
-        { defaultMessage: 'Service environment' }
-      ),
-      sortable: true,
-      render: (value: string) => getOptionLabel(value)
-    },
-    {
-      field: 'settings.transaction_sample_rate',
-      name: i18n.translate(
-        'xpack.apm.settings.agentConf.configTable.sampleRateColumnLabel',
-        { defaultMessage: 'Sample rate' }
-      ),
-      dataType: 'number',
-      sortable: true,
-      render: (value: number) => value
-    },
-    {
-      field: 'settings.capture_body',
-      name: i18n.translate(
-        'xpack.apm.settings.agentConf.configTable.captureBodyColumnLabel',
-        { defaultMessage: 'Capture body' }
-      ),
-      sortable: true,
-      render: (value: string) => value
-    },
-    {
-      field: 'settings.transaction_max_spans',
-      name: i18n.translate(
-        'xpack.apm.settings.agentConf.configTable.transactionMaxSpansColumnLabel',
-        { defaultMessage: 'Transaction max spans' }
-      ),
-      dataType: 'number',
-      sortable: true,
-      render: (value: number) => value
-    },
-    {
-      align: 'right',
-      field: '@timestamp',
-      name: i18n.translate(
-        'xpack.apm.settings.agentConf.configTable.lastUpdatedColumnLabel',
-        { defaultMessage: 'Last updated' }
-      ),
-      sortable: true,
-      render: (value: number) => (
-        <TimestampTooltip time={value} timeUnit="minutes" />
-      )
-    },
-    {
-      width: px(units.double),
-      name: '',
-      actions: [
-        {
-          name: i18n.translate(
-            'xpack.apm.settings.agentConf.configTable.editButtonLabel',
-            { defaultMessage: 'Edit' }
-          ),
-          description: i18n.translate(
-            'xpack.apm.settings.agentConf.configTable.editButtonDescription',
-            { defaultMessage: 'Edit this config' }
-          ),
-          icon: 'pencil',
-          color: 'primary',
-          type: 'icon',
-          onClick: (config: Config) => {
-            setSelectedConfig(config);
-            setIsFlyoutOpen(true);
-          }
-        }
-      ]
-    }
-  ];
-
-  const emptyStatePrompt = (
-    <EuiEmptyPrompt
-      iconType="controlsHorizontal"
-      title={
-        <h2>
-          {i18n.translate(
-            'xpack.apm.settings.agentConf.configTable.emptyPromptTitle',
-            { defaultMessage: 'No configurations found.' }
-          )}
-        </h2>
-      }
-      body={
-        <>
-          <p>
-            {i18n.translate(
-              'xpack.apm.settings.agentConf.configTable.emptyPromptText',
-              {
-                defaultMessage:
-                  "Let's change that! You can fine-tune agent configuration directly from Kibana without having to redeploy. Get started by creating your first configuration."
-              }
-            )}
-          </p>
-        </>
-      }
-      actions={
-        <EuiButton color="primary" fill onClick={() => setIsFlyoutOpen(true)}>
-          {i18n.translate(
-            'xpack.apm.settings.agentConf.configTable.createConfigButtonLabel',
-            { defaultMessage: 'Create configuration' }
-          )}
-        </EuiButton>
-      }
-    />
-  );
-
-  const failurePrompt = (
-    <EuiEmptyPrompt
-      iconType="alert"
-      body={
-        <>
-          <p>
-            {i18n.translate(
-              'xpack.apm.settings.agentConf.configTable.configTable.failurePromptText',
-              {
-                defaultMessage:
-                  'The list of agent configurations could not be fetched. Your user may not have the sufficient permissions.'
-              }
-            )}
-          </p>
-        </>
-      }
-    />
-  );
-
-  if (status === 'failure') {
-    return failurePrompt;
-  }
-
-  if (status === 'success' && isEmpty(data)) {
-    return emptyStatePrompt;
-  }
-
-  return (
-    <ManagedTable
-      noItemsMessage={<LoadingStatePrompt />}
-      columns={columns}
-      items={data}
-      initialSortField="service.name"
-      initialSortDirection="asc"
-      initialPageSize={50}
-    />
-  );
-}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/List/ConfirmDeleteModal.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/List/ConfirmDeleteModal.tsx
new file mode 100644
index 0000000000000..267aaddc93f76
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/List/ConfirmDeleteModal.tsx
@@ -0,0 +1,119 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState } from 'react';
+import { EuiConfirmModal, EuiOverlayMask } from '@elastic/eui';
+import { NotificationsStart } from 'kibana/public';
+import { i18n } from '@kbn/i18n';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { AgentConfigurationListAPIResponse } from '../../../../../../../../../plugins/apm/server/lib/settings/agent_configuration/list_configurations';
+import { getOptionLabel } from '../../../../../../../../../plugins/apm/common/agent_configuration/all_option';
+import { callApmApi } from '../../../../../services/rest/createCallApmApi';
+import { useApmPluginContext } from '../../../../../hooks/useApmPluginContext';
+
+type Config = AgentConfigurationListAPIResponse[0];
+
+interface Props {
+  config: Config;
+  onCancel: () => void;
+  onConfirm: () => void;
+}
+
+export function ConfirmDeleteModal({ config, onCancel, onConfirm }: Props) {
+  const [isDeleting, setIsDeleting] = useState(false);
+  const { toasts } = useApmPluginContext().core.notifications;
+
+  return (
+    <EuiOverlayMask>
+      <EuiConfirmModal
+        title={i18n.translate('xpack.apm.agentConfig.deleteModal.title', {
+          defaultMessage: `Delete configuration`
+        })}
+        onCancel={onCancel}
+        onConfirm={async () => {
+          setIsDeleting(true);
+          await deleteConfig(config, toasts);
+          setIsDeleting(false);
+          onConfirm();
+        }}
+        cancelButtonText={i18n.translate(
+          'xpack.apm.agentConfig.deleteModal.cancel',
+          { defaultMessage: `Cancel` }
+        )}
+        confirmButtonText={i18n.translate(
+          'xpack.apm.agentConfig.deleteModal.confirm',
+          { defaultMessage: `Delete` }
+        )}
+        confirmButtonDisabled={isDeleting}
+        buttonColor="danger"
+        defaultFocusedButton="confirm"
+      >
+        <p>
+          {i18n.translate('xpack.apm.agentConfig.deleteModal.text', {
+            defaultMessage: `You are about to delete the configuration for service "{serviceName}" and environment "{environment}".`,
+            values: {
+              serviceName: getOptionLabel(config.service.name),
+              environment: getOptionLabel(config.service.environment)
+            }
+          })}
+        </p>
+      </EuiConfirmModal>
+    </EuiOverlayMask>
+  );
+}
+
+async function deleteConfig(
+  config: Config,
+  toasts: NotificationsStart['toasts']
+) {
+  try {
+    await callApmApi({
+      pathname: '/api/apm/settings/agent-configuration',
+      method: 'DELETE',
+      params: {
+        body: {
+          service: {
+            name: config.service.name,
+            environment: config.service.environment
+          }
+        }
+      }
+    });
+
+    toasts.addSuccess({
+      title: i18n.translate(
+        'xpack.apm.agentConfig.deleteSection.deleteConfigSucceededTitle',
+        { defaultMessage: 'Configuration was deleted' }
+      ),
+      text: i18n.translate(
+        'xpack.apm.agentConfig.deleteSection.deleteConfigSucceededText',
+        {
+          defaultMessage:
+            'You have successfully deleted a configuration for "{serviceName}". It will take some time to propagate to the agents.',
+          values: { serviceName: getOptionLabel(config.service.name) }
+        }
+      )
+    });
+  } catch (error) {
+    toasts.addDanger({
+      title: i18n.translate(
+        'xpack.apm.agentConfig.deleteSection.deleteConfigFailedTitle',
+        { defaultMessage: 'Configuration could not be deleted' }
+      ),
+      text: i18n.translate(
+        'xpack.apm.agentConfig.deleteSection.deleteConfigFailedText',
+        {
+          defaultMessage:
+            'Something went wrong when deleting a configuration for "{serviceName}". Error: "{errorMessage}"',
+          values: {
+            serviceName: getOptionLabel(config.service.name),
+            errorMessage: error.message
+          }
+        }
+      )
+    });
+  }
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/List/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/List/index.tsx
new file mode 100644
index 0000000000000..6d5f65121d8fd
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/List/index.tsx
@@ -0,0 +1,221 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import {
+  EuiEmptyPrompt,
+  EuiButton,
+  EuiButtonEmpty,
+  EuiHealth,
+  EuiToolTip,
+  EuiButtonIcon
+} from '@elastic/eui';
+import { isEmpty } from 'lodash';
+import theme from '@elastic/eui/dist/eui_theme_light.json';
+import { FETCH_STATUS } from '../../../../../hooks/useFetcher';
+import { ITableColumn, ManagedTable } from '../../../../shared/ManagedTable';
+import { LoadingStatePrompt } from '../../../../shared/LoadingStatePrompt';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { AgentConfigurationListAPIResponse } from '../../../../../../../../../plugins/apm/server/lib/settings/agent_configuration/list_configurations';
+import { TimestampTooltip } from '../../../../shared/TimestampTooltip';
+import { px, units } from '../../../../../style/variables';
+import { getOptionLabel } from '../../../../../../../../../plugins/apm/common/agent_configuration/all_option';
+import {
+  createAgentConfigurationHref,
+  editAgentConfigurationHref
+} from '../../../../shared/Links/apm/agentConfigurationLinks';
+import { ConfirmDeleteModal } from './ConfirmDeleteModal';
+
+type Config = AgentConfigurationListAPIResponse[0];
+
+export function AgentConfigurationList({
+  status,
+  data,
+  refetch
+}: {
+  status: FETCH_STATUS;
+  data: Config[];
+  refetch: () => void;
+}) {
+  const [configToBeDeleted, setConfigToBeDeleted] = useState<Config | null>(
+    null
+  );
+
+  const emptyStatePrompt = (
+    <EuiEmptyPrompt
+      iconType="controlsHorizontal"
+      title={
+        <h2>
+          {i18n.translate(
+            'xpack.apm.agentConfig.configTable.emptyPromptTitle',
+            { defaultMessage: 'No configurations found.' }
+          )}
+        </h2>
+      }
+      body={
+        <>
+          <p>
+            {i18n.translate(
+              'xpack.apm.agentConfig.configTable.emptyPromptText',
+              {
+                defaultMessage:
+                  "Let's change that! You can fine-tune agent configuration directly from Kibana without having to redeploy. Get started by creating your first configuration."
+              }
+            )}
+          </p>
+        </>
+      }
+      actions={
+        <EuiButton color="primary" fill href={createAgentConfigurationHref()}>
+          {i18n.translate(
+            'xpack.apm.agentConfig.configTable.createConfigButtonLabel',
+            { defaultMessage: 'Create configuration' }
+          )}
+        </EuiButton>
+      }
+    />
+  );
+
+  const failurePrompt = (
+    <EuiEmptyPrompt
+      iconType="alert"
+      body={
+        <>
+          <p>
+            {i18n.translate(
+              'xpack.apm.agentConfig.configTable.configTable.failurePromptText',
+              {
+                defaultMessage:
+                  'The list of agent configurations could not be fetched. Your user may not have the sufficient permissions.'
+              }
+            )}
+          </p>
+        </>
+      }
+    />
+  );
+
+  if (status === FETCH_STATUS.FAILURE) {
+    return failurePrompt;
+  }
+
+  if (status === FETCH_STATUS.SUCCESS && isEmpty(data)) {
+    return emptyStatePrompt;
+  }
+
+  const columns: Array<ITableColumn<Config>> = [
+    {
+      field: 'applied_by_agent',
+      align: 'center',
+      width: px(units.double),
+      name: '',
+      sortable: true,
+      render: (isApplied: boolean) => (
+        <EuiToolTip
+          content={
+            isApplied
+              ? i18n.translate(
+                  'xpack.apm.agentConfig.configTable.appliedTooltipMessage',
+                  { defaultMessage: 'Applied by at least one agent' }
+                )
+              : i18n.translate(
+                  'xpack.apm.agentConfig.configTable.notAppliedTooltipMessage',
+                  { defaultMessage: 'Not yet applied by any agents' }
+                )
+          }
+        >
+          <EuiHealth color={isApplied ? 'success' : theme.euiColorLightShade} />
+        </EuiToolTip>
+      )
+    },
+    {
+      field: 'service.name',
+      name: i18n.translate(
+        'xpack.apm.agentConfig.configTable.serviceNameColumnLabel',
+        { defaultMessage: 'Service name' }
+      ),
+      sortable: true,
+      render: (_, config: Config) => (
+        <EuiButtonEmpty
+          flush="left"
+          size="s"
+          color="primary"
+          href={editAgentConfigurationHref(config.service)}
+        >
+          {getOptionLabel(config.service.name)}
+        </EuiButtonEmpty>
+      )
+    },
+    {
+      field: 'service.environment',
+      name: i18n.translate(
+        'xpack.apm.agentConfig.configTable.environmentColumnLabel',
+        { defaultMessage: 'Service environment' }
+      ),
+      sortable: true,
+      render: (environment: string) => getOptionLabel(environment)
+    },
+    {
+      align: 'right',
+      field: '@timestamp',
+      name: i18n.translate(
+        'xpack.apm.agentConfig.configTable.lastUpdatedColumnLabel',
+        { defaultMessage: 'Last updated' }
+      ),
+      sortable: true,
+      render: (value: number) => (
+        <TimestampTooltip time={value} timeUnit="minutes" />
+      )
+    },
+    {
+      width: px(units.double),
+      name: '',
+      render: (config: Config) => (
+        <EuiButtonIcon
+          aria-label="Edit"
+          iconType="pencil"
+          href={editAgentConfigurationHref(config.service)}
+        />
+      )
+    },
+    {
+      width: px(units.double),
+      name: '',
+      render: (config: Config) => (
+        <EuiButtonIcon
+          aria-label="Delete"
+          iconType="trash"
+          onClick={() => setConfigToBeDeleted(config)}
+        />
+      )
+    }
+  ];
+
+  return (
+    <>
+      {configToBeDeleted && (
+        <ConfirmDeleteModal
+          config={configToBeDeleted}
+          onCancel={() => setConfigToBeDeleted(null)}
+          onConfirm={() => {
+            setConfigToBeDeleted(null);
+            refetch();
+          }}
+        />
+      )}
+
+      <ManagedTable
+        noItemsMessage={<LoadingStatePrompt />}
+        columns={columns}
+        items={data}
+        initialSortField="service.name"
+        initialSortDirection="asc"
+        initialPageSize={20}
+      />
+    </>
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/index.tsx
index 35cc68547d337..8171e339adc82 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/AgentConfigurations/index.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useState } from 'react';
+import React from 'react';
 import { i18n } from '@kbn/i18n';
 import {
   EuiTitle,
@@ -16,97 +16,59 @@ import {
 } from '@elastic/eui';
 import { isEmpty } from 'lodash';
 import { useFetcher } from '../../../../hooks/useFetcher';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { AgentConfigurationListAPIResponse } from '../../../../../../../../plugins/apm/server/lib/settings/agent_configuration/list_configurations';
-import { AgentConfigurationList } from './AgentConfigurationList';
+import { AgentConfigurationList } from './List';
 import { useTrackPageview } from '../../../../../../../../plugins/observability/public';
-import { AddEditFlyout } from './AddEditFlyout';
-
-export type Config = AgentConfigurationListAPIResponse[0];
+import { createAgentConfigurationHref } from '../../../shared/Links/apm/agentConfigurationLinks';
 
 export function AgentConfigurations() {
-  const { data = [], status, refetch } = useFetcher(
+  const { refetch, data = [], status } = useFetcher(
     callApmApi =>
-      callApmApi({ pathname: `/api/apm/settings/agent-configuration` }),
+      callApmApi({ pathname: '/api/apm/settings/agent-configuration' }),
     [],
     { preservePreviousData: false }
   );
-  const [selectedConfig, setSelectedConfig] = useState<Config | null>(null);
-  const [isFlyoutOpen, setIsFlyoutOpen] = useState(false);
 
   useTrackPageview({ app: 'apm', path: 'agent_configuration' });
   useTrackPageview({ app: 'apm', path: 'agent_configuration', delay: 15000 });
 
   const hasConfigurations = !isEmpty(data);
 
-  const onClose = () => {
-    setSelectedConfig(null);
-    setIsFlyoutOpen(false);
-  };
-
   return (
     <>
-      {isFlyoutOpen && (
-        <AddEditFlyout
-          selectedConfig={selectedConfig}
-          onClose={onClose}
-          onSaved={() => {
-            onClose();
-            refetch();
-          }}
-          onDeleted={() => {
-            onClose();
-            refetch();
-          }}
-        />
-      )}
-
       <EuiPanel>
         <EuiFlexGroup alignItems="center">
           <EuiFlexItem grow={false}>
             <EuiTitle>
               <h2>
                 {i18n.translate(
-                  'xpack.apm.settings.agentConf.configurationsPanelTitle',
+                  'xpack.apm.agentConfig.configurationsPanelTitle',
                   { defaultMessage: 'Agent remote configuration' }
                 )}
               </h2>
             </EuiTitle>
           </EuiFlexItem>
 
-          {hasConfigurations ? (
-            <CreateConfigurationButton onClick={() => setIsFlyoutOpen(true)} />
-          ) : null}
+          {hasConfigurations ? <CreateConfigurationButton /> : null}
         </EuiFlexGroup>
 
         <EuiSpacer size="m" />
 
-        <AgentConfigurationList
-          status={status}
-          data={data}
-          setIsFlyoutOpen={setIsFlyoutOpen}
-          setSelectedConfig={setSelectedConfig}
-        />
+        <AgentConfigurationList status={status} data={data} refetch={refetch} />
       </EuiPanel>
     </>
   );
 }
 
-function CreateConfigurationButton({ onClick }: { onClick: () => void }) {
+function CreateConfigurationButton() {
+  const href = createAgentConfigurationHref();
   return (
     <EuiFlexItem>
       <EuiFlexGroup alignItems="center" justifyContent="flexEnd">
         <EuiFlexItem grow={false}>
-          <EuiButton
-            color="primary"
-            fill
-            iconType="plusInCircle"
-            onClick={onClick}
-          >
-            {i18n.translate(
-              'xpack.apm.settings.agentConf.createConfigButtonLabel',
-              { defaultMessage: 'Create configuration' }
-            )}
+          <EuiButton color="primary" fill iconType="plusInCircle" href={href}>
+            {i18n.translate('xpack.apm.agentConfig.createConfigButtonLabel', {
+              defaultMessage: 'Create configuration'
+            })}
           </EuiButton>
         </EuiFlexItem>
       </EuiFlexGroup>
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/ApmIndices/index.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/ApmIndices/index.test.tsx
index fd71bf9709ce9..272c4b3add415 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/ApmIndices/index.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/ApmIndices/index.test.tsx
@@ -7,8 +7,8 @@
 import { render, wait } from '@testing-library/react';
 import React from 'react';
 import { ApmIndices } from '.';
-import { MockApmPluginContextWrapper } from '../../../../utils/testHelpers';
 import * as hooks from '../../../../hooks/useFetcher';
+import { MockApmPluginContextWrapper } from '../../../../context/ApmPluginContext/MockApmPluginContext';
 
 describe('ApmIndices', () => {
   it('should not get stuck in infinite loop', async () => {
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/Documentation.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/Documentation.tsx
new file mode 100644
index 0000000000000..48a0288f11ae5
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/Documentation.tsx
@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { ElasticDocsLink } from '../../../../../shared/Links/ElasticDocsLink';
+
+interface Props {
+  label: string;
+}
+export const Documentation = ({ label }: Props) => (
+  <ElasticDocsLink section="/kibana" path="/custom-links.html" target="_blank">
+    {label}
+  </ElasticDocsLink>
+);
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/FiltersSection.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/FiltersSection.tsx
index 69fecf25f5143..1c253b2fa8bff 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/FiltersSection.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/FiltersSection.tsx
@@ -16,12 +16,11 @@ import {
 import { i18n } from '@kbn/i18n';
 import { isEmpty } from 'lodash';
 import React from 'react';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { FilterOptions } from '../../../../../../../../../../plugins/apm/server/routes/settings/custom_link';
+import { FilterOptions } from '../../../../../../../../../../plugins/apm/common/custom_link_filter_options';
 import {
   DEFAULT_OPTION,
-  Filters,
-  filterSelectOptions,
+  FilterKeyValue,
+  FILTER_SELECT_OPTIONS,
   getSelectOptions
 } from './helper';
 
@@ -29,10 +28,10 @@ export const FiltersSection = ({
   filters,
   onChangeFilters
 }: {
-  filters: Filters;
-  onChangeFilters: (filters: Filters) => void;
+  filters: FilterKeyValue[];
+  onChangeFilters: (filters: FilterKeyValue[]) => void;
 }) => {
-  const onChangeFilter = (filter: Filters[0], idx: number) => {
+  const onChangeFilter = (filter: FilterKeyValue, idx: number) => {
     const newFilters = [...filters];
     newFilters[idx] = filter;
     onChangeFilters(newFilters);
@@ -40,7 +39,8 @@ export const FiltersSection = ({
 
   const onRemoveFilter = (idx: number) => {
     // remove without mutating original array
-    const newFilters = [...filters].splice(idx, 1);
+    const newFilters = [...filters];
+    newFilters.splice(idx, 1);
 
     // if there is only one item left it should not be removed
     // but reset to empty
@@ -68,12 +68,12 @@ export const FiltersSection = ({
         </h3>
       </EuiTitle>
       <EuiSpacer size="s" />
-      <EuiText size="xs">
+      <EuiText size="s">
         {i18n.translate(
           'xpack.apm.settings.customizeUI.customLink.flyout.filters.subtitle',
           {
             defaultMessage:
-              'Add additional values within the same field by comma separating values.'
+              'Use the filter options to scope them to only appear for specific services.'
           }
         )}
       </EuiText>
@@ -83,12 +83,12 @@ export const FiltersSection = ({
       {filters.map((filter, idx) => {
         const [key, value] = filter;
         const filterId = `filter-${idx}`;
-        const selectOptions = getSelectOptions(filters, idx);
+        const selectOptions = getSelectOptions(filters, key);
         return (
           <EuiFlexGroup key={filterId} gutterSize="s" alignItems="center">
             <EuiFlexItem>
               <EuiSelect
-                aria-label={filterId}
+                data-test-subj={filterId}
                 id={filterId}
                 fullWidth
                 options={selectOptions}
@@ -113,6 +113,7 @@ export const FiltersSection = ({
             </EuiFlexItem>
             <EuiFlexItem>
               <EuiFieldText
+                data-test-subj={`value-${idx}`}
                 fullWidth
                 placeholder={i18n.translate(
                   'xpack.apm.settings.customizeUI.customLink.flyOut.filters.defaultOption.value',
@@ -127,7 +128,7 @@ export const FiltersSection = ({
               <EuiButtonEmpty
                 iconType="trash"
                 onClick={() => onRemoveFilter(idx)}
-                disabled={!key && filters.length === 1}
+                disabled={!value && !key && filters.length === 1}
               />
             </EuiFlexItem>
           </EuiFlexGroup>
@@ -139,7 +140,7 @@ export const FiltersSection = ({
       <AddFilterButton
         onClick={handleAddFilter}
         // Disable button when user has already added all items available
-        isDisabled={filters.length === filterSelectOptions.length - 1}
+        isDisabled={filters.length === FILTER_SELECT_OPTIONS.length - 1}
       />
     </>
   );
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkPreview.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkPreview.test.tsx
new file mode 100644
index 0000000000000..9b487cf916089
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkPreview.test.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { LinkPreview } from '../CustomLinkFlyout/LinkPreview';
+import { render, getNodeText, getByTestId } from '@testing-library/react';
+
+describe('LinkPreview', () => {
+  const getElementValue = (container: HTMLElement, id: string) =>
+    getNodeText(
+      ((getByTestId(container, id) as HTMLDivElement)
+        .children as HTMLCollection)[0] as HTMLDivElement
+    );
+
+  it('shows label and url default values', () => {
+    const { container } = render(
+      <LinkPreview label="" url="" filters={[['', '']]} />
+    );
+    expect(getElementValue(container, 'preview-label')).toEqual('Elastic.co');
+    expect(getElementValue(container, 'preview-url')).toEqual(
+      'https://www.elastic.co'
+    );
+  });
+
+  it('shows label and url values', () => {
+    const { container } = render(
+      <LinkPreview label="foo" url="https://baz.co" filters={[['', '']]} />
+    );
+    expect(getElementValue(container, 'preview-label')).toEqual('foo');
+    expect(
+      (getByTestId(container, 'preview-link') as HTMLAnchorElement).text
+    ).toEqual('https://baz.co');
+  });
+
+  it('shows warning when couldnt replace context variables', () => {
+    const { container } = render(
+      <LinkPreview
+        label="foo"
+        url="https://baz.co?service.name={{invalid}"
+        filters={[['', '']]}
+      />
+    );
+    expect(getElementValue(container, 'preview-label')).toEqual('foo');
+    expect(
+      (getByTestId(container, 'preview-link') as HTMLAnchorElement).text
+    ).toEqual('https://baz.co?service.name={{invalid}');
+    expect(getByTestId(container, 'preview-warning')).toBeInTheDocument();
+  });
+});
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkPreview.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkPreview.tsx
new file mode 100644
index 0000000000000..0ad3455ab271f
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkPreview.tsx
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useEffect, useState } from 'react';
+import {
+  EuiPanel,
+  EuiText,
+  EuiSpacer,
+  EuiLink,
+  EuiToolTip,
+  EuiIcon,
+  EuiFlexGroup,
+  EuiFlexItem
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { debounce } from 'lodash';
+import { Transaction } from '../../../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
+import { callApmApi } from '../../../../../../services/rest/createCallApmApi';
+import {
+  FilterKeyValue,
+  convertFiltersToObject,
+  replaceTemplateVariables
+} from './helper';
+
+interface Props {
+  label: string;
+  url: string;
+  filters: FilterKeyValue[];
+}
+
+const fetchTransaction = debounce(
+  async (
+    filters: FilterKeyValue[],
+    callback: (transaction: Transaction) => void
+  ) => {
+    const transaction = await callApmApi({
+      pathname: '/api/apm/settings/custom_links/transaction',
+      params: { query: convertFiltersToObject(filters) }
+    });
+    callback(transaction);
+  },
+  1000
+);
+
+const getTextColor = (value?: string) => (value ? 'default' : 'subdued');
+
+export const LinkPreview = ({ label, url, filters }: Props) => {
+  const [transaction, setTransaction] = useState<Transaction | undefined>();
+
+  useEffect(() => {
+    fetchTransaction(filters, setTransaction);
+  }, [filters]);
+
+  const { formattedUrl, error } = replaceTemplateVariables(url, transaction);
+
+  return (
+    <EuiPanel betaBadgeLabel="Preview" paddingSize="l">
+      <EuiText
+        size="s"
+        color={getTextColor(label)}
+        className="eui-textBreakWord"
+        data-test-subj="preview-label"
+      >
+        {label
+          ? label
+          : i18n.translate(
+              'xpack.apm.settings.customizeUI.customLink.default.label',
+              { defaultMessage: 'Elastic.co' }
+            )}
+      </EuiText>
+
+      <EuiText
+        size="s"
+        color={getTextColor(url)}
+        className="eui-textBreakWord"
+        data-test-subj="preview-url"
+      >
+        {url ? (
+          <EuiLink
+            href={formattedUrl}
+            target="_blank"
+            data-test-subj="preview-link"
+          >
+            {formattedUrl}
+          </EuiLink>
+        ) : (
+          i18n.translate(
+            'xpack.apm.settings.customizeUI.customLink.default.url',
+            { defaultMessage: 'https://www.elastic.co' }
+          )
+        )}
+      </EuiText>
+      <EuiSpacer />
+      <EuiFlexGroup justifyContent="spaceBetween">
+        <EuiFlexItem grow={false}>
+          <EuiText size="s" color="subdued">
+            {i18n.translate(
+              'xpack.apm.settings.customizeUI.customLink.linkPreview.descrition',
+              {
+                defaultMessage:
+                  'Test your link with values from an example transaction document based on the filters above.'
+              }
+            )}
+          </EuiText>
+        </EuiFlexItem>
+
+        <EuiFlexItem grow={false}>
+          {error && (
+            <EuiToolTip position="top" content={error}>
+              <EuiIcon
+                type="alert"
+                color="warning"
+                data-test-subj="preview-warning"
+              />
+            </EuiToolTip>
+          )}
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiPanel>
+  );
+};
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkSection.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkSection.tsx
index 89f55a6c682ca..8bcebc2aea09e 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkSection.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/LinkSection.tsx
@@ -13,11 +13,12 @@ import {
 import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { CustomLink } from '../../../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
+import { Documentation } from './Documentation';
 
 interface InputField {
   name: keyof CustomLink;
   label: string;
-  helpText: string;
+  helpText: string | React.ReactNode;
   placeholder: string;
   onChange: (value: string) => void;
   value?: string;
@@ -69,13 +70,25 @@ export const LinkSection = ({
           defaultMessage: 'URL'
         }
       ),
-      helpText: i18n.translate(
-        'xpack.apm.settings.customizeUI.customLink.flyout.link.url.helpText',
-        {
-          defaultMessage:
-            'Add fieldname variables to your URL to apply values e.g. {sample}. TODO: Learn more in the docs.',
-          values: { sample: '{{trace.id}}' }
-        }
+      helpText: (
+        <>
+          {i18n.translate(
+            'xpack.apm.settings.customizeUI.customLink.flyout.link.url.helpText',
+            {
+              defaultMessage:
+                'Add field name variables to your URL to apply values e.g. {sample}.',
+              values: { sample: '{{trace.id}}' }
+            }
+          )}{' '}
+          <Documentation
+            label={i18n.translate(
+              'xpack.apm.settings.customizeUI.customLink.flyout.link.url.doc',
+              {
+                defaultMessage: 'Learn more in the docs.'
+              }
+            )}
+          />
+        </>
       ),
       placeholder: i18n.translate(
         'xpack.apm.settings.customizeUI.customLink.flyout.link.url.placeholder',
@@ -125,7 +138,7 @@ export const LinkSection = ({
               fullWidth
               value={field.value}
               onChange={e => field.onChange(e.target.value)}
-              aria-label={field.name}
+              data-test-subj={field.name}
             />
           </EuiFormRow>
         );
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/helper.test.ts b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/helper.test.ts
new file mode 100644
index 0000000000000..ac01ee48f2fe5
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/helper.test.ts
@@ -0,0 +1,205 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import {
+  convertFiltersToArray,
+  convertFiltersToObject,
+  getSelectOptions,
+  replaceTemplateVariables
+} from '../CustomLinkFlyout/helper';
+import { CustomLink } from '../../../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
+import { Transaction } from '../../../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
+
+describe('Custom link helper', () => {
+  describe('convertFiltersToArray', () => {
+    it('returns array of tuple when custom link not defined', () => {
+      expect(convertFiltersToArray()).toEqual([['', '']]);
+    });
+    it('returns filters as array', () => {
+      expect(
+        convertFiltersToArray({
+          'service.name': 'foo',
+          'transaction.type': 'bar'
+        } as CustomLink)
+      ).toEqual([
+        ['service.name', 'foo'],
+        ['transaction.type', 'bar']
+      ]);
+    });
+    it('returns empty when no filter is added', () => {
+      expect(
+        convertFiltersToArray({
+          label: 'foo',
+          url: 'bar'
+        } as CustomLink)
+      ).toEqual([['', '']]);
+    });
+  });
+
+  describe('convertFiltersToObject', () => {
+    it('returns undefined when any filter is added', () => {
+      expect(convertFiltersToObject([['', '']])).toBeUndefined();
+    });
+    it('removes uncompleted filters', () => {
+      expect(
+        convertFiltersToObject([
+          ['service.name', ''],
+          ['', 'foo'],
+          ['transaction.type', 'bar']
+        ])
+      ).toEqual({ 'transaction.type': ['bar'] });
+    });
+    it('splits the value by comma', () => {
+      expect(
+        convertFiltersToObject([
+          ['service.name', 'foo'],
+          ['service.environment', 'foo, bar'],
+          ['transaction.type', 'foo, '],
+          ['transaction.name', 'foo,']
+        ])
+      ).toEqual({
+        'service.name': ['foo'],
+        'service.environment': ['foo', 'bar'],
+        'transaction.type': ['foo'],
+        'transaction.name': ['foo']
+      });
+    });
+  });
+
+  describe('getSelectOptions', () => {
+    it('returns all available options when no filters were selected', () => {
+      expect(
+        getSelectOptions(
+          [
+            ['', ''],
+            ['', ''],
+            ['', ''],
+            ['', '']
+          ],
+          ''
+        )
+      ).toEqual([
+        { value: 'DEFAULT', text: 'Select field...' },
+        { value: 'service.name', text: 'service.name' },
+        { value: 'service.environment', text: 'service.environment' },
+        { value: 'transaction.type', text: 'transaction.type' },
+        { value: 'transaction.name', text: 'transaction.name' }
+      ]);
+    });
+    it('removes item added in another filter', () => {
+      expect(
+        getSelectOptions(
+          [
+            ['service.name', 'foo'],
+            ['', ''],
+            ['', ''],
+            ['', '']
+          ],
+          ''
+        )
+      ).toEqual([
+        { value: 'DEFAULT', text: 'Select field...' },
+        { value: 'service.environment', text: 'service.environment' },
+        { value: 'transaction.type', text: 'transaction.type' },
+        { value: 'transaction.name', text: 'transaction.name' }
+      ]);
+    });
+    it('removes item added in another filter but keep the current selected', () => {
+      expect(
+        getSelectOptions(
+          [
+            ['service.name', 'foo'],
+            ['transaction.name', 'bar'],
+            ['', ''],
+            ['', '']
+          ],
+          'transaction.name'
+        )
+      ).toEqual([
+        { value: 'DEFAULT', text: 'Select field...' },
+        { value: 'service.environment', text: 'service.environment' },
+        { value: 'transaction.type', text: 'transaction.type' },
+        { value: 'transaction.name', text: 'transaction.name' }
+      ]);
+    });
+    it('returns empty when all option were selected', () => {
+      expect(
+        getSelectOptions(
+          [
+            ['service.name', 'foo'],
+            ['transaction.name', 'bar'],
+            ['service.environment', 'baz'],
+            ['transaction.type', 'qux']
+          ],
+          ''
+        )
+      ).toEqual([{ value: 'DEFAULT', text: 'Select field...' }]);
+    });
+  });
+
+  describe('replaceTemplateVariables', () => {
+    const transaction = ({
+      service: { name: 'foo' },
+      trace: { id: '123' }
+    } as unknown) as Transaction;
+
+    it('replaces template variables', () => {
+      expect(
+        replaceTemplateVariables(
+          'https://elastic.co?service.name={{service.name}}&trace.id={{trace.id}}',
+          transaction
+        )
+      ).toEqual({
+        error: undefined,
+        formattedUrl: 'https://elastic.co?service.name=foo&trace.id=123'
+      });
+    });
+
+    it('returns error when transaction is not defined', () => {
+      const expectedResult = {
+        error:
+          "We couldn't find a matching transaction document based on the defined filters.",
+        formattedUrl: 'https://elastic.co?service.name=&trace.id='
+      };
+      expect(
+        replaceTemplateVariables(
+          'https://elastic.co?service.name={{service.name}}&trace.id={{trace.id}}'
+        )
+      ).toEqual(expectedResult);
+      expect(
+        replaceTemplateVariables(
+          'https://elastic.co?service.name={{service.name}}&trace.id={{trace.id}}',
+          ({} as unknown) as Transaction
+        )
+      ).toEqual(expectedResult);
+    });
+
+    it('returns error when could not replace variables', () => {
+      expect(
+        replaceTemplateVariables(
+          'https://elastic.co?service.name={{service.nam}}&trace.id={{trace.i}}',
+          transaction
+        )
+      ).toEqual({
+        error:
+          "We couldn't find a value match for {{service.nam}}, {{trace.i}} in the example transaction document.",
+        formattedUrl: 'https://elastic.co?service.name=&trace.id='
+      });
+    });
+
+    it('returns error when variable is invalid', () => {
+      expect(
+        replaceTemplateVariables(
+          'https://elastic.co?service.name={{service.name}',
+          transaction
+        )
+      ).toEqual({
+        error:
+          "We couldn't find an example transaction document due to invalid variable(s) defined.",
+        formattedUrl: 'https://elastic.co?service.name={{service.name}'
+      });
+    });
+  });
+});
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/helper.ts b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/helper.ts
index bb86a251594ab..df99c82c71b70 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/helper.ts
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/helper.ts
@@ -4,15 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { i18n } from '@kbn/i18n';
-import { isEmpty, pick } from 'lodash';
+import Mustache from 'mustache';
+import { isEmpty, pick, get } from 'lodash';
+import { Transaction } from '../../../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
 import {
   FilterOptions,
-  filterOptions
-  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
-} from '../../../../../../../../../../plugins/apm/server/routes/settings/custom_link';
+  FILTER_OPTIONS
+} from '../../../../../../../../../../plugins/apm/common/custom_link_filter_options';
 import { CustomLink } from '../../../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
 
-export type Filters = Array<[keyof FilterOptions | '', string]>;
+type FilterKey = keyof FilterOptions | '';
+type FilterValue = string;
+export type FilterKeyValue = [FilterKey, FilterValue];
 
 interface FilterSelectOption {
   value: 'DEFAULT' | keyof FilterOptions;
@@ -33,9 +36,13 @@ interface FilterSelectOption {
  * results: [['service.name', 'opbeans-java'],['transaction.type', 'request']]
  * @param customLink
  */
-export const convertFiltersToArray = (customLink?: CustomLink): Filters => {
+export const convertFiltersToArray = (
+  customLink?: CustomLink
+): FilterKeyValue[] => {
   if (customLink) {
-    const filters = Object.entries(pick(customLink, filterOptions)) as Filters;
+    const filters = Object.entries(
+      pick(customLink, FILTER_OPTIONS)
+    ) as FilterKeyValue[];
     if (!isEmpty(filters)) {
       return filters;
     }
@@ -54,9 +61,18 @@ export const convertFiltersToArray = (customLink?: CustomLink): Filters => {
  * }
  * @param filters
  */
-export const convertFiltersToObject = (filters: Filters) => {
+export const convertFiltersToObject = (filters: FilterKeyValue[]) => {
   const convertedFilters = Object.fromEntries(
-    filters.filter(([key, value]) => !isEmpty(key) && !isEmpty(value))
+    filters
+      .filter(([key, value]) => !isEmpty(key) && !isEmpty(value))
+      .map(([key, value]) => [
+        key,
+        // Splits the value by comma, removes whitespace from both ends and filters out empty values
+        value
+          .split(',')
+          .map(v => v.trim())
+          .filter(v => v)
+      ])
   );
   if (!isEmpty(convertedFilters)) {
     return convertedFilters;
@@ -71,9 +87,9 @@ export const DEFAULT_OPTION: FilterSelectOption = {
   )
 };
 
-export const filterSelectOptions: FilterSelectOption[] = [
+export const FILTER_SELECT_OPTIONS: FilterSelectOption[] = [
   DEFAULT_OPTION,
-  ...filterOptions.map(filter => ({
+  ...FILTER_OPTIONS.map(filter => ({
     value: filter as keyof FilterOptions,
     text: filter
   }))
@@ -83,14 +99,76 @@ export const filterSelectOptions: FilterSelectOption[] = [
  * Returns the options available, removing filters already added, but keeping the selected filter.
  *
  * @param filters
- * @param idx
+ * @param selectedKey
  */
-export const getSelectOptions = (filters: Filters, idx: number) => {
-  return filterSelectOptions.filter(option => {
-    const indexUsedFilter = filters.findIndex(
-      filter => filter[0] === option.value
+export const getSelectOptions = (
+  filters: FilterKeyValue[],
+  selectedKey: FilterKey
+) => {
+  return FILTER_SELECT_OPTIONS.filter(
+    ({ value }) =>
+      !filters.some(
+        ([filterKey]) => filterKey === value && filterKey !== selectedKey
+      )
+  );
+};
+
+const getInvalidTemplateVariables = (
+  template: string,
+  transaction: Transaction
+) => {
+  return (Mustache.parse(template) as Array<[string, string]>)
+    .filter(([type]) => type === 'name')
+    .map(([, value]) => value)
+    .filter(templateVar => get(transaction, templateVar) == null);
+};
+
+const validateUrl = (url: string, transaction?: Transaction) => {
+  if (!transaction || isEmpty(transaction)) {
+    return i18n.translate(
+      'xpack.apm.settings.customizeUI.customLink.preview.transaction.notFound',
+      {
+        defaultMessage:
+          "We couldn't find a matching transaction document based on the defined filters."
+      }
+    );
+  }
+  try {
+    const invalidVariables = getInvalidTemplateVariables(url, transaction);
+    if (!isEmpty(invalidVariables)) {
+      return i18n.translate(
+        'xpack.apm.settings.customizeUI.customLink.preview.contextVariable.noMatch',
+        {
+          defaultMessage:
+            "We couldn't find a value match for {variables} in the example transaction document.",
+          values: {
+            variables: invalidVariables
+              .map(variable => `{{${variable}}}`)
+              .join(', ')
+          }
+        }
+      );
+    }
+  } catch (e) {
+    return i18n.translate(
+      'xpack.apm.settings.customizeUI.customLink.preview.contextVariable.invalid',
+      {
+        defaultMessage:
+          "We couldn't find an example transaction document due to invalid variable(s) defined."
+      }
     );
-    // Filter out all items already added, besides the one selected in the current filter.
-    return indexUsedFilter === -1 || idx === indexUsedFilter;
-  });
+  }
+};
+
+export const replaceTemplateVariables = (
+  url: string,
+  transaction?: Transaction
+) => {
+  const error = validateUrl(url, transaction);
+  try {
+    return { formattedUrl: Mustache.render(url, transaction), error };
+  } catch (e) {
+    // errors will be caught on validateUrl function
+    return { formattedUrl: url, error };
+  }
 };
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/index.tsx
index 88358c888160b..68755bad5f652 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/index.tsx
@@ -21,6 +21,8 @@ import { FlyoutFooter } from './FlyoutFooter';
 import { LinkSection } from './LinkSection';
 import { saveCustomLink } from './saveCustomLink';
 import { convertFiltersToArray, convertFiltersToObject } from './helper';
+import { LinkPreview } from './LinkPreview';
+import { Documentation } from './Documentation';
 
 interface Props {
   onClose: () => void;
@@ -87,9 +89,17 @@ export const CustomLinkFlyout = ({
                   'xpack.apm.settings.customizeUI.customLink.flyout.label',
                   {
                     defaultMessage:
-                      'Links will be available in the context of transaction details throughout the APM app. You can create an unlimited number of links and use the filter options to scope them to only appear for specific services. You can refer to dynamic variables by using any of the transaction metadata to fill in your URLs. TODO: Learn more about it in the docs.'
+                      'Links will be available in the context of transaction details throughout the APM app. You can create an unlimited number of links. You can refer to dynamic variables by using any of the transaction metadata to fill in your URLs. More information, including examples, are available in the'
                   }
-                )}
+                )}{' '}
+                <Documentation
+                  label={i18n.translate(
+                    'xpack.apm.settings.customizeUI.customLink.flyout.label.doc',
+                    {
+                      defaultMessage: 'documentation.'
+                    }
+                  )}
+                />
               </p>
             </EuiText>
 
@@ -105,6 +115,10 @@ export const CustomLinkFlyout = ({
             <EuiSpacer size="l" />
 
             <FiltersSection filters={filters} onChangeFilters={setFilters} />
+
+            <EuiSpacer size="l" />
+
+            <LinkPreview label={label} url={url} filters={filters} />
           </EuiFlyoutBody>
 
           <FlyoutFooter
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/saveCustomLink.ts b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/saveCustomLink.ts
index f255840e1d734..815ce1d95c385 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/saveCustomLink.ts
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout/saveCustomLink.ts
@@ -18,7 +18,7 @@ export async function saveCustomLink({
   id?: string;
   label: string;
   url: string;
-  filters?: { [key: string]: string };
+  filters?: { [key: string]: string[] };
   toasts: NotificationsStart['toasts'];
 }) {
   try {
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/__test__/CustomLink.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.test.tsx
similarity index 56%
rename from x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/__test__/CustomLink.test.tsx
rename to x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.test.tsx
index f02cc2be8268d..b5bee5a5a1ebb 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/__test__/CustomLink.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.test.tsx
@@ -7,14 +7,17 @@
 import { fireEvent, render, wait } from '@testing-library/react';
 import React from 'react';
 import { act } from 'react-dom/test-utils';
-import { CustomLinkOverview } from '../';
-import * as hooks from '../../../../../../hooks/useFetcher';
+import * as apmApi from '../../../../../services/rest/createCallApmApi';
+import { License } from '../../../../../../../../../plugins/licensing/common/license';
+import * as hooks from '../../../../../hooks/useFetcher';
+import { LicenseContext } from '../../../../../context/LicenseContext';
+import { CustomLinkOverview } from '.';
 import {
   expectTextsInDocument,
-  MockApmPluginContextWrapper
-} from '../../../../../../utils/testHelpers';
-import * as saveCustomLink from '../CustomLinkFlyout/saveCustomLink';
-import * as apmApi from '../../../../../../services/rest/createCallApmApi';
+  expectTextsNotInDocument
+} from '../../../../../utils/testHelpers';
+import * as saveCustomLink from './CustomLinkFlyout/saveCustomLink';
+import { MockApmPluginContextWrapper } from '../../../../../context/ApmPluginContext/MockApmPluginContext';
 
 const data = [
   {
@@ -32,6 +35,23 @@ const data = [
 ];
 
 describe('CustomLink', () => {
+  let callApmApiSpy: Function;
+  beforeAll(() => {
+    callApmApiSpy = spyOn(apmApi, 'callApmApi').and.returnValue({});
+  });
+  afterAll(() => {
+    jest.resetAllMocks();
+  });
+  const goldLicense = new License({
+    signature: 'test signature',
+    license: {
+      expiryDateInMillis: 0,
+      mode: 'gold',
+      status: 'active',
+      type: 'gold',
+      uid: '1'
+    }
+  });
   describe('empty prompt', () => {
     beforeAll(() => {
       spyOn(hooks, 'useFetcher').and.returnValue({
@@ -44,14 +64,20 @@ describe('CustomLink', () => {
       jest.clearAllMocks();
     });
     it('shows when no link is available', () => {
-      const component = render(<CustomLinkOverview />);
+      const component = render(
+        <LicenseContext.Provider value={goldLicense}>
+          <CustomLinkOverview />
+        </LicenseContext.Provider>
+      );
       expectTextsInDocument(component, ['No links found.']);
     });
     it('opens flyout when click to create new link', () => {
       const { queryByText, getByText } = render(
-        <MockApmPluginContextWrapper>
-          <CustomLinkOverview />
-        </MockApmPluginContextWrapper>
+        <LicenseContext.Provider value={goldLicense}>
+          <MockApmPluginContextWrapper>
+            <CustomLinkOverview />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
       );
       expect(queryByText('Create link')).not.toBeInTheDocument();
       act(() => {
@@ -75,9 +101,11 @@ describe('CustomLink', () => {
 
     it('shows a table with all custom link', () => {
       const component = render(
-        <MockApmPluginContextWrapper>
-          <CustomLinkOverview />
-        </MockApmPluginContextWrapper>
+        <LicenseContext.Provider value={goldLicense}>
+          <MockApmPluginContextWrapper>
+            <CustomLinkOverview />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
       );
       expectTextsInDocument(component, [
         'label 1',
@@ -89,9 +117,11 @@ describe('CustomLink', () => {
 
     it('checks if create custom link button is available and working', () => {
       const { queryByText, getByText } = render(
-        <MockApmPluginContextWrapper>
-          <CustomLinkOverview />
-        </MockApmPluginContextWrapper>
+        <LicenseContext.Provider value={goldLicense}>
+          <MockApmPluginContextWrapper>
+            <CustomLinkOverview />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
       );
       expect(queryByText('Create link')).not.toBeInTheDocument();
       act(() => {
@@ -103,10 +133,8 @@ describe('CustomLink', () => {
 
   describe('Flyout', () => {
     const refetch = jest.fn();
-    let callApmApiSpy: Function;
     let saveCustomLinkSpy: Function;
     beforeAll(() => {
-      callApmApiSpy = spyOn(apmApi, 'callApmApi');
       saveCustomLinkSpy = spyOn(saveCustomLink, 'saveCustomLink');
       spyOn(hooks, 'useFetcher').and.returnValue({
         data,
@@ -120,9 +148,11 @@ describe('CustomLink', () => {
 
     const openFlyout = () => {
       const component = render(
-        <MockApmPluginContextWrapper>
-          <CustomLinkOverview />
-        </MockApmPluginContextWrapper>
+        <LicenseContext.Provider value={goldLicense}>
+          <MockApmPluginContextWrapper>
+            <CustomLinkOverview />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
       );
       expect(component.queryByText('Create link')).not.toBeInTheDocument();
       act(() => {
@@ -134,13 +164,13 @@ describe('CustomLink', () => {
 
     it('creates a custom link', async () => {
       const component = openFlyout();
-      const labelInput = component.getByLabelText('label');
+      const labelInput = component.getByTestId('label');
       act(() => {
         fireEvent.change(labelInput, {
           target: { value: 'foo' }
         });
       });
-      const urlInput = component.getByLabelText('url');
+      const urlInput = component.getByTestId('url');
       act(() => {
         fireEvent.change(urlInput, {
           target: { value: 'bar' }
@@ -154,9 +184,11 @@ describe('CustomLink', () => {
 
     it('deletes a custom link', async () => {
       const component = render(
-        <MockApmPluginContextWrapper>
-          <CustomLinkOverview />
-        </MockApmPluginContextWrapper>
+        <LicenseContext.Provider value={goldLicense}>
+          <MockApmPluginContextWrapper>
+            <CustomLinkOverview />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
       );
       expect(component.queryByText('Create link')).not.toBeInTheDocument();
       const editButtons = component.getAllByLabelText('Edit');
@@ -204,9 +236,7 @@ describe('CustomLink', () => {
           if (addNewFilter) {
             addFilterField(component, 1);
           }
-          const field = component.getByLabelText(
-            fieldName
-          ) as HTMLSelectElement;
+          const field = component.getByTestId(fieldName) as HTMLSelectElement;
           const optionsAvailable = Object.values(field)
             .map(option => (option as HTMLOptionElement).text)
             .filter(option => option);
@@ -248,4 +278,93 @@ describe('CustomLink', () => {
       });
     });
   });
+
+  describe('invalid license', () => {
+    beforeAll(() => {
+      spyOn(hooks, 'useFetcher').and.returnValue({
+        data: [],
+        status: 'success'
+      });
+    });
+    it('shows license prompt when user has a basic license', () => {
+      const license = new License({
+        signature: 'test signature',
+        license: {
+          expiryDateInMillis: 0,
+          mode: 'basic',
+          status: 'active',
+          type: 'basic',
+          uid: '1'
+        }
+      });
+      const component = render(
+        <LicenseContext.Provider value={license}>
+          <MockApmPluginContextWrapper>
+            <CustomLinkOverview />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
+      );
+      expectTextsInDocument(component, ['Start free 30-day trial']);
+    });
+    it('shows license prompt when user has an invalid gold license', () => {
+      const license = new License({
+        signature: 'test signature',
+        license: {
+          expiryDateInMillis: 0,
+          mode: 'gold',
+          status: 'invalid',
+          type: 'gold',
+          uid: '1'
+        }
+      });
+      const component = render(
+        <LicenseContext.Provider value={license}>
+          <MockApmPluginContextWrapper>
+            <CustomLinkOverview />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
+      );
+      expectTextsInDocument(component, ['Start free 30-day trial']);
+    });
+    it('shows license prompt when user has an invalid trial license', () => {
+      const license = new License({
+        signature: 'test signature',
+        license: {
+          expiryDateInMillis: 0,
+          mode: 'trial',
+          status: 'invalid',
+          type: 'trial',
+          uid: '1'
+        }
+      });
+      const component = render(
+        <LicenseContext.Provider value={license}>
+          <MockApmPluginContextWrapper>
+            <CustomLinkOverview />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
+      );
+      expectTextsInDocument(component, ['Start free 30-day trial']);
+    });
+    it('doesnt show license prompt when user has a trial license', () => {
+      const license = new License({
+        signature: 'test signature',
+        license: {
+          expiryDateInMillis: 0,
+          mode: 'trial',
+          status: 'active',
+          type: 'trial',
+          uid: '1'
+        }
+      });
+      const component = render(
+        <LicenseContext.Provider value={license}>
+          <MockApmPluginContextWrapper>
+            <CustomLinkOverview />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
+      );
+      expectTextsNotInDocument(component, ['Start free 30-day trial']);
+    });
+  });
 });
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.tsx
index bc1882c8c2785..a4985d4410699 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/CustomizeUI/CustomLink/index.tsx
@@ -7,6 +7,8 @@
 import { EuiPanel, EuiSpacer, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { isEmpty } from 'lodash';
 import React, { useEffect, useState } from 'react';
+import { i18n } from '@kbn/i18n';
+import { useLicense } from '../../../../../hooks/useLicense';
 import { CustomLink } from '../../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
 import { useFetcher, FETCH_STATUS } from '../../../../../hooks/useFetcher';
 import { CustomLinkFlyout } from './CustomLinkFlyout';
@@ -14,8 +16,12 @@ import { CustomLinkTable } from './CustomLinkTable';
 import { EmptyPrompt } from './EmptyPrompt';
 import { Title } from './Title';
 import { CreateCustomLinkButton } from './CreateCustomLinkButton';
+import { LicensePrompt } from '../../../../shared/LicensePrompt';
 
 export const CustomLinkOverview = () => {
+  const license = useLicense();
+  const hasValidLicense = license?.isActive && license?.hasAtLeast('gold');
+
   const [isFlyoutOpen, setIsFlyoutOpen] = useState(false);
   const [customLinkSelected, setCustomLinkSelected] = useState<
     CustomLink | undefined
@@ -65,7 +71,7 @@ export const CustomLinkOverview = () => {
           <EuiFlexItem grow={false}>
             <Title />
           </EuiFlexItem>
-          {!showEmptyPrompt && (
+          {hasValidLicense && !showEmptyPrompt && (
             <EuiFlexItem>
               <EuiFlexGroup alignItems="center" justifyContent="flexEnd">
                 <EuiFlexItem grow={false}>
@@ -77,13 +83,24 @@ export const CustomLinkOverview = () => {
         </EuiFlexGroup>
 
         <EuiSpacer size="m" />
-
-        {showEmptyPrompt ? (
-          <EmptyPrompt onCreateCustomLinkClick={onCreateCustomLinkClick} />
+        {hasValidLicense ? (
+          showEmptyPrompt ? (
+            <EmptyPrompt onCreateCustomLinkClick={onCreateCustomLinkClick} />
+          ) : (
+            <CustomLinkTable
+              items={customLinks}
+              onCustomLinkSelected={setCustomLinkSelected}
+            />
+          )
         ) : (
-          <CustomLinkTable
-            items={customLinks}
-            onCustomLinkSelected={setCustomLinkSelected}
+          <LicensePrompt
+            text={i18n.translate(
+              'xpack.apm.settings.customizeUI.customLink.license.text',
+              {
+                defaultMessage:
+                  "To create custom links, you must be subscribed to an Elastic Gold license or above. With it, you'll have the ability to create custom links to improve your workflow when analyzing your services."
+              }
+            )}
           />
         )}
       </EuiPanel>
diff --git a/x-pack/legacy/plugins/apm/public/components/app/Settings/index.tsx b/x-pack/legacy/plugins/apm/public/components/app/Settings/index.tsx
index eef386731c5c3..f33bb17decd4e 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/Settings/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/Settings/index.tsx
@@ -39,23 +39,20 @@ export const Settings: React.FC = props => {
                 id: 0,
                 items: [
                   {
-                    name: i18n.translate(
-                      'xpack.apm.settings.agentConfiguration',
-                      {
-                        defaultMessage: 'Agent Configuration'
-                      }
-                    ),
+                    name: i18n.translate('xpack.apm.settings.agentConfig', {
+                      defaultMessage: 'Agent Configuration'
+                    }),
                     id: '1',
-                    // @ts-ignore
                     href: getAPMHref('/settings/agent-configuration', search),
-                    isSelected: pathname === '/settings/agent-configuration'
+                    isSelected: pathname.startsWith(
+                      '/settings/agent-configuration'
+                    )
                   },
                   {
                     name: i18n.translate('xpack.apm.settings.indices', {
                       defaultMessage: 'Indices'
                     }),
                     id: '2',
-                    // @ts-ignore
                     href: getAPMHref('/settings/apm-indices', search),
                     isSelected: pathname === '/settings/apm-indices'
                   },
@@ -64,7 +61,6 @@ export const Settings: React.FC = props => {
                       defaultMessage: 'Customize UI'
                     }),
                     id: '3',
-                    // @ts-ignore
                     href: getAPMHref('/settings/customize-ui', search),
                     isSelected: pathname === '/settings/customize-ui'
                   }
diff --git a/x-pack/legacy/plugins/apm/public/components/app/TraceLink/__test__/TraceLink.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/TraceLink/__test__/TraceLink.test.tsx
index fe58fc39c6cfa..b8d6d9818eb2c 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/TraceLink/__test__/TraceLink.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/TraceLink/__test__/TraceLink.test.tsx
@@ -9,7 +9,7 @@ import React from 'react';
 import { TraceLink } from '../';
 import * as hooks from '../../../../hooks/useFetcher';
 import * as urlParamsHooks from '../../../../hooks/useUrlParams';
-import { MockApmPluginContextWrapper } from '../../../../utils/testHelpers';
+import { MockApmPluginContextWrapper } from '../../../../context/ApmPluginContext/MockApmPluginContext';
 
 const renderOptions = { wrapper: MockApmPluginContextWrapper };
 
diff --git a/x-pack/legacy/plugins/apm/public/components/app/TransactionOverview/__jest__/TransactionOverview.test.tsx b/x-pack/legacy/plugins/apm/public/components/app/TransactionOverview/__jest__/TransactionOverview.test.tsx
index 882682f1f6760..22cbeee5c6b7c 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/TransactionOverview/__jest__/TransactionOverview.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/app/TransactionOverview/__jest__/TransactionOverview.test.tsx
@@ -22,7 +22,7 @@ import * as useFetcherHook from '../../../../hooks/useFetcher';
 import { fromQuery } from '../../../shared/Links/url_helpers';
 import { Router } from 'react-router-dom';
 import { UrlParamsProvider } from '../../../../context/UrlParamsContext';
-import { MockApmPluginContextWrapper } from '../../../../utils/testHelpers';
+import { MockApmPluginContextWrapper } from '../../../../context/ApmPluginContext/MockApmPluginContext';
 
 jest.spyOn(history, 'push');
 jest.spyOn(history, 'replace');
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.stories.tsx b/x-pack/legacy/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.stories.tsx
new file mode 100644
index 0000000000000..4ef8de7c2b208
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.stories.tsx
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { storiesOf } from '@storybook/react';
+import React from 'react';
+import { ErrorRateAlertTrigger } from '.';
+
+storiesOf('app/ErrorRateAlertTrigger', module).add('example', props => {
+  const params = {
+    threshold: 2,
+    window: '5m'
+  };
+
+  return (
+    <div style={{ width: 400 }}>
+      <ErrorRateAlertTrigger
+        alertParams={params as any}
+        setAlertParams={() => undefined}
+        setAlertProperty={() => undefined}
+      />
+    </div>
+  );
+});
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.tsx b/x-pack/legacy/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.tsx
new file mode 100644
index 0000000000000..6d0a2b96092a1
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/ErrorRateAlertTrigger/index.tsx
@@ -0,0 +1,84 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { EuiFieldNumber } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { ForLastExpression } from '../../../../../../../plugins/triggers_actions_ui/public';
+import { ALERT_TYPES_CONFIG } from '../../../../../../../plugins/apm/common/alert_types';
+import { ServiceAlertTrigger } from '../ServiceAlertTrigger';
+import { PopoverExpression } from '../ServiceAlertTrigger/PopoverExpression';
+
+export interface ErrorRateAlertTriggerParams {
+  windowSize: number;
+  windowUnit: string;
+  threshold: number;
+}
+
+interface Props {
+  alertParams: ErrorRateAlertTriggerParams;
+  setAlertParams: (key: string, value: any) => void;
+  setAlertProperty: (key: string, value: any) => void;
+}
+
+export function ErrorRateAlertTrigger(props: Props) {
+  const { setAlertParams, setAlertProperty, alertParams } = props;
+
+  const defaults = {
+    threshold: 25,
+    windowSize: 1,
+    windowUnit: 'm'
+  };
+
+  const params = {
+    ...defaults,
+    ...alertParams
+  };
+
+  const fields = [
+    <PopoverExpression
+      title={i18n.translate('xpack.apm.errorRateAlertTrigger.isAbove', {
+        defaultMessage: 'is above'
+      })}
+      value={params.threshold.toString()}
+    >
+      <EuiFieldNumber
+        value={alertParams.threshold ?? ''}
+        step={0}
+        onChange={e =>
+          setAlertParams('threshold', parseInt(e.target.value, 10))
+        }
+        compressed
+        append={i18n.translate('xpack.apm.errorRateAlertTrigger.errors', {
+          defaultMessage: 'errors'
+        })}
+      />
+    </PopoverExpression>,
+    <ForLastExpression
+      onChangeWindowSize={windowSize =>
+        setAlertParams('windowSize', windowSize)
+      }
+      onChangeWindowUnit={windowUnit =>
+        setAlertParams('windowUnit', windowUnit)
+      }
+      timeWindowSize={params.windowSize}
+      timeWindowUnit={params.windowUnit}
+      errors={{
+        timeWindowSize: [],
+        timeWindowUnit: []
+      }}
+    />
+  ];
+
+  return (
+    <ServiceAlertTrigger
+      alertTypeName={ALERT_TYPES_CONFIG['apm.error_rate'].name}
+      defaults={defaults}
+      fields={fields}
+      setAlertParams={setAlertParams}
+      setAlertProperty={setAlertProperty}
+    />
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/KueryBar/index.tsx b/x-pack/legacy/plugins/apm/public/components/shared/KueryBar/index.tsx
index bea1de18384a3..dba31822dd23e 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/KueryBar/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/KueryBar/index.tsx
@@ -79,7 +79,7 @@ export function KueryBar() {
   const disabled = /\/service-map$/.test(location.pathname);
   const disabledPlaceholder = i18n.translate(
     'xpack.apm.kueryBar.disabledPlaceholder',
-    { defaultMessage: 'Search is not available for service maps' }
+    { defaultMessage: 'Search is not available for service map' }
   );
 
   async function onChange(inputValue: string, selectionStart: number) {
diff --git a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/PlatinumLicensePrompt.stories.tsx b/x-pack/legacy/plugins/apm/public/components/shared/LicensePrompt/LicensePrompt.stories.tsx
similarity index 79%
rename from x-pack/legacy/plugins/apm/public/components/app/ServiceMap/PlatinumLicensePrompt.stories.tsx
rename to x-pack/legacy/plugins/apm/public/components/shared/LicensePrompt/LicensePrompt.stories.tsx
index 80281c1a0a8fc..010bba7677f00 100644
--- a/x-pack/legacy/plugins/apm/public/components/app/ServiceMap/PlatinumLicensePrompt.stories.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/LicensePrompt/LicensePrompt.stories.tsx
@@ -6,13 +6,13 @@
 
 import { storiesOf } from '@storybook/react';
 import React from 'react';
-import { PlatinumLicensePrompt } from './PlatinumLicensePrompt';
 import {
   ApmPluginContext,
   ApmPluginContextValue
 } from '../../../context/ApmPluginContext';
+import { LicensePrompt } from '.';
 
-storiesOf('app/ServiceMap/PlatinumLicensePrompt', module).add(
+storiesOf('app/LicensePrompt', module).add(
   'example',
   () => {
     const contextMock = ({
@@ -21,7 +21,7 @@ storiesOf('app/ServiceMap/PlatinumLicensePrompt', module).add(
 
     return (
       <ApmPluginContext.Provider value={contextMock}>
-        <PlatinumLicensePrompt />
+        <LicensePrompt text="To create Feature name, you must be subscribed to an Elastic X license or above." />
       </ApmPluginContext.Provider>
     );
   },
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/LicensePrompt/index.tsx b/x-pack/legacy/plugins/apm/public/components/shared/LicensePrompt/index.tsx
new file mode 100644
index 0000000000000..d2afefb83a568
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/LicensePrompt/index.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiButton, EuiEmptyPrompt, EuiPanel } from '@elastic/eui';
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { useKibanaUrl } from '../../../hooks/useKibanaUrl';
+
+interface Props {
+  text: string;
+  showBetaBadge?: boolean;
+}
+
+export const LicensePrompt = ({ text, showBetaBadge = false }: Props) => {
+  const licensePageUrl = useKibanaUrl(
+    '/app/kibana',
+    '/management/elasticsearch/license_management/home'
+  );
+
+  const renderLicenseBody = (
+    <EuiEmptyPrompt
+      iconType="iInCircle"
+      iconColor="subdued"
+      title={
+        <h2>
+          {i18n.translate('xpack.apm.license.title', {
+            defaultMessage: 'Start free 30-day trial'
+          })}
+        </h2>
+      }
+      body={<p>{text}</p>}
+      actions={
+        <EuiButton fill={true} href={licensePageUrl}>
+          {i18n.translate('xpack.apm.license.button', {
+            defaultMessage: 'Start trial'
+          })}
+        </EuiButton>
+      }
+    />
+  );
+
+  const renderWithBetaBadge = (
+    <EuiPanel
+      betaBadgeLabel={i18n.translate('xpack.apm.license.betaBadge', {
+        defaultMessage: 'Beta'
+      })}
+      betaBadgeTooltipContent={i18n.translate(
+        'xpack.apm.license.betaTooltipMessage',
+        {
+          defaultMessage:
+            'This feature is currently in beta. If you encounter any bugs or have feedback, please open an issue or visit our discussion forum.'
+        }
+      )}
+    >
+      {renderLicenseBody}
+    </EuiPanel>
+  );
+
+  return <>{showBetaBadge ? renderWithBetaBadge : renderLicenseBody}</>;
+};
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/Links/ElasticDocsLink.tsx b/x-pack/legacy/plugins/apm/public/components/shared/Links/ElasticDocsLink.tsx
index 0e0c318ad3299..9fcab049e224f 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/Links/ElasticDocsLink.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/Links/ElasticDocsLink.tsx
@@ -9,7 +9,7 @@ import { EuiLink, EuiLinkAnchorProps } from '@elastic/eui';
 import { useApmPluginContext } from '../../../hooks/useApmPluginContext';
 
 // union type constisting of valid guide sections that we link to
-type DocsSection = '/apm/get-started' | '/x-pack' | '/apm/server';
+type DocsSection = '/apm/get-started' | '/x-pack' | '/apm/server' | '/kibana';
 
 interface Props extends EuiLinkAnchorProps {
   section: DocsSection;
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/Links/apm/APMLink.tsx b/x-pack/legacy/plugins/apm/public/components/shared/Links/apm/APMLink.tsx
index eba59f6e3ce44..29b3fff2050c8 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/Links/apm/APMLink.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/Links/apm/APMLink.tsx
@@ -31,7 +31,7 @@ export const PERSISTENT_APM_PARAMS = [
 
 export function getAPMHref(
   path: string,
-  currentSearch: string, // TODO: Replace with passing in URL PARAMS here
+  currentSearch: string,
   query: APMQueryParams = {}
 ) {
   const currentQuery = toQuery(currentSearch);
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/Links/apm/agentConfigurationLinks.tsx b/x-pack/legacy/plugins/apm/public/components/shared/Links/apm/agentConfigurationLinks.tsx
new file mode 100644
index 0000000000000..0c747e0773a69
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/Links/apm/agentConfigurationLinks.tsx
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getAPMHref } from './APMLink';
+import { AgentConfigurationIntake } from '../../../../../../../../plugins/apm/common/agent_configuration/configuration_types';
+import { history } from '../../../../utils/history';
+
+export function editAgentConfigurationHref(
+  configService: AgentConfigurationIntake['service']
+) {
+  const { search } = history.location;
+  return getAPMHref('/settings/agent-configuration/edit', search, {
+    // ignoring because `name` has not been added to url params. Related: https://github.com/elastic/kibana/issues/51963
+    // @ts-ignore
+    name: configService.name,
+    environment: configService.environment
+  });
+}
+
+export function createAgentConfigurationHref() {
+  const { search } = history.location;
+  return getAPMHref('/settings/agent-configuration/create', search);
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/LoadingStatePrompt.tsx b/x-pack/legacy/plugins/apm/public/components/shared/LoadingStatePrompt.tsx
index e1cf07c03dee9..8a87de976f5ed 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/LoadingStatePrompt.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/LoadingStatePrompt.tsx
@@ -11,7 +11,7 @@ export function LoadingStatePrompt() {
   return (
     <EuiFlexGroup justifyContent="spaceAround">
       <EuiFlexItem grow={false}>
-        <EuiLoadingSpinner size="l" />
+        <EuiLoadingSpinner size="l" data-test-subj="loading-spinner" />
       </EuiFlexItem>
     </EuiFlexGroup>
   );
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/ErrorMetadata/__test__/ErrorMetadata.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/ErrorMetadata/__test__/ErrorMetadata.test.tsx
index 0c60d523b8f3f..258788252379a 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/ErrorMetadata/__test__/ErrorMetadata.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/ErrorMetadata/__test__/ErrorMetadata.test.tsx
@@ -10,9 +10,9 @@ import { render } from '@testing-library/react';
 import { APMError } from '../../../../../../../../../plugins/apm/typings/es_schemas/ui/apm_error';
 import {
   expectTextsInDocument,
-  expectTextsNotInDocument,
-  MockApmPluginContextWrapper
+  expectTextsNotInDocument
 } from '../../../../../utils/testHelpers';
+import { MockApmPluginContextWrapper } from '../../../../../context/ApmPluginContext/MockApmPluginContext';
 
 const renderOptions = {
   wrapper: MockApmPluginContextWrapper
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/SpanMetadata/__test__/SpanMetadata.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/SpanMetadata/__test__/SpanMetadata.test.tsx
index ee66636d88ba9..0059b7b8fb4b3 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/SpanMetadata/__test__/SpanMetadata.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/SpanMetadata/__test__/SpanMetadata.test.tsx
@@ -10,9 +10,9 @@ import { SpanMetadata } from '..';
 import { Span } from '../../../../../../../../../plugins/apm/typings/es_schemas/ui/span';
 import {
   expectTextsInDocument,
-  expectTextsNotInDocument,
-  MockApmPluginContextWrapper
+  expectTextsNotInDocument
 } from '../../../../../utils/testHelpers';
+import { MockApmPluginContextWrapper } from '../../../../../context/ApmPluginContext/MockApmPluginContext';
 
 const renderOptions = {
   wrapper: MockApmPluginContextWrapper
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/TransactionMetadata/__test__/TransactionMetadata.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/TransactionMetadata/__test__/TransactionMetadata.test.tsx
index f426074fbef80..3d78f36db9786 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/TransactionMetadata/__test__/TransactionMetadata.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/TransactionMetadata/__test__/TransactionMetadata.test.tsx
@@ -10,9 +10,9 @@ import { render } from '@testing-library/react';
 import { Transaction } from '../../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
 import {
   expectTextsInDocument,
-  expectTextsNotInDocument,
-  MockApmPluginContextWrapper
+  expectTextsNotInDocument
 } from '../../../../../utils/testHelpers';
+import { MockApmPluginContextWrapper } from '../../../../../context/ApmPluginContext/MockApmPluginContext';
 
 const renderOptions = {
   wrapper: MockApmPluginContextWrapper
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/__test__/MetadataTable.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/__test__/MetadataTable.test.tsx
index 979b9118a7534..96202525c8661 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/__test__/MetadataTable.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/MetadataTable/__test__/MetadataTable.test.tsx
@@ -7,11 +7,9 @@
 import React from 'react';
 import { render } from '@testing-library/react';
 import { MetadataTable } from '..';
-import {
-  expectTextsInDocument,
-  MockApmPluginContextWrapper
-} from '../../../../utils/testHelpers';
+import { expectTextsInDocument } from '../../../../utils/testHelpers';
 import { SectionsWithRows } from '../helper';
+import { MockApmPluginContextWrapper } from '../../../../context/ApmPluginContext/MockApmPluginContext';
 
 const renderOptions = {
   wrapper: MockApmPluginContextWrapper
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/SelectWithPlaceholder/index.tsx b/x-pack/legacy/plugins/apm/public/components/shared/SelectWithPlaceholder/index.tsx
index a8e6bc0a648af..8698978bfe6fb 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/SelectWithPlaceholder/index.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/SelectWithPlaceholder/index.tsx
@@ -7,33 +7,38 @@
 import React from 'react';
 import { EuiSelect } from '@elastic/eui';
 import { isEmpty } from 'lodash';
+import { i18n } from '@kbn/i18n';
 
-const NO_SELECTION = 'NO_SELECTION';
+export const NO_SELECTION = '__NO_SELECTION__';
+const DEFAULT_PLACEHOLDER = i18n.translate('xpack.apm.selectPlaceholder', {
+  defaultMessage: 'Select option:'
+});
 
 /**
  * This component addresses some cross-browser inconsistencies of `EuiSelect`
  * with `hasNoInitialSelection`. It uses the `placeholder` prop to populate
  * the first option as the initial, not selected option.
  */
-export const SelectWithPlaceholder: typeof EuiSelect = props => (
-  <EuiSelect
-    {...props}
-    options={[
-      { text: props.placeholder, value: NO_SELECTION },
-      ...(props.options || [])
-    ]}
-    value={isEmpty(props.value) ? NO_SELECTION : props.value}
-    onChange={e => {
-      if (props.onChange) {
-        props.onChange(
-          Object.assign(e, {
+export const SelectWithPlaceholder: typeof EuiSelect = props => {
+  const placeholder = props.placeholder || DEFAULT_PLACEHOLDER;
+  return (
+    <EuiSelect
+      {...props}
+      options={[
+        { text: placeholder, value: NO_SELECTION },
+        ...(props.options || [])
+      ]}
+      value={isEmpty(props.value) ? NO_SELECTION : props.value}
+      onChange={e => {
+        if (props.onChange) {
+          const customEvent = Object.assign(e, {
             target: Object.assign(e.target, {
-              value:
-                e.target.value === NO_SELECTION ? undefined : e.target.value
+              value: e.target.value === NO_SELECTION ? '' : e.target.value
             })
-          })
-        );
-      }
-    }}
-  />
-);
+          });
+          props.onChange(customEvent);
+        }
+      }}
+    />
+  );
+};
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/ServiceAlertTrigger/PopoverExpression/index.tsx b/x-pack/legacy/plugins/apm/public/components/shared/ServiceAlertTrigger/PopoverExpression/index.tsx
new file mode 100644
index 0000000000000..1abdb94c8313e
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/ServiceAlertTrigger/PopoverExpression/index.tsx
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState } from 'react';
+import { EuiExpression, EuiPopover } from '@elastic/eui';
+
+interface Props {
+  title: string;
+  value: string;
+  children?: React.ReactNode;
+}
+
+export const PopoverExpression = (props: Props) => {
+  const { title, value, children } = props;
+
+  const [popoverOpen, setPopoverOpen] = useState(false);
+
+  return (
+    <EuiPopover
+      isOpen={popoverOpen}
+      withTitle
+      anchorPosition="downLeft"
+      closePopover={() => setPopoverOpen(false)}
+      button={
+        <EuiExpression
+          description={title}
+          value={value}
+          isActive={popoverOpen}
+          onClick={() => setPopoverOpen(true)}
+        />
+      }
+    >
+      {children}
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/ServiceAlertTrigger/index.tsx b/x-pack/legacy/plugins/apm/public/components/shared/ServiceAlertTrigger/index.tsx
new file mode 100644
index 0000000000000..98391b277caf6
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/ServiceAlertTrigger/index.tsx
@@ -0,0 +1,61 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useEffect } from 'react';
+import { EuiSpacer, EuiFlexGrid, EuiFlexItem } from '@elastic/eui';
+import { useUrlParams } from '../../../hooks/useUrlParams';
+
+interface Props {
+  alertTypeName: string;
+  setAlertParams: (key: string, value: any) => void;
+  setAlertProperty: (key: string, value: any) => void;
+  defaults: Record<string, any>;
+  fields: React.ReactNode[];
+}
+
+export function ServiceAlertTrigger(props: Props) {
+  const { urlParams } = useUrlParams();
+
+  const {
+    fields,
+    setAlertParams,
+    setAlertProperty,
+    alertTypeName,
+    defaults
+  } = props;
+
+  const params: Record<string, any> = {
+    ...defaults,
+    serviceName: urlParams.serviceName!
+  };
+
+  useEffect(() => {
+    // we only want to run this on mount to set default values
+    setAlertProperty('name', `${alertTypeName} | ${params.serviceName}`);
+    setAlertProperty('tags', [
+      'apm',
+      `service.name:${params.serviceName}`.toLowerCase()
+    ]);
+    Object.keys(params).forEach(key => {
+      setAlertParams(key, params[key]);
+    });
+
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+  return (
+    <>
+      <EuiSpacer size="l" />
+      <EuiFlexGrid gutterSize="l" direction="row" columns={2}>
+        {fields.map((field, index) => (
+          <EuiFlexItem grow={false} key={index}>
+            {field}
+          </EuiFlexItem>
+        ))}
+      </EuiFlexGrid>
+      <EuiSpacer size="m" />
+    </>
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkPopover.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkPopover.test.tsx
new file mode 100644
index 0000000000000..99789ca2ecdf5
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkPopover.test.tsx
@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { render, act, fireEvent } from '@testing-library/react';
+import { CustomLink } from '../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
+import { Transaction } from '../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
+import { CustomLinkPopover } from './CustomLinkPopover';
+import { expectTextsInDocument } from '../../../../utils/testHelpers';
+
+describe('CustomLinkPopover', () => {
+  const customLinks = [
+    { id: '1', label: 'foo', url: 'http://elastic.co' },
+    {
+      id: '2',
+      label: 'bar',
+      url: 'http://elastic.co?service.name={{service.name}}'
+    }
+  ] as CustomLink[];
+  const transaction = ({
+    service: { name: 'foo.bar' }
+  } as unknown) as Transaction;
+  it('renders popover', () => {
+    const component = render(
+      <CustomLinkPopover
+        customLinks={customLinks}
+        transaction={transaction}
+        onCreateCustomLinkClick={jest.fn()}
+        onClose={jest.fn()}
+      />
+    );
+    expectTextsInDocument(component, ['CUSTOM LINKS', 'Create', 'foo', 'bar']);
+  });
+
+  it('closes popover', () => {
+    const handleCloseMock = jest.fn();
+    const { getByText } = render(
+      <CustomLinkPopover
+        customLinks={customLinks}
+        transaction={transaction}
+        onCreateCustomLinkClick={jest.fn()}
+        onClose={handleCloseMock}
+      />
+    );
+    expect(handleCloseMock).not.toHaveBeenCalled();
+    act(() => {
+      fireEvent.click(getByText('CUSTOM LINKS'));
+    });
+    expect(handleCloseMock).toHaveBeenCalled();
+  });
+
+  it('opens flyout to create new custom link', () => {
+    const handleCreateCustomLinkClickMock = jest.fn();
+    const { getByText } = render(
+      <CustomLinkPopover
+        customLinks={customLinks}
+        transaction={transaction}
+        onCreateCustomLinkClick={handleCreateCustomLinkClickMock}
+        onClose={jest.fn()}
+      />
+    );
+    expect(handleCreateCustomLinkClickMock).not.toHaveBeenCalled();
+    act(() => {
+      fireEvent.click(getByText('Create'));
+    });
+    expect(handleCreateCustomLinkClickMock).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkPopover.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkPopover.tsx
new file mode 100644
index 0000000000000..ee4aa25606a0c
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkPopover.tsx
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import {
+  EuiPopoverTitle,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import styled from 'styled-components';
+import { Transaction } from '../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
+import { CustomLink } from '../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
+import { CustomLinkSection } from './CustomLinkSection';
+import { ManageCustomLink } from './ManageCustomLink';
+import { px } from '../../../../style/variables';
+
+const ScrollableContainer = styled.div`
+  max-height: ${px(535)};
+  overflow: scroll;
+`;
+
+export const CustomLinkPopover = ({
+  customLinks,
+  onCreateCustomLinkClick,
+  onClose,
+  transaction
+}: {
+  customLinks: CustomLink[];
+  onCreateCustomLinkClick: () => void;
+  onClose: () => void;
+  transaction: Transaction;
+}) => {
+  return (
+    <>
+      <EuiPopoverTitle>
+        <EuiFlexGroup>
+          <EuiFlexItem style={{ alignItems: 'flex-start' }}>
+            <EuiButtonEmpty
+              color="text"
+              size="xs"
+              onClick={onClose}
+              iconType="arrowLeft"
+              style={{ fontWeight: 'bold' }}
+              flush="left"
+            >
+              {i18n.translate(
+                'xpack.apm.transactionActionMenu.customLink.popover.title',
+                {
+                  defaultMessage: 'CUSTOM LINKS'
+                }
+              )}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <ManageCustomLink
+              onCreateCustomLinkClick={onCreateCustomLinkClick}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiPopoverTitle>
+      <ScrollableContainer>
+        <CustomLinkSection
+          customLinks={customLinks}
+          transaction={transaction}
+        />
+      </ScrollableContainer>
+    </>
+  );
+};
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.test.tsx
new file mode 100644
index 0000000000000..4e52c302c6025
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.test.tsx
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { render } from '@testing-library/react';
+import { CustomLink } from '../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
+import { CustomLinkSection } from './CustomLinkSection';
+import {
+  expectTextsInDocument,
+  expectTextsNotInDocument
+} from '../../../../utils/testHelpers';
+import { Transaction } from '../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
+
+describe('CustomLinkSection', () => {
+  const customLinks = [
+    { id: '1', label: 'foo', url: 'http://elastic.co' },
+    {
+      id: '2',
+      label: 'bar',
+      url: 'http://elastic.co?service.name={{service.name}}'
+    }
+  ] as CustomLink[];
+  const transaction = ({
+    service: { name: 'foo.bar' }
+  } as unknown) as Transaction;
+  it('shows links', () => {
+    const component = render(
+      <CustomLinkSection customLinks={customLinks} transaction={transaction} />
+    );
+    expectTextsInDocument(component, ['foo', 'bar']);
+  });
+
+  it('doesnt show any links', () => {
+    const component = render(
+      <CustomLinkSection customLinks={[]} transaction={transaction} />
+    );
+    expectTextsNotInDocument(component, ['foo', 'bar']);
+  });
+});
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.tsx
new file mode 100644
index 0000000000000..601405dda6ece
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/CustomLinkSection.tsx
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import Mustache from 'mustache';
+import { Transaction } from '../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
+import { CustomLink } from '../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
+import {
+  SectionLinks,
+  SectionLink
+} from '../../../../../../../../plugins/observability/public';
+
+export const CustomLinkSection = ({
+  customLinks,
+  transaction
+}: {
+  customLinks: CustomLink[];
+  transaction: Transaction;
+}) => (
+  <SectionLinks>
+    {customLinks.map(link => {
+      let href = link.url;
+      try {
+        href = Mustache.render(link.url, transaction);
+      } catch (e) {
+        // ignores any error that happens
+      }
+      return (
+        <SectionLink
+          key={link.id}
+          label={link.label}
+          href={href}
+          target="_blank"
+        />
+      );
+    })}
+  </SectionLinks>
+);
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/ManageCustomLink.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/ManageCustomLink.test.tsx
new file mode 100644
index 0000000000000..9e7df53b0882f
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/ManageCustomLink.test.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { render, act, fireEvent } from '@testing-library/react';
+import { ManageCustomLink } from './ManageCustomLink';
+import {
+  expectTextsInDocument,
+  expectTextsNotInDocument
+} from '../../../../utils/testHelpers';
+
+describe('ManageCustomLink', () => {
+  it('renders with create button', () => {
+    const component = render(
+      <ManageCustomLink onCreateCustomLinkClick={jest.fn()} />
+    );
+    expect(
+      component.getByLabelText('Custom links settings page')
+    ).toBeInTheDocument();
+    expectTextsInDocument(component, ['Create']);
+  });
+  it('renders without create button', () => {
+    const component = render(
+      <ManageCustomLink
+        onCreateCustomLinkClick={jest.fn()}
+        showCreateCustomLinkButton={false}
+      />
+    );
+    expect(
+      component.getByLabelText('Custom links settings page')
+    ).toBeInTheDocument();
+    expectTextsNotInDocument(component, ['Create']);
+  });
+  it('opens flyout to create new custom link', () => {
+    const handleCreateCustomLinkClickMock = jest.fn();
+    const { getByText } = render(
+      <ManageCustomLink
+        onCreateCustomLinkClick={handleCreateCustomLinkClickMock}
+      />
+    );
+    expect(handleCreateCustomLinkClickMock).not.toHaveBeenCalled();
+    act(() => {
+      fireEvent.click(getByText('Create'));
+    });
+    expect(handleCreateCustomLinkClickMock).toHaveBeenCalled();
+  });
+});
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/ManageCustomLink.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/ManageCustomLink.tsx
new file mode 100644
index 0000000000000..fa9f8b2f07c53
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/ManageCustomLink.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiToolTip,
+  EuiButtonEmpty,
+  EuiIcon
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { APMLink } from '../../Links/apm/APMLink';
+
+export const ManageCustomLink = ({
+  onCreateCustomLinkClick,
+  showCreateCustomLinkButton = true
+}: {
+  onCreateCustomLinkClick: () => void;
+  showCreateCustomLinkButton?: boolean;
+}) => (
+  <EuiFlexGroup>
+    <EuiFlexItem>
+      <EuiFlexGroup justifyContent="flexEnd" gutterSize="none">
+        <EuiFlexItem grow={false} style={{ justifyContent: 'center' }}>
+          <EuiToolTip
+            position="top"
+            content={i18n.translate('xpack.apm.customLink.buttom.manage', {
+              defaultMessage: 'Manage custom links'
+            })}
+          >
+            <APMLink path={`/settings/customize-ui`}>
+              <EuiIcon
+                type="gear"
+                color="text"
+                aria-label="Custom links settings page"
+              />
+            </APMLink>
+          </EuiToolTip>
+        </EuiFlexItem>
+        {showCreateCustomLinkButton && (
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty
+              iconType="plusInCircle"
+              size="xs"
+              onClick={onCreateCustomLinkClick}
+            >
+              {i18n.translate('xpack.apm.customLink.buttom.create.title', {
+                defaultMessage: 'Create'
+              })}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+        )}
+      </EuiFlexGroup>
+    </EuiFlexItem>
+  </EuiFlexGroup>
+);
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/index.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/index.test.tsx
new file mode 100644
index 0000000000000..ba9c7eee8792b
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/index.test.tsx
@@ -0,0 +1,128 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { render, act, fireEvent } from '@testing-library/react';
+import { CustomLink } from '.';
+import { Transaction } from '../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
+import { FETCH_STATUS } from '../../../../hooks/useFetcher';
+import {
+  expectTextsInDocument,
+  expectTextsNotInDocument
+} from '../../../../utils/testHelpers';
+import { CustomLink as CustomLinkType } from '../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
+
+describe('Custom links', () => {
+  it('shows empty message when no custom link is available', () => {
+    const component = render(
+      <CustomLink
+        customLinks={[]}
+        transaction={({} as unknown) as Transaction}
+        onCreateCustomLinkClick={jest.fn()}
+        onSeeMoreClick={jest.fn()}
+        status={FETCH_STATUS.SUCCESS}
+      />
+    );
+
+    expectTextsInDocument(component, [
+      'No custom links found. Set up your own custom links i.e. a link to a specific Dashboard or external link.'
+    ]);
+    expectTextsNotInDocument(component, ['Create']);
+  });
+
+  it('shows loading while custom links are fetched', () => {
+    const { getByTestId } = render(
+      <CustomLink
+        customLinks={[]}
+        transaction={({} as unknown) as Transaction}
+        onCreateCustomLinkClick={jest.fn()}
+        onSeeMoreClick={jest.fn()}
+        status={FETCH_STATUS.LOADING}
+      />
+    );
+    expect(getByTestId('loading-spinner')).toBeInTheDocument();
+  });
+
+  it('shows first 3 custom links available', () => {
+    const customLinks = [
+      { id: '1', label: 'foo', url: 'foo' },
+      { id: '2', label: 'bar', url: 'bar' },
+      { id: '3', label: 'baz', url: 'baz' },
+      { id: '4', label: 'qux', url: 'qux' }
+    ] as CustomLinkType[];
+    const component = render(
+      <CustomLink
+        customLinks={customLinks}
+        transaction={({} as unknown) as Transaction}
+        onCreateCustomLinkClick={jest.fn()}
+        onSeeMoreClick={jest.fn()}
+        status={FETCH_STATUS.SUCCESS}
+      />
+    );
+    expectTextsInDocument(component, ['foo', 'bar', 'baz']);
+    expectTextsNotInDocument(component, ['qux']);
+  });
+
+  it('clicks on See more button', () => {
+    const customLinks = [
+      { id: '1', label: 'foo', url: 'foo' },
+      { id: '2', label: 'bar', url: 'bar' },
+      { id: '3', label: 'baz', url: 'baz' },
+      { id: '4', label: 'qux', url: 'qux' }
+    ] as CustomLinkType[];
+    const onSeeMoreClickMock = jest.fn();
+    const component = render(
+      <CustomLink
+        customLinks={customLinks}
+        transaction={({} as unknown) as Transaction}
+        onCreateCustomLinkClick={jest.fn()}
+        onSeeMoreClick={onSeeMoreClickMock}
+        status={FETCH_STATUS.SUCCESS}
+      />
+    );
+    expect(onSeeMoreClickMock).not.toHaveBeenCalled();
+    act(() => {
+      fireEvent.click(component.getByText('See more'));
+    });
+    expect(onSeeMoreClickMock).toHaveBeenCalled();
+  });
+
+  describe('create custom link buttons', () => {
+    it('shows create button below empty message', () => {
+      const component = render(
+        <CustomLink
+          customLinks={[]}
+          transaction={({} as unknown) as Transaction}
+          onCreateCustomLinkClick={jest.fn()}
+          onSeeMoreClick={jest.fn()}
+          status={FETCH_STATUS.SUCCESS}
+        />
+      );
+
+      expectTextsInDocument(component, ['Create custom link']);
+      expectTextsNotInDocument(component, ['Create']);
+    });
+    it('shows create button besides the title', () => {
+      const customLinks = [
+        { id: '1', label: 'foo', url: 'foo' },
+        { id: '2', label: 'bar', url: 'bar' },
+        { id: '3', label: 'baz', url: 'baz' },
+        { id: '4', label: 'qux', url: 'qux' }
+      ] as CustomLinkType[];
+      const component = render(
+        <CustomLink
+          customLinks={customLinks}
+          transaction={({} as unknown) as Transaction}
+          onCreateCustomLinkClick={jest.fn()}
+          onSeeMoreClick={jest.fn()}
+          status={FETCH_STATUS.SUCCESS}
+        />
+      );
+      expectTextsInDocument(component, ['Create']);
+      expectTextsNotInDocument(component, ['Create custom link']);
+    });
+  });
+});
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/index.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/index.tsx
new file mode 100644
index 0000000000000..9280f8e71bf9e
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/CustomLink/index.tsx
@@ -0,0 +1,128 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import {
+  EuiText,
+  EuiIcon,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiSpacer,
+  EuiButtonEmpty
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import styled from 'styled-components';
+import { isEmpty } from 'lodash';
+import { Transaction } from '../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
+import { CustomLink as CustomLinkType } from '../../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
+import {
+  ActionMenuDivider,
+  SectionSubtitle
+} from '../../../../../../../../plugins/observability/public';
+import { CustomLinkSection } from './CustomLinkSection';
+import { ManageCustomLink } from './ManageCustomLink';
+import { FETCH_STATUS } from '../../../../hooks/useFetcher';
+import { LoadingStatePrompt } from '../../LoadingStatePrompt';
+import { px } from '../../../../style/variables';
+
+const SeeMoreButton = styled.button<{ show: boolean }>`
+  display: ${props => (props.show ? 'flex' : 'none')};
+  align-items: center;
+  width: 100%;
+  justify-content: space-between;
+  &:hover {
+    text-decoration: underline;
+  }
+`;
+
+export const CustomLink = ({
+  customLinks,
+  status,
+  onCreateCustomLinkClick,
+  onSeeMoreClick,
+  transaction
+}: {
+  customLinks: CustomLinkType[];
+  status: FETCH_STATUS;
+  onCreateCustomLinkClick: () => void;
+  onSeeMoreClick: () => void;
+  transaction: Transaction;
+}) => {
+  const renderEmptyPrompt = (
+    <>
+      <EuiText size="xs" grow={false} style={{ width: px(300) }}>
+        {i18n.translate('xpack.apm.customLink.empty', {
+          defaultMessage:
+            'No custom links found. Set up your own custom links i.e. a link to a specific Dashboard or external link.'
+        })}
+      </EuiText>
+      <EuiSpacer size="s" />
+      <EuiButtonEmpty
+        iconType="plusInCircle"
+        size="xs"
+        onClick={onCreateCustomLinkClick}
+      >
+        {i18n.translate('xpack.apm.customLink.buttom.create', {
+          defaultMessage: 'Create custom link'
+        })}
+      </EuiButtonEmpty>
+    </>
+  );
+
+  const renderCustomLinkBottomSection = isEmpty(customLinks) ? (
+    renderEmptyPrompt
+  ) : (
+    <SeeMoreButton onClick={onSeeMoreClick} show={customLinks.length > 3}>
+      <EuiText size="s">
+        {i18n.translate('xpack.apm.transactionActionMenu.customLink.seeMore', {
+          defaultMessage: 'See more'
+        })}
+      </EuiText>
+      <EuiIcon type="arrowRight" />
+    </SeeMoreButton>
+  );
+
+  return (
+    <>
+      <ActionMenuDivider />
+      <EuiFlexGroup>
+        <EuiFlexItem style={{ justifyContent: 'center' }}>
+          <EuiText size={'s'} grow={false}>
+            <h5>
+              {i18n.translate(
+                'xpack.apm.transactionActionMenu.customLink.section',
+                {
+                  defaultMessage: 'Custom Links'
+                }
+              )}
+            </h5>
+          </EuiText>
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <ManageCustomLink
+            onCreateCustomLinkClick={onCreateCustomLinkClick}
+            showCreateCustomLinkButton={!!customLinks.length}
+          />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+      <EuiSpacer size="s" />
+      <SectionSubtitle>
+        {i18n.translate('xpack.apm.transactionActionMenu.customLink.subtitle', {
+          defaultMessage: 'Links will open in a new window.'
+        })}
+      </SectionSubtitle>
+      <CustomLinkSection
+        customLinks={customLinks.slice(0, 3)}
+        transaction={transaction}
+      />
+      <EuiSpacer size="s" />
+      {status === FETCH_STATUS.LOADING ? (
+        <LoadingStatePrompt />
+      ) : (
+        renderCustomLinkBottomSection
+      )}
+    </>
+  );
+};
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/TransactionActionMenu.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/TransactionActionMenu.tsx
index dd022626807d0..e3c412f40ba3a 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/TransactionActionMenu.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/TransactionActionMenu.tsx
@@ -6,7 +6,10 @@
 
 import { EuiButtonEmpty } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import React, { FunctionComponent, useState } from 'react';
+import React, { FunctionComponent, useMemo, useState } from 'react';
+import { FilterOptions } from '../../../../../../../plugins/apm/common/custom_link_filter_options';
+import { CustomLink as CustomLinkType } from '../../../../../../../plugins/apm/server/lib/settings/custom_link/custom_link_types';
+import { Transaction } from '../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
 import {
   ActionMenu,
   ActionMenuDivider,
@@ -16,11 +19,16 @@ import {
   SectionSubtitle,
   SectionTitle
 } from '../../../../../../../plugins/observability/public';
-import { Transaction } from '../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
 import { useApmPluginContext } from '../../../hooks/useApmPluginContext';
+import { useFetcher } from '../../../hooks/useFetcher';
 import { useLocation } from '../../../hooks/useLocation';
 import { useUrlParams } from '../../../hooks/useUrlParams';
+import { CustomLinkFlyout } from '../../app/Settings/CustomizeUI/CustomLink/CustomLinkFlyout';
+import { CustomLink } from './CustomLink';
+import { CustomLinkPopover } from './CustomLink/CustomLinkPopover';
 import { getSections } from './sections';
+import { useLicense } from '../../../hooks/useLicense';
+import { px } from '../../../style/variables';
 
 interface Props {
   readonly transaction: Transaction;
@@ -37,11 +45,36 @@ const ActionMenuButton = ({ onClick }: { onClick: () => void }) => (
 export const TransactionActionMenu: FunctionComponent<Props> = ({
   transaction
 }: Props) => {
+  const license = useLicense();
+  const hasValidLicense = license?.isActive && license?.hasAtLeast('gold');
+
   const { core } = useApmPluginContext();
   const location = useLocation();
   const { urlParams } = useUrlParams();
 
-  const [isOpen, setIsOpen] = useState(false);
+  const [isActionPopoverOpen, setIsActionPopoverOpen] = useState(false);
+  const [isCustomLinksPopoverOpen, setIsCustomLinksPopoverOpen] = useState(
+    false
+  );
+  const [isCustomLinkFlyoutOpen, setIsCustomLinkFlyoutOpen] = useState(false);
+
+  const filters: FilterOptions = useMemo(
+    () => ({
+      'service.name': transaction?.service.name,
+      'service.environment': transaction?.service.environment,
+      'transaction.name': transaction?.transaction.name,
+      'transaction.type': transaction?.transaction.type
+    }),
+    [transaction]
+  );
+  const { data: customLinks = [], status, refetch } = useFetcher(
+    callApmApi =>
+      callApmApi({
+        pathname: '/api/apm/settings/custom_links',
+        params: { query: filters }
+      }),
+    [filters]
+  );
 
   const sections = getSections({
     transaction,
@@ -50,39 +83,92 @@ export const TransactionActionMenu: FunctionComponent<Props> = ({
     urlParams
   });
 
+  const toggleCustomLinkFlyout = () => {
+    setIsCustomLinkFlyoutOpen(isOpen => !isOpen);
+  };
+
+  const toggleCustomLinkPopover = () => {
+    setIsCustomLinksPopoverOpen(isOpen => !isOpen);
+  };
+
   return (
-    <ActionMenu
-      id="transactionActionMenu"
-      closePopover={() => setIsOpen(false)}
-      isOpen={isOpen}
-      anchorPosition="downRight"
-      button={<ActionMenuButton onClick={() => setIsOpen(!isOpen)} />}
-    >
-      {sections.map((section, idx) => {
-        const isLastSection = idx !== sections.length - 1;
-        return (
-          <div key={idx}>
-            {section.map(item => (
-              <Section key={item.key}>
-                {item.title && <SectionTitle>{item.title}</SectionTitle>}
-                {item.subtitle && (
-                  <SectionSubtitle>{item.subtitle}</SectionSubtitle>
-                )}
-                <SectionLinks>
-                  {item.actions.map(action => (
-                    <SectionLink
-                      key={action.key}
-                      label={action.label}
-                      href={action.href}
-                    />
-                  ))}
-                </SectionLinks>
-              </Section>
-            ))}
-            {isLastSection && <ActionMenuDivider />}
-          </div>
-        );
-      })}
-    </ActionMenu>
+    <>
+      {isCustomLinkFlyoutOpen && (
+        <CustomLinkFlyout
+          customLinkSelected={{ ...filters } as CustomLinkType}
+          onClose={toggleCustomLinkFlyout}
+          onSave={() => {
+            toggleCustomLinkFlyout();
+            refetch();
+          }}
+          onDelete={() => {
+            toggleCustomLinkFlyout();
+            refetch();
+          }}
+        />
+      )}
+      <ActionMenu
+        id="transactionActionMenu"
+        closePopover={() => {
+          setIsActionPopoverOpen(false);
+          setIsCustomLinksPopoverOpen(false);
+        }}
+        isOpen={isActionPopoverOpen}
+        anchorPosition="downRight"
+        button={
+          <ActionMenuButton onClick={() => setIsActionPopoverOpen(true)} />
+        }
+      >
+        <div style={{ maxHeight: px(600) }}>
+          {isCustomLinksPopoverOpen ? (
+            <CustomLinkPopover
+              customLinks={customLinks.slice(3, customLinks.length)}
+              onCreateCustomLinkClick={toggleCustomLinkFlyout}
+              onClose={toggleCustomLinkPopover}
+              transaction={transaction}
+            />
+          ) : (
+            <>
+              {sections.map((section, idx) => {
+                const isLastSection = idx !== sections.length - 1;
+                return (
+                  <div key={idx}>
+                    {section.map(item => (
+                      <Section key={item.key}>
+                        {item.title && (
+                          <SectionTitle>{item.title}</SectionTitle>
+                        )}
+                        {item.subtitle && (
+                          <SectionSubtitle>{item.subtitle}</SectionSubtitle>
+                        )}
+                        <SectionLinks>
+                          {item.actions.map(action => (
+                            <SectionLink
+                              key={action.key}
+                              label={action.label}
+                              href={action.href}
+                            />
+                          ))}
+                        </SectionLinks>
+                      </Section>
+                    ))}
+                    {isLastSection && <ActionMenuDivider />}
+                  </div>
+                );
+              })}
+              {hasValidLicense && (
+                <CustomLink
+                  customLinks={customLinks}
+                  status={status}
+                  onCreateCustomLinkClick={toggleCustomLinkFlyout}
+                  onSeeMoreClick={toggleCustomLinkPopover}
+                  transaction={transaction}
+                />
+              )}
+            </>
+          )}
+        </div>
+      </ActionMenu>
+    </>
   );
 };
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/__test__/TransactionActionMenu.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/__test__/TransactionActionMenu.test.tsx
index ac3616e8c134c..560884aec554a 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/__test__/TransactionActionMenu.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/__test__/TransactionActionMenu.test.tsx
@@ -5,11 +5,18 @@
  */
 
 import React from 'react';
-import { render, fireEvent } from '@testing-library/react';
+import { render, fireEvent, act } from '@testing-library/react';
 import { TransactionActionMenu } from '../TransactionActionMenu';
 import { Transaction } from '../../../../../../../../plugins/apm/typings/es_schemas/ui/transaction';
 import * as Transactions from './mockData';
-import { MockApmPluginContextWrapper } from '../../../../utils/testHelpers';
+import {
+  expectTextsNotInDocument,
+  expectTextsInDocument
+} from '../../../../utils/testHelpers';
+import * as hooks from '../../../../hooks/useFetcher';
+import { LicenseContext } from '../../../../context/LicenseContext';
+import { License } from '../../../../../../../../plugins/licensing/common/license';
+import { MockApmPluginContextWrapper } from '../../../../context/ApmPluginContext/MockApmPluginContext';
 
 const renderTransaction = async (transaction: Record<string, any>) => {
   const rendered = render(
@@ -23,6 +30,15 @@ const renderTransaction = async (transaction: Record<string, any>) => {
 };
 
 describe('TransactionActionMenu component', () => {
+  beforeAll(() => {
+    spyOn(hooks, 'useFetcher').and.returnValue({
+      data: [],
+      status: 'success'
+    });
+  });
+  afterAll(() => {
+    jest.clearAllMocks();
+  });
   it('should always render the discover link', async () => {
     const { queryByText } = await renderTransaction(
       Transactions.transactionWithMinimalData
@@ -124,4 +140,115 @@ describe('TransactionActionMenu component', () => {
 
     expect(container).toMatchSnapshot();
   });
+
+  describe('Custom links', () => {
+    it('doesnt show custom links when license is not valid', () => {
+      const license = new License({
+        signature: 'test signature',
+        license: {
+          expiryDateInMillis: 0,
+          mode: 'gold',
+          status: 'invalid',
+          type: 'gold',
+          uid: '1'
+        }
+      });
+      const component = render(
+        <LicenseContext.Provider value={license}>
+          <MockApmPluginContextWrapper>
+            <TransactionActionMenu
+              transaction={
+                Transactions.transactionWithMinimalData as Transaction
+              }
+            />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
+      );
+      act(() => {
+        fireEvent.click(component.getByText('Actions'));
+      });
+      expectTextsNotInDocument(component, ['Custom Links']);
+    });
+    it('doesnt show custom links when basic license', () => {
+      const license = new License({
+        signature: 'test signature',
+        license: {
+          expiryDateInMillis: 0,
+          mode: 'basic',
+          status: 'active',
+          type: 'basic',
+          uid: '1'
+        }
+      });
+      const component = render(
+        <LicenseContext.Provider value={license}>
+          <MockApmPluginContextWrapper>
+            <TransactionActionMenu
+              transaction={
+                Transactions.transactionWithMinimalData as Transaction
+              }
+            />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
+      );
+      act(() => {
+        fireEvent.click(component.getByText('Actions'));
+      });
+      expectTextsNotInDocument(component, ['Custom Links']);
+    });
+    it('shows custom links when trial license', () => {
+      const license = new License({
+        signature: 'test signature',
+        license: {
+          expiryDateInMillis: 0,
+          mode: 'trial',
+          status: 'active',
+          type: 'trial',
+          uid: '1'
+        }
+      });
+      const component = render(
+        <LicenseContext.Provider value={license}>
+          <MockApmPluginContextWrapper>
+            <TransactionActionMenu
+              transaction={
+                Transactions.transactionWithMinimalData as Transaction
+              }
+            />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
+      );
+      act(() => {
+        fireEvent.click(component.getByText('Actions'));
+      });
+      expectTextsInDocument(component, ['Custom Links']);
+    });
+    it('shows custom links when gold license', () => {
+      const license = new License({
+        signature: 'test signature',
+        license: {
+          expiryDateInMillis: 0,
+          mode: 'gold',
+          status: 'active',
+          type: 'gold',
+          uid: '1'
+        }
+      });
+      const component = render(
+        <LicenseContext.Provider value={license}>
+          <MockApmPluginContextWrapper>
+            <TransactionActionMenu
+              transaction={
+                Transactions.transactionWithMinimalData as Transaction
+              }
+            />
+          </MockApmPluginContextWrapper>
+        </LicenseContext.Provider>
+      );
+      act(() => {
+        fireEvent.click(component.getByText('Actions'));
+      });
+      expectTextsInDocument(component, ['Custom Links']);
+    });
+  });
 });
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/__test__/mockData.ts b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/__test__/mockData.ts
index be8f379ce62ee..70be1a4744767 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/__test__/mockData.ts
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionActionMenu/__test__/mockData.ts
@@ -8,7 +8,10 @@ import { Location } from 'history';
 
 const bareTransaction = {
   '@metadata': 'whatever',
-  observer: 'whatever',
+  observer: {
+    version: '8.0.0',
+    version_major: 8
+  },
   agent: {
     name: 'java',
     version: '7.0.0'
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.stories.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.stories.tsx
new file mode 100644
index 0000000000000..a8f834103e6c1
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.stories.tsx
@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { cloneDeep, merge } from 'lodash';
+import { storiesOf } from '@storybook/react';
+import React from 'react';
+import { TransactionDurationAlertTrigger } from '.';
+import {
+  MockApmPluginContextWrapper,
+  mockApmPluginContextValue
+} from '../../../context/ApmPluginContext/MockApmPluginContext';
+import { MockUrlParamsContextProvider } from '../../../context/UrlParamsContext/MockUrlParamsContextProvider';
+import { ApmPluginContextValue } from '../../../context/ApmPluginContext';
+
+storiesOf('app/TransactionDurationAlertTrigger', module).add(
+  'example',
+  context => {
+    const params = {
+      threshold: 1500,
+      aggregationType: 'avg' as const,
+      window: '5m'
+    };
+
+    const contextMock = (merge(cloneDeep(mockApmPluginContextValue), {
+      core: {
+        http: {
+          get: () => {
+            return Promise.resolve({ transactionTypes: ['request'] });
+          }
+        }
+      }
+    }) as unknown) as ApmPluginContextValue;
+
+    return (
+      <div style={{ width: 400 }}>
+        <MockApmPluginContextWrapper value={contextMock}>
+          <MockUrlParamsContextProvider>
+            <TransactionDurationAlertTrigger
+              alertParams={params as any}
+              setAlertParams={() => undefined}
+              setAlertProperty={() => undefined}
+            />
+          </MockUrlParamsContextProvider>
+        </MockApmPluginContextWrapper>
+      </div>
+    );
+  }
+);
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.tsx b/x-pack/legacy/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.tsx
new file mode 100644
index 0000000000000..cdc7c30089b4f
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/components/shared/TransactionDurationAlertTrigger/index.tsx
@@ -0,0 +1,149 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { map } from 'lodash';
+import { EuiFieldNumber, EuiSelect } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { ForLastExpression } from '../../../../../../../plugins/triggers_actions_ui/public';
+import {
+  TRANSACTION_ALERT_AGGREGATION_TYPES,
+  ALERT_TYPES_CONFIG
+} from '../../../../../../../plugins/apm/common/alert_types';
+import { ServiceAlertTrigger } from '../ServiceAlertTrigger';
+import { useUrlParams } from '../../../hooks/useUrlParams';
+import { useServiceTransactionTypes } from '../../../hooks/useServiceTransactionTypes';
+import { PopoverExpression } from '../ServiceAlertTrigger/PopoverExpression';
+
+interface Params {
+  windowSize: number;
+  windowUnit: string;
+  threshold: number;
+  aggregationType: 'avg' | '95th' | '99th';
+  serviceName: string;
+  transactionType: string;
+}
+
+interface Props {
+  alertParams: Params;
+  setAlertParams: (key: string, value: any) => void;
+  setAlertProperty: (key: string, value: any) => void;
+}
+
+export function TransactionDurationAlertTrigger(props: Props) {
+  const { setAlertParams, alertParams, setAlertProperty } = props;
+
+  const { urlParams } = useUrlParams();
+
+  const transactionTypes = useServiceTransactionTypes(urlParams);
+
+  if (!transactionTypes.length) {
+    return null;
+  }
+
+  const defaults = {
+    threshold: 1500,
+    aggregationType: 'avg',
+    windowSize: 5,
+    windowUnit: 'm',
+    transactionType: transactionTypes[0]
+  };
+
+  const params = {
+    ...defaults,
+    ...alertParams
+  };
+
+  const fields = [
+    <PopoverExpression
+      value={params.transactionType}
+      title={i18n.translate('xpack.apm.transactionDurationAlertTrigger.type', {
+        defaultMessage: 'Type'
+      })}
+    >
+      <EuiSelect
+        value={params.transactionType}
+        options={transactionTypes.map(key => {
+          return {
+            text: key,
+            value: key
+          };
+        })}
+        onChange={e =>
+          setAlertParams(
+            'transactionType',
+            e.target.value as Params['transactionType']
+          )
+        }
+        compressed
+      />
+    </PopoverExpression>,
+    <PopoverExpression
+      value={params.aggregationType}
+      title={i18n.translate('xpack.apm.transactionDurationAlertTrigger.when', {
+        defaultMessage: 'When'
+      })}
+    >
+      <EuiSelect
+        value={params.aggregationType}
+        options={map(TRANSACTION_ALERT_AGGREGATION_TYPES, (label, key) => {
+          return {
+            text: label,
+            value: key
+          };
+        })}
+        onChange={e =>
+          setAlertParams(
+            'aggregationType',
+            e.target.value as Params['aggregationType']
+          )
+        }
+        compressed
+      />
+    </PopoverExpression>,
+    <PopoverExpression
+      value={params.threshold ? `${params.threshold}ms` : ''}
+      title={i18n.translate(
+        'xpack.apm.transactionDurationAlertTrigger.isAbove',
+        {
+          defaultMessage: 'is above'
+        }
+      )}
+    >
+      <EuiFieldNumber
+        value={params.threshold ?? ''}
+        onChange={e => setAlertParams('threshold', e.target.value)}
+        append={i18n.translate('xpack.apm.transactionDurationAlertTrigger.ms', {
+          defaultMessage: 'ms'
+        })}
+        compressed
+      />
+    </PopoverExpression>,
+    <ForLastExpression
+      onChangeWindowSize={timeWindowSize =>
+        setAlertParams('windowSize', timeWindowSize)
+      }
+      onChangeWindowUnit={timeWindowUnit =>
+        setAlertParams('windowUnit', timeWindowUnit)
+      }
+      timeWindowSize={params.windowSize}
+      timeWindowUnit={params.windowUnit}
+      errors={{
+        timeWindowSize: [],
+        timeWindowUnit: []
+      }}
+    />
+  ];
+
+  return (
+    <ServiceAlertTrigger
+      alertTypeName={ALERT_TYPES_CONFIG['apm.transaction_duration'].name}
+      fields={fields}
+      defaults={defaults}
+      setAlertParams={setAlertParams}
+      setAlertProperty={setAlertProperty}
+    />
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/components/shared/charts/TransactionCharts/BrowserLineChart.test.tsx b/x-pack/legacy/plugins/apm/public/components/shared/charts/TransactionCharts/BrowserLineChart.test.tsx
index 6d3e29ec09985..9f112475a4a78 100644
--- a/x-pack/legacy/plugins/apm/public/components/shared/charts/TransactionCharts/BrowserLineChart.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/components/shared/charts/TransactionCharts/BrowserLineChart.test.tsx
@@ -7,7 +7,7 @@
 import React from 'react';
 import { shallow } from 'enzyme';
 import { BrowserLineChart } from './BrowserLineChart';
-import { MockApmPluginContextWrapper } from '../../../../utils/testHelpers';
+import { MockApmPluginContextWrapper } from '../../../../context/ApmPluginContext/MockApmPluginContext';
 
 describe('BrowserLineChart', () => {
   describe('render', () => {
diff --git a/x-pack/legacy/plugins/apm/public/context/ApmPluginContext/MockApmPluginContext.tsx b/x-pack/legacy/plugins/apm/public/context/ApmPluginContext/MockApmPluginContext.tsx
new file mode 100644
index 0000000000000..8775dc98c3e1a
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/context/ApmPluginContext/MockApmPluginContext.tsx
@@ -0,0 +1,63 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { ApmPluginContext, ApmPluginContextValue } from '.';
+import { createCallApmApi } from '../../services/rest/createCallApmApi';
+import { ConfigSchema } from '../../new-platform/plugin';
+
+const mockCore = {
+  chrome: {
+    setBreadcrumbs: () => {}
+  },
+  http: {
+    basePath: {
+      prepend: (path: string) => `/basepath${path}`
+    }
+  },
+  notifications: {
+    toasts: {
+      addWarning: () => {},
+      addDanger: () => {}
+    }
+  }
+};
+
+const mockConfig: ConfigSchema = {
+  indexPatternTitle: 'apm-*',
+  serviceMapEnabled: true,
+  ui: {
+    enabled: false
+  }
+};
+
+export const mockApmPluginContextValue = {
+  config: mockConfig,
+  core: mockCore,
+  packageInfo: { version: '0' },
+  plugins: {}
+};
+
+export function MockApmPluginContextWrapper({
+  children,
+  value = {} as ApmPluginContextValue
+}: {
+  children?: React.ReactNode;
+  value?: ApmPluginContextValue;
+}) {
+  if (value.core?.http) {
+    createCallApmApi(value.core?.http);
+  }
+  return (
+    <ApmPluginContext.Provider
+      value={{
+        ...mockApmPluginContextValue,
+        ...value
+      }}
+    >
+      {children}
+    </ApmPluginContext.Provider>
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/public/context/ApmPluginContext.tsx b/x-pack/legacy/plugins/apm/public/context/ApmPluginContext/index.tsx
similarity index 89%
rename from x-pack/legacy/plugins/apm/public/context/ApmPluginContext.tsx
rename to x-pack/legacy/plugins/apm/public/context/ApmPluginContext/index.tsx
index 7a9aaa6dfb920..d8934ba4b0151 100644
--- a/x-pack/legacy/plugins/apm/public/context/ApmPluginContext.tsx
+++ b/x-pack/legacy/plugins/apm/public/context/ApmPluginContext/index.tsx
@@ -6,7 +6,7 @@
 
 import { createContext } from 'react';
 import { AppMountContext, PackageInfo } from 'kibana/public';
-import { ApmPluginSetupDeps, ConfigSchema } from '../new-platform/plugin';
+import { ApmPluginSetupDeps, ConfigSchema } from '../../new-platform/plugin';
 
 export type AppMountContextBasePath = AppMountContext['core']['http']['basePath'];
 
diff --git a/x-pack/legacy/plugins/apm/public/context/LocationContext.tsx b/x-pack/legacy/plugins/apm/public/context/LocationContext.tsx
index 30e6e02c9fbc1..1e9c20494b42e 100644
--- a/x-pack/legacy/plugins/apm/public/context/LocationContext.tsx
+++ b/x-pack/legacy/plugins/apm/public/context/LocationContext.tsx
@@ -11,10 +11,8 @@ import { withRouter } from 'react-router-dom';
 const initialLocation = {} as Location;
 
 const LocationContext = createContext(initialLocation);
-const LocationProvider: React.ComponentClass<{}> = withRouter(
-  ({ location, children }) => {
-    return <LocationContext.Provider children={children} value={location} />;
-  }
-);
+const LocationProvider = withRouter(({ location, children }) => {
+  return <LocationContext.Provider children={children} value={location} />;
+});
 
 export { LocationContext, LocationProvider };
diff --git a/x-pack/legacy/plugins/apm/public/context/UrlParamsContext/MockUrlParamsContextProvider.tsx b/x-pack/legacy/plugins/apm/public/context/UrlParamsContext/MockUrlParamsContextProvider.tsx
new file mode 100644
index 0000000000000..46f51da49692a
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/public/context/UrlParamsContext/MockUrlParamsContextProvider.tsx
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { IUrlParams } from './types';
+import { UrlParamsContext, useUiFilters } from '.';
+
+const defaultUrlParams = {
+  page: 0,
+  serviceName: 'opbeans-python',
+  transactionType: 'request',
+  start: '2018-01-10T09:51:41.050Z',
+  end: '2018-01-10T10:06:41.050Z'
+};
+
+interface Props {
+  params?: IUrlParams;
+  children: React.ReactNode;
+  refreshTimeRange?: (time: any) => void;
+}
+
+export const MockUrlParamsContextProvider = ({
+  params,
+  children,
+  refreshTimeRange = () => undefined
+}: Props) => {
+  const urlParams = { ...defaultUrlParams, ...params };
+  return (
+    <UrlParamsContext.Provider
+      value={{
+        urlParams,
+        refreshTimeRange,
+        uiFilters: useUiFilters(urlParams)
+      }}
+      children={children}
+    />
+  );
+};
diff --git a/x-pack/legacy/plugins/apm/public/hooks/useFetcher.integration.test.tsx b/x-pack/legacy/plugins/apm/public/hooks/useFetcher.integration.test.tsx
index 389737a815ab2..8918d992b4f53 100644
--- a/x-pack/legacy/plugins/apm/public/hooks/useFetcher.integration.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/hooks/useFetcher.integration.test.tsx
@@ -4,10 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
 import { render, wait } from '@testing-library/react';
-import { delay, MockApmPluginContextWrapper } from '../utils/testHelpers';
+import React from 'react';
+import { delay } from '../utils/testHelpers';
 import { useFetcher } from './useFetcher';
+import { MockApmPluginContextWrapper } from '../context/ApmPluginContext/MockApmPluginContext';
 
 const wrapper = MockApmPluginContextWrapper;
 
diff --git a/x-pack/legacy/plugins/apm/public/hooks/useFetcher.test.tsx b/x-pack/legacy/plugins/apm/public/hooks/useFetcher.test.tsx
index e3ef1d44c8b03..deb805c542b1e 100644
--- a/x-pack/legacy/plugins/apm/public/hooks/useFetcher.test.tsx
+++ b/x-pack/legacy/plugins/apm/public/hooks/useFetcher.test.tsx
@@ -5,8 +5,9 @@
  */
 
 import { renderHook } from '@testing-library/react-hooks';
-import { delay, MockApmPluginContextWrapper } from '../utils/testHelpers';
+import { delay } from '../utils/testHelpers';
 import { useFetcher } from './useFetcher';
+import { MockApmPluginContextWrapper } from '../context/ApmPluginContext/MockApmPluginContext';
 
 // Wrap the hook with a provider so it can useApmPluginContext
 const wrapper = MockApmPluginContextWrapper;
diff --git a/x-pack/legacy/plugins/apm/public/hooks/useFetcher.tsx b/x-pack/legacy/plugins/apm/public/hooks/useFetcher.tsx
index c2530d6982c3b..95cebd6b2a465 100644
--- a/x-pack/legacy/plugins/apm/public/hooks/useFetcher.tsx
+++ b/x-pack/legacy/plugins/apm/public/hooks/useFetcher.tsx
@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+/* eslint-disable no-console */
+
 import React, { useContext, useEffect, useState, useMemo } from 'react';
 import { i18n } from '@kbn/i18n';
 import { IHttpFetchError } from 'src/core/public';
@@ -20,7 +22,7 @@ export enum FETCH_STATUS {
   PENDING = 'pending'
 }
 
-interface Result<Data> {
+export interface FetcherResult<Data> {
   data?: Data;
   status: FETCH_STATUS;
   error?: Error;
@@ -40,13 +42,15 @@ export function useFetcher<TReturn>(
   options: {
     preservePreviousData?: boolean;
   } = {}
-): Result<InferResponseType<TReturn>> & { refetch: () => void } {
+): FetcherResult<InferResponseType<TReturn>> & { refetch: () => void } {
   const { notifications } = useApmPluginContext().core;
   const { preservePreviousData = true } = options;
   const { setIsLoading } = useLoadingIndicator();
 
   const { dispatchStatus } = useContext(LoadingIndicatorContext);
-  const [result, setResult] = useState<Result<InferResponseType<TReturn>>>({
+  const [result, setResult] = useState<
+    FetcherResult<InferResponseType<TReturn>>
+  >({
     data: undefined,
     status: FETCH_STATUS.PENDING
   });
@@ -80,11 +84,27 @@ export function useFetcher<TReturn>(
             data,
             status: FETCH_STATUS.SUCCESS,
             error: undefined
-          } as Result<InferResponseType<TReturn>>);
+          } as FetcherResult<InferResponseType<TReturn>>);
         }
       } catch (e) {
-        const err = e as IHttpFetchError;
+        const err = e as Error | IHttpFetchError;
+
         if (!didCancel) {
+          const errorDetails =
+            'response' in err ? (
+              <>
+                {err.response?.statusText} ({err.response?.status})
+                <h5>
+                  {i18n.translate('xpack.apm.fetcher.error.url', {
+                    defaultMessage: `URL`
+                  })}
+                </h5>
+                {err.response?.url}
+              </>
+            ) : (
+              err.message
+            );
+
           notifications.toasts.addWarning({
             title: i18n.translate('xpack.apm.fetcher.error.title', {
               defaultMessage: `Error while fetching resource`
@@ -96,13 +116,8 @@ export function useFetcher<TReturn>(
                     defaultMessage: `Error`
                   })}
                 </h5>
-                {err.response?.statusText} ({err.response?.status})
-                <h5>
-                  {i18n.translate('xpack.apm.fetcher.error.url', {
-                    defaultMessage: `URL`
-                  })}
-                </h5>
-                {err.response?.url}
+
+                {errorDetails}
               </div>
             )
           });
diff --git a/x-pack/legacy/plugins/apm/public/new-platform/plugin.tsx b/x-pack/legacy/plugins/apm/public/new-platform/plugin.tsx
index e34e2c904defb..b85f88040e513 100644
--- a/x-pack/legacy/plugins/apm/public/new-platform/plugin.tsx
+++ b/x-pack/legacy/plugins/apm/public/new-platform/plugin.tsx
@@ -9,6 +9,8 @@ import ReactDOM from 'react-dom';
 import { Route, Router, Switch } from 'react-router-dom';
 import styled from 'styled-components';
 import { metadata } from 'ui/metadata';
+import { i18n } from '@kbn/i18n';
+import { AlertType } from '../../../../../plugins/apm/common/alert_types';
 import {
   CoreSetup,
   CoreStart,
@@ -38,6 +40,12 @@ import { toggleAppLinkInNav } from './toggleAppLinkInNav';
 import { setReadonlyBadge } from './updateBadge';
 import { KibanaContextProvider } from '../../../../../../src/plugins/kibana_react/public';
 import { APMIndicesPermission } from '../components/app/APMIndicesPermission';
+import {
+  TriggersAndActionsUIPublicPluginSetup,
+  AlertsContextProvider
+} from '../../../../../plugins/triggers_actions_ui/public';
+import { ErrorRateAlertTrigger } from '../components/shared/ErrorRateAlertTrigger';
+import { TransactionDurationAlertTrigger } from '../components/shared/TransactionDurationAlertTrigger';
 import { createCallApmApi } from '../services/rest/createCallApmApi';
 
 export const REACT_APP_ROOT_ID = 'react-apm-root';
@@ -71,6 +79,7 @@ export interface ApmPluginSetupDeps {
   data: DataPublicPluginSetup;
   home: HomePublicPluginSetup;
   licensing: LicensingPluginSetup;
+  triggers_actions_ui: TriggersAndActionsUIPublicPluginSetup;
 }
 
 export interface ConfigSchema {
@@ -134,25 +143,58 @@ export class ApmPlugin
       plugins
     };
 
+    plugins.triggers_actions_ui.alertTypeRegistry.register({
+      id: AlertType.ErrorRate,
+      name: i18n.translate('xpack.apm.alertTypes.errorRate', {
+        defaultMessage: 'Error rate'
+      }),
+      iconClass: 'bell',
+      alertParamsExpression: ErrorRateAlertTrigger,
+      validate: () => ({
+        errors: []
+      })
+    });
+
+    plugins.triggers_actions_ui.alertTypeRegistry.register({
+      id: AlertType.TransactionDuration,
+      name: i18n.translate('xpack.apm.alertTypes.transactionDuration', {
+        defaultMessage: 'Transaction duration'
+      }),
+      iconClass: 'bell',
+      alertParamsExpression: TransactionDurationAlertTrigger,
+      validate: () => ({
+        errors: []
+      })
+    });
+
     ReactDOM.render(
       <ApmPluginContext.Provider value={apmPluginContextValue}>
-        <KibanaContextProvider services={{ ...core, ...plugins }}>
-          <i18nCore.Context>
-            <Router history={history}>
-              <LocationProvider>
-                <MatchedRouteProvider routes={routes}>
-                  <UrlParamsProvider>
-                    <LoadingIndicatorProvider>
-                      <LicenseProvider>
-                        <App />
-                      </LicenseProvider>
-                    </LoadingIndicatorProvider>
-                  </UrlParamsProvider>
-                </MatchedRouteProvider>
-              </LocationProvider>
-            </Router>
-          </i18nCore.Context>
-        </KibanaContextProvider>
+        <AlertsContextProvider
+          value={{
+            http: core.http,
+            toastNotifications: core.notifications.toasts,
+            actionTypeRegistry: plugins.triggers_actions_ui.actionTypeRegistry,
+            alertTypeRegistry: plugins.triggers_actions_ui.alertTypeRegistry
+          }}
+        >
+          <KibanaContextProvider services={{ ...core, ...plugins }}>
+            <i18nCore.Context>
+              <Router history={history}>
+                <LocationProvider>
+                  <MatchedRouteProvider routes={routes}>
+                    <UrlParamsProvider>
+                      <LoadingIndicatorProvider>
+                        <LicenseProvider>
+                          <App />
+                        </LicenseProvider>
+                      </LoadingIndicatorProvider>
+                    </UrlParamsProvider>
+                  </MatchedRouteProvider>
+                </LocationProvider>
+              </Router>
+            </i18nCore.Context>
+          </KibanaContextProvider>
+        </AlertsContextProvider>
       </ApmPluginContext.Provider>,
       document.getElementById(REACT_APP_ROOT_ID)
     );
diff --git a/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx b/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx
index 6bcfbc4541b64..36c0e18777bfd 100644
--- a/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx
+++ b/x-pack/legacy/plugins/apm/public/utils/testHelpers.tsx
@@ -11,7 +11,7 @@ import enzymeToJson from 'enzyme-to-json';
 import { Location } from 'history';
 import moment from 'moment';
 import { Moment } from 'moment-timezone';
-import React, { ReactNode } from 'react';
+import React from 'react';
 import { render, waitForElement } from '@testing-library/react';
 import '@testing-library/jest-dom/extend-expect';
 import { MemoryRouter } from 'react-router-dom';
@@ -24,12 +24,7 @@ import {
   ESSearchResponse,
   ESSearchRequest
 } from '../../../../../plugins/apm/typings/elasticsearch';
-import {
-  ApmPluginContext,
-  ApmPluginContextValue
-} from '../context/ApmPluginContext';
-import { ConfigSchema } from '../new-platform/plugin';
-import { createCallApmApi } from '../services/rest/createCallApmApi';
+import { MockApmPluginContextWrapper } from '../context/ApmPluginContext/MockApmPluginContext';
 
 export function toJson(wrapper: ReactWrapper) {
   return enzymeToJson(wrapper, {
@@ -186,57 +181,3 @@ export async function inspectSearchParams(
 }
 
 export type SearchParamsMock = PromiseReturnType<typeof inspectSearchParams>;
-
-const mockCore = {
-  chrome: {
-    setBreadcrumbs: () => {}
-  },
-  http: {
-    basePath: {
-      prepend: (path: string) => `/basepath${path}`
-    }
-  },
-  notifications: {
-    toasts: {
-      addWarning: () => {},
-      addDanger: () => {}
-    }
-  }
-};
-
-const mockConfig: ConfigSchema = {
-  indexPatternTitle: 'apm-*',
-  serviceMapEnabled: true,
-  ui: {
-    enabled: false
-  }
-};
-
-export const mockApmPluginContextValue = {
-  config: mockConfig,
-  core: mockCore,
-  packageInfo: { version: '0' },
-  plugins: {}
-};
-
-export function MockApmPluginContextWrapper({
-  children,
-  value = {} as ApmPluginContextValue
-}: {
-  children?: ReactNode;
-  value?: ApmPluginContextValue;
-}) {
-  if (value.core?.http) {
-    createCallApmApi(value.core?.http);
-  }
-  return (
-    <ApmPluginContext.Provider
-      value={{
-        ...mockApmPluginContextValue,
-        ...value
-      }}
-    >
-      {children}
-    </ApmPluginContext.Provider>
-  );
-}
diff --git a/x-pack/legacy/plugins/apm/scripts/.gitignore b/x-pack/legacy/plugins/apm/scripts/.gitignore
new file mode 100644
index 0000000000000..8ee01d321b721
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/scripts/.gitignore
@@ -0,0 +1 @@
+yarn.lock
diff --git a/x-pack/legacy/plugins/apm/scripts/package.json b/x-pack/legacy/plugins/apm/scripts/package.json
new file mode 100644
index 0000000000000..9121449c53619
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/scripts/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "apm-scripts",
+  "version": "1.0.0",
+  "main": "index.js",
+  "license": "MIT",
+  "dependencies": {
+    "@octokit/rest": "^16.35.0",
+    "console-stamp": "^0.2.9"
+  }
+}
diff --git a/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data.js b/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data.js
new file mode 100644
index 0000000000000..a99651c62dd7a
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data.js
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// compile typescript on the fly
+// eslint-disable-next-line import/no-extraneous-dependencies
+require('@babel/register')({
+  extensions: ['.ts'],
+  plugins: [
+    '@babel/plugin-proposal-optional-chaining',
+    '@babel/plugin-proposal-nullish-coalescing-operator'
+  ],
+  presets: [
+    '@babel/typescript',
+    ['@babel/preset-env', { targets: { node: 'current' } }]
+  ]
+});
+
+require('./upload-telemetry-data/index.ts');
diff --git a/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data/download-telemetry-template.ts b/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data/download-telemetry-template.ts
new file mode 100644
index 0000000000000..dfed9223ef708
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data/download-telemetry-template.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// @ts-ignore
+import { Octokit } from '@octokit/rest';
+
+export async function downloadTelemetryTemplate(octokit: Octokit) {
+  const file = await octokit.repos.getContents({
+    owner: 'elastic',
+    repo: 'telemetry',
+    path: 'config/templates/xpack-phone-home.json',
+    // @ts-ignore
+    mediaType: {
+      format: 'application/vnd.github.VERSION.raw'
+    }
+  });
+
+  if (Array.isArray(file.data)) {
+    throw new Error('Expected single response, got array');
+  }
+
+  return JSON.parse(Buffer.from(file.data.content!, 'base64').toString());
+}
diff --git a/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data/generate-sample-documents.ts b/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data/generate-sample-documents.ts
new file mode 100644
index 0000000000000..8d76063a7fdf6
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data/generate-sample-documents.ts
@@ -0,0 +1,124 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { DeepPartial } from 'utility-types';
+import {
+  merge,
+  omit,
+  defaultsDeep,
+  range,
+  mapValues,
+  isPlainObject,
+  flatten
+} from 'lodash';
+import uuid from 'uuid';
+import {
+  CollectTelemetryParams,
+  collectDataTelemetry
+  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
+} from '../../../../../plugins/apm/server/lib/apm_telemetry/collect_data_telemetry';
+
+interface GenerateOptions {
+  days: number;
+  instances: number;
+  variation: {
+    min: number;
+    max: number;
+  };
+}
+
+const randomize = (
+  value: unknown,
+  instanceVariation: number,
+  dailyGrowth: number
+) => {
+  if (typeof value === 'boolean') {
+    return Math.random() > 0.5;
+  }
+  if (typeof value === 'number') {
+    return Math.round(instanceVariation * dailyGrowth * value);
+  }
+  return value;
+};
+
+const mapValuesDeep = (
+  obj: Record<string, any>,
+  iterator: (value: unknown, key: string, obj: Record<string, any>) => unknown
+): Record<string, any> =>
+  mapValues(obj, (val, key) =>
+    isPlainObject(val) ? mapValuesDeep(val, iterator) : iterator(val, key!, obj)
+  );
+
+export async function generateSampleDocuments(
+  options: DeepPartial<GenerateOptions> & {
+    collectTelemetryParams: CollectTelemetryParams;
+  }
+) {
+  const { collectTelemetryParams, ...preferredOptions } = options;
+
+  const opts: GenerateOptions = defaultsDeep(
+    {
+      days: 100,
+      instances: 50,
+      variation: {
+        min: 0.1,
+        max: 4
+      }
+    },
+    preferredOptions
+  );
+
+  const sample = await collectDataTelemetry(collectTelemetryParams);
+
+  console.log('Collected telemetry'); // eslint-disable-line no-console
+  console.log('\n' + JSON.stringify(sample, null, 2)); // eslint-disable-line no-console
+
+  const dateOfScriptExecution = new Date();
+
+  return flatten(
+    range(0, opts.instances).map(instanceNo => {
+      const instanceId = uuid.v4();
+      const defaults = {
+        cluster_uuid: instanceId,
+        stack_stats: {
+          kibana: {
+            versions: {
+              version: '8.0.0'
+            }
+          }
+        }
+      };
+
+      const instanceVariation =
+        Math.random() * (opts.variation.max - opts.variation.min) +
+        opts.variation.min;
+
+      return range(0, opts.days).map(dayNo => {
+        const dailyGrowth = Math.pow(1.005, opts.days - 1 - dayNo);
+
+        const timestamp = Date.UTC(
+          dateOfScriptExecution.getFullYear(),
+          dateOfScriptExecution.getMonth(),
+          -dayNo
+        );
+
+        const generated = mapValuesDeep(omit(sample, 'versions'), value =>
+          randomize(value, instanceVariation, dailyGrowth)
+        );
+
+        return merge({}, defaults, {
+          timestamp,
+          stack_stats: {
+            kibana: {
+              plugins: {
+                apm: merge({}, sample, generated)
+              }
+            }
+          }
+        });
+      });
+    })
+  );
+}
diff --git a/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data/index.ts b/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data/index.ts
new file mode 100644
index 0000000000000..bdc57eac412fc
--- /dev/null
+++ b/x-pack/legacy/plugins/apm/scripts/upload-telemetry-data/index.ts
@@ -0,0 +1,208 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// This script downloads the telemetry mapping, runs the APM telemetry tasks,
+// generates a bunch of randomized data based on the downloaded sample,
+// and uploads it to a cluster of your choosing in the same format as it is
+// stored in the telemetry cluster. Its purpose is twofold:
+// - Easier testing of the telemetry tasks
+// - Validate whether we can run the queries we want to on the telemetry data
+
+import fs from 'fs';
+import path from 'path';
+// @ts-ignore
+import { Octokit } from '@octokit/rest';
+import { merge, chunk, flatten, pick, identity } from 'lodash';
+import axios from 'axios';
+import yaml from 'js-yaml';
+import { Client } from 'elasticsearch';
+import { argv } from 'yargs';
+import { promisify } from 'util';
+import { Logger } from 'kibana/server';
+// @ts-ignore
+import consoleStamp from 'console-stamp';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { CollectTelemetryParams } from '../../../../../plugins/apm/server/lib/apm_telemetry/collect_data_telemetry';
+import { downloadTelemetryTemplate } from './download-telemetry-template';
+import mapping from '../../mappings.json';
+import { generateSampleDocuments } from './generate-sample-documents';
+
+consoleStamp(console, '[HH:MM:ss.l]');
+
+const githubToken = process.env.GITHUB_TOKEN;
+
+if (!githubToken) {
+  throw new Error('GITHUB_TOKEN was not provided.');
+}
+
+const kibanaConfigDir = path.join(__filename, '../../../../../../../config');
+const kibanaDevConfig = path.join(kibanaConfigDir, 'kibana.dev.yml');
+const kibanaConfig = path.join(kibanaConfigDir, 'kibana.yml');
+
+const xpackTelemetryIndexName = 'xpack-phone-home';
+
+const loadedKibanaConfig = (yaml.safeLoad(
+  fs.readFileSync(
+    fs.existsSync(kibanaDevConfig) ? kibanaDevConfig : kibanaConfig,
+    'utf8'
+  )
+) || {}) as {};
+
+const cliEsCredentials = pick(
+  {
+    'elasticsearch.username': process.env.ELASTICSEARCH_USERNAME,
+    'elasticsearch.password': process.env.ELASTICSEARCH_PASSWORD,
+    'elasticsearch.hosts': process.env.ELASTICSEARCH_HOST
+  },
+  identity
+) as {
+  'elasticsearch.username': string;
+  'elasticsearch.password': string;
+  'elasticsearch.hosts': string;
+};
+
+const config = {
+  'apm_oss.transactionIndices': 'apm-*',
+  'apm_oss.metricsIndices': 'apm-*',
+  'apm_oss.errorIndices': 'apm-*',
+  'apm_oss.spanIndices': 'apm-*',
+  'apm_oss.onboardingIndices': 'apm-*',
+  'apm_oss.sourcemapIndices': 'apm-*',
+  'elasticsearch.hosts': 'http://localhost:9200',
+  ...loadedKibanaConfig,
+  ...cliEsCredentials
+};
+
+async function uploadData() {
+  const octokit = new Octokit({
+    auth: githubToken
+  });
+
+  const telemetryTemplate = await downloadTelemetryTemplate(octokit);
+
+  const kibanaMapping = mapping['apm-telemetry'];
+
+  const httpAuth =
+    config['elasticsearch.username'] && config['elasticsearch.password']
+      ? {
+          username: config['elasticsearch.username'],
+          password: config['elasticsearch.password']
+        }
+      : null;
+
+  const client = new Client({
+    host: config['elasticsearch.hosts'],
+    ...(httpAuth
+      ? {
+          httpAuth: `${httpAuth.username}:${httpAuth.password}`
+        }
+      : {})
+  });
+
+  if (argv.clear) {
+    try {
+      await promisify(client.indices.delete.bind(client))({
+        index: xpackTelemetryIndexName
+      });
+    } catch (err) {
+      // 404 = index not found, totally okay
+      if (err.status !== 404) {
+        throw err;
+      }
+    }
+  }
+
+  const axiosInstance = axios.create({
+    baseURL: config['elasticsearch.hosts'],
+    ...(httpAuth ? { auth: httpAuth } : {})
+  });
+
+  const newTemplate = merge(telemetryTemplate, {
+    settings: {
+      index: { mapping: { total_fields: { limit: 10000 } } }
+    }
+  });
+
+  // override apm mapping instead of merging
+  newTemplate.mappings.properties.stack_stats.properties.kibana.properties.plugins.properties.apm = kibanaMapping;
+
+  await axiosInstance.put(`/_template/xpack-phone-home`, newTemplate);
+
+  const sampleDocuments = await generateSampleDocuments({
+    collectTelemetryParams: {
+      logger: (console as unknown) as Logger,
+      indices: {
+        ...config,
+        apmCustomLinkIndex: '.apm-custom-links',
+        apmAgentConfigurationIndex: '.apm-agent-configuration'
+      },
+      search: body => {
+        return promisify(client.search.bind(client))({
+          ...body,
+          requestTimeout: 120000
+        }) as any;
+      },
+      indicesStats: body => {
+        return promisify(client.indices.stats.bind(client))({
+          ...body,
+          requestTimeout: 120000
+        }) as any;
+      },
+      transportRequest: (params => {
+        return axiosInstance[params.method](params.path);
+      }) as CollectTelemetryParams['transportRequest']
+    }
+  });
+
+  const chunks = chunk(sampleDocuments, 250);
+
+  await chunks.reduce<Promise<any>>((prev, documents) => {
+    return prev.then(async () => {
+      const body = flatten(
+        documents.map(doc => [{ index: { _index: 'xpack-phone-home' } }, doc])
+      );
+
+      return promisify(client.bulk.bind(client))({
+        body,
+        refresh: true
+      }).then((response: any) => {
+        if (response.errors) {
+          const firstError = response.items.filter(
+            (item: any) => item.index.status >= 400
+          )[0].index.error;
+          throw new Error(`Failed to upload documents: ${firstError.reason} `);
+        }
+      });
+    });
+  }, Promise.resolve());
+}
+
+uploadData()
+  .catch(e => {
+    if ('response' in e) {
+      if (typeof e.response === 'string') {
+        // eslint-disable-next-line no-console
+        console.log(e.response);
+      } else {
+        // eslint-disable-next-line no-console
+        console.log(
+          JSON.stringify(
+            e.response,
+            ['status', 'statusText', 'headers', 'data'],
+            2
+          )
+        );
+      }
+    } else {
+      // eslint-disable-next-line no-console
+      console.log(e);
+    }
+    process.exit(1);
+  })
+  .then(() => {
+    // eslint-disable-next-line no-console
+    console.log('Finished uploading generated telemetry data');
+  });
diff --git a/x-pack/legacy/plugins/graph/index.ts b/x-pack/legacy/plugins/graph/index.ts
index 5122796335e45..53d32a836cfa1 100644
--- a/x-pack/legacy/plugins/graph/index.ts
+++ b/x-pack/legacy/plugins/graph/index.ts
@@ -37,6 +37,7 @@ export const graph: LegacyPluginInitializer = kibana => {
         name: i18n.translate('xpack.graph.featureRegistry.graphFeatureName', {
           defaultMessage: 'Graph',
         }),
+        order: 1200,
         icon: 'graphApp',
         navLinkId: 'graph',
         app: ['graph', 'kibana'],
@@ -44,6 +45,8 @@ export const graph: LegacyPluginInitializer = kibana => {
         validLicenses: ['platinum', 'enterprise', 'trial'],
         privileges: {
           all: {
+            app: ['graph', 'kibana'],
+            catalogue: ['graph'],
             savedObject: {
               all: ['graph-workspace'],
               read: ['index-pattern'],
@@ -51,6 +54,8 @@ export const graph: LegacyPluginInitializer = kibana => {
             ui: ['save', 'delete'],
           },
           read: {
+            app: ['graph', 'kibana'],
+            catalogue: ['graph'],
             savedObject: {
               all: [],
               read: ['index-pattern', 'graph-workspace'],
diff --git a/x-pack/legacy/plugins/lens/index.ts b/x-pack/legacy/plugins/lens/index.ts
index 5eda6c4b4ff7a..b1c67fb81ba07 100644
--- a/x-pack/legacy/plugins/lens/index.ts
+++ b/x-pack/legacy/plugins/lens/index.ts
@@ -19,7 +19,7 @@ export const lens: LegacyPluginInitializer = kibana => {
     id: PLUGIN_ID,
     configPrefix: `xpack.${PLUGIN_ID}`,
     // task_manager could be required, but is only used for telemetry
-    require: ['kibana', 'elasticsearch', 'xpack_main', 'interpreter', 'data'],
+    require: ['kibana', 'elasticsearch', 'xpack_main', 'interpreter'],
     publicDir: resolve(__dirname, 'public'),
 
     uiExports: {
diff --git a/x-pack/legacy/plugins/lens/public/app_plugin/app.test.tsx b/x-pack/legacy/plugins/lens/public/app_plugin/app.test.tsx
index d6312005a6c25..fbda18cc0e307 100644
--- a/x-pack/legacy/plugins/lens/public/app_plugin/app.test.tsx
+++ b/x-pack/legacy/plugins/lens/public/app_plugin/app.test.tsx
@@ -22,7 +22,6 @@ import { dataPluginMock } from '../../../../../../src/plugins/data/public/mocks'
 const dataStartMock = dataPluginMock.createStartContract();
 
 import { TopNavMenuData } from '../../../../../../src/plugins/navigation/public';
-import { DataStart } from '../../../../../../src/legacy/core_plugins/data/public';
 import { coreMock } from 'src/core/public/mocks';
 
 jest.mock('ui/new_platform');
@@ -87,7 +86,6 @@ describe('Lens App', () => {
     editorFrame: EditorFrameInstance;
     data: typeof dataStartMock;
     core: typeof core;
-    dataShim: DataStart;
     storage: Storage;
     docId?: string;
     docStorage: SavedObjectStore;
@@ -134,7 +132,6 @@ describe('Lens App', () => {
       editorFrame: EditorFrameInstance;
       data: typeof dataStartMock;
       core: typeof core;
-      dataShim: DataStart;
       storage: Storage;
       docId?: string;
       docStorage: SavedObjectStore;
@@ -332,7 +329,6 @@ describe('Lens App', () => {
         editorFrame: EditorFrameInstance;
         data: typeof dataStartMock;
         core: typeof core;
-        dataShim: DataStart;
         storage: Storage;
         docId?: string;
         docStorage: SavedObjectStore;
@@ -648,7 +644,6 @@ describe('Lens App', () => {
       editorFrame: EditorFrameInstance;
       data: typeof dataStartMock;
       core: typeof core;
-      dataShim: DataStart;
       storage: Storage;
       docId?: string;
       docStorage: SavedObjectStore;
diff --git a/x-pack/legacy/plugins/lens/public/editor_frame_service/editor_frame/layer_actions.test.ts b/x-pack/legacy/plugins/lens/public/editor_frame_service/editor_frame/layer_actions.test.ts
index 0fd38a8fdba65..3363e34a01568 100644
--- a/x-pack/legacy/plugins/lens/public/editor_frame_service/editor_frame/layer_actions.test.ts
+++ b/x-pack/legacy/plugins/lens/public/editor_frame_service/editor_frame/layer_actions.test.ts
@@ -28,19 +28,21 @@ function createTestArgs(initialLayerIds: string[]) {
     appendLayer: (layerIds: unknown, layerId: string) => [...(layerIds as string[]), layerId],
   };
 
+  const datasourceStates = {
+    ds1: {
+      isLoading: false,
+      state: initialLayerIds.slice(0, 1),
+    },
+    ds2: {
+      isLoading: false,
+      state: initialLayerIds.slice(1),
+    },
+  };
+
   return {
     state: {
       activeDatasourceId: 'ds1',
-      datasourceStates: {
-        ds1: {
-          isLoading: false,
-          state: initialLayerIds.slice(0, 1),
-        },
-        ds2: {
-          isLoading: false,
-          state: initialLayerIds.slice(1),
-        },
-      },
+      datasourceStates,
       title: 'foo',
       visualization: {
         activeId: 'vis1',
@@ -53,6 +55,13 @@ function createTestArgs(initialLayerIds: string[]) {
       ds2: testDatasource('ds2'),
     },
     trackUiEvent,
+    stagedPreview: {
+      visualization: {
+        activeId: 'vis1',
+        state: initialLayerIds,
+      },
+      datasourceStates,
+    },
   };
 }
 
@@ -70,6 +79,7 @@ describe('removeLayer', () => {
     expect(newState.visualization.state).toEqual(['vis_clear_layer1']);
     expect(newState.datasourceStates.ds1.state).toEqual(['ds1_clear_layer1']);
     expect(newState.datasourceStates.ds2.state).toEqual([]);
+    expect(newState.stagedPreview).not.toBeDefined();
     expect(trackUiEvent).toHaveBeenCalledWith('layer_cleared');
   });
 
@@ -89,6 +99,7 @@ describe('removeLayer', () => {
     expect(newState.visualization.state).toEqual(['layer2']);
     expect(newState.datasourceStates.ds1.state).toEqual([]);
     expect(newState.datasourceStates.ds2.state).toEqual(['layer2']);
+    expect(newState.stagedPreview).not.toBeDefined();
     expect(trackUiEvent).toHaveBeenCalledWith('layer_removed');
   });
 });
@@ -110,6 +121,7 @@ describe('appendLayer', () => {
     expect(newState.visualization.state).toEqual(['layer1', 'layer2', 'foo']);
     expect(newState.datasourceStates.ds1.state).toEqual(['layer1', 'foo']);
     expect(newState.datasourceStates.ds2.state).toEqual(['layer2']);
+    expect(newState.stagedPreview).not.toBeDefined();
     expect(trackUiEvent).toHaveBeenCalledWith('layer_added');
   });
 });
diff --git a/x-pack/legacy/plugins/lens/public/editor_frame_service/editor_frame/layer_actions.ts b/x-pack/legacy/plugins/lens/public/editor_frame_service/editor_frame/layer_actions.ts
index e0562e8ca8e11..cc2cbb172d23e 100644
--- a/x-pack/legacy/plugins/lens/public/editor_frame_service/editor_frame/layer_actions.ts
+++ b/x-pack/legacy/plugins/lens/public/editor_frame_service/editor_frame/layer_actions.ts
@@ -50,6 +50,7 @@ export function removeLayer(opts: RemoveLayerOptions): EditorFrameState {
           ? activeVisualization.clearLayer(state.visualization.state, layerId)
           : activeVisualization.removeLayer(state.visualization.state, layerId),
     },
+    stagedPreview: undefined,
   };
 }
 
@@ -84,5 +85,6 @@ export function appendLayer({
       ...state.visualization,
       state: activeVisualization.appendLayer(state.visualization.state, layerId),
     },
+    stagedPreview: undefined,
   };
 }
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx b/x-pack/legacy/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
index 41c317ccab290..f4485774bc942 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_datasource/dimension_panel/dimension_panel.test.tsx
@@ -34,12 +34,6 @@ jest.mock('ui/new_platform');
 jest.mock('../loader');
 jest.mock('../state_helpers');
 
-// Used by indexpattern plugin, which is a dependency of a dependency
-jest.mock('ui/chrome');
-// Contains old and new platform data plugins, used for interpreter and filter ratio
-jest.mock('ui/new_platform');
-jest.mock('plugins/data/setup', () => ({ data: { query: { ui: {} } } }));
-
 const expectedIndexPatterns = {
   1: {
     id: '1',
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx b/x-pack/legacy/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx
index e86a16c1af9d6..e36622f876acd 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.test.tsx
@@ -12,13 +12,9 @@ import {
   getDatasourceSuggestionsFromCurrentState,
 } from './indexpattern_suggestions';
 
+jest.mock('ui/new_platform');
 jest.mock('./loader');
 jest.mock('../id_generator');
-// chrome, notify, storage are used by ./plugin
-jest.mock('ui/chrome');
-// Contains old and new platform data plugins, used for interpreter and filter ratio
-jest.mock('ui/new_platform');
-jest.mock('plugins/data/setup', () => ({ data: { query: { ui: {} } } }));
 
 const expectedIndexPatterns = {
   1: {
@@ -784,7 +780,7 @@ describe('IndexPattern Data Source suggestions', () => {
         expect(suggestions[0].table.columns[0].operation.isBucketed).toBeFalsy();
       });
 
-      it('prepends a terms column on string field', () => {
+      it('appends a terms column on string field', () => {
         const initialState = stateWithNonEmptyTables();
         const suggestions = getDatasourceSuggestionsForField(initialState, '1', {
           name: 'dest',
@@ -799,7 +795,7 @@ describe('IndexPattern Data Source suggestions', () => {
               layers: {
                 previousLayer: initialState.layers.previousLayer,
                 currentLayer: expect.objectContaining({
-                  columnOrder: ['id1', 'cola', 'colb'],
+                  columnOrder: ['cola', 'id1', 'colb'],
                   columns: {
                     ...initialState.layers.currentLayer.columns,
                     id1: expect.objectContaining({
@@ -814,7 +810,7 @@ describe('IndexPattern Data Source suggestions', () => {
         );
       });
 
-      it('appends a metric column on a number field', () => {
+      it('replaces a metric column on a number field if only one other metric is already set', () => {
         const initialState = stateWithNonEmptyTables();
         const suggestions = getDatasourceSuggestionsForField(initialState, '1', {
           name: 'memory',
@@ -823,15 +819,57 @@ describe('IndexPattern Data Source suggestions', () => {
           searchable: true,
         });
 
+        expect(suggestions).toContainEqual(
+          expect.objectContaining({
+            state: expect.objectContaining({
+              layers: expect.objectContaining({
+                currentLayer: expect.objectContaining({
+                  columnOrder: ['cola', 'id1'],
+                  columns: {
+                    cola: initialState.layers.currentLayer.columns.cola,
+                    id1: expect.objectContaining({
+                      operationType: 'avg',
+                      sourceField: 'memory',
+                    }),
+                  },
+                }),
+              }),
+            }),
+          })
+        );
+      });
+
+      it('adds a metric column on a number field if no other metrics set', () => {
+        const initialState = stateWithNonEmptyTables();
+        const modifiedState: IndexPatternPrivateState = {
+          ...initialState,
+          layers: {
+            ...initialState.layers,
+            currentLayer: {
+              ...initialState.layers.currentLayer,
+              columns: {
+                cola: initialState.layers.currentLayer.columns.cola,
+              },
+              columnOrder: ['cola'],
+            },
+          },
+        };
+        const suggestions = getDatasourceSuggestionsForField(modifiedState, '1', {
+          name: 'memory',
+          type: 'number',
+          aggregatable: true,
+          searchable: true,
+        });
+
         expect(suggestions).toContainEqual(
           expect.objectContaining({
             state: expect.objectContaining({
               layers: {
-                previousLayer: initialState.layers.previousLayer,
+                previousLayer: modifiedState.layers.previousLayer,
                 currentLayer: expect.objectContaining({
-                  columnOrder: ['cola', 'colb', 'id1'],
+                  columnOrder: ['cola', 'id1'],
                   columns: {
-                    ...initialState.layers.currentLayer.columns,
+                    ...modifiedState.layers.currentLayer.columns,
                     id1: expect.objectContaining({
                       operationType: 'avg',
                       sourceField: 'memory',
@@ -844,10 +882,30 @@ describe('IndexPattern Data Source suggestions', () => {
         );
       });
 
-      it('appends a metric column with a different operation on a number field if field is already in use', () => {
+      it('adds a metric column on a number field if 2 or more other metric', () => {
         const initialState = stateWithNonEmptyTables();
-        const suggestions = getDatasourceSuggestionsForField(initialState, '1', {
-          name: 'bytes',
+        const modifiedState: IndexPatternPrivateState = {
+          ...initialState,
+          layers: {
+            ...initialState.layers,
+            currentLayer: {
+              ...initialState.layers.currentLayer,
+              columns: {
+                ...initialState.layers.currentLayer.columns,
+                colc: {
+                  dataType: 'number',
+                  isBucketed: false,
+                  sourceField: 'dest',
+                  label: 'Unique count of dest',
+                  operationType: 'cardinality',
+                },
+              },
+              columnOrder: ['cola', 'colb', 'colc'],
+            },
+          },
+        };
+        const suggestions = getDatasourceSuggestionsForField(modifiedState, '1', {
+          name: 'memory',
           type: 'number',
           aggregatable: true,
           searchable: true,
@@ -857,14 +915,14 @@ describe('IndexPattern Data Source suggestions', () => {
           expect.objectContaining({
             state: expect.objectContaining({
               layers: {
-                previousLayer: initialState.layers.previousLayer,
+                previousLayer: modifiedState.layers.previousLayer,
                 currentLayer: expect.objectContaining({
-                  columnOrder: ['cola', 'colb', 'id1'],
+                  columnOrder: ['cola', 'colb', 'colc', 'id1'],
                   columns: {
-                    ...initialState.layers.currentLayer.columns,
+                    ...modifiedState.layers.currentLayer.columns,
                     id1: expect.objectContaining({
-                      operationType: 'sum',
-                      sourceField: 'bytes',
+                      operationType: 'avg',
+                      sourceField: 'memory',
                     }),
                   },
                 }),
diff --git a/x-pack/legacy/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.ts b/x-pack/legacy/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.ts
index 35e99fc4fe98d..96127caa67bb4 100644
--- a/x-pack/legacy/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.ts
+++ b/x-pack/legacy/plugins/lens/public/indexpattern_datasource/indexpattern_suggestions.ts
@@ -197,16 +197,29 @@ function addFieldAsMetricOperation(
     field,
   });
   const newColumnId = generateId();
-  const updatedColumns = {
-    ...layer.columns,
-    [newColumnId]: newColumn,
-  };
-  const updatedColumnOrder = [...layer.columnOrder, newColumnId];
+
+  const [, metrics] = separateBucketColumns(layer);
+
+  // Add metrics if there are 0 or > 1 metric
+  if (metrics.length !== 1) {
+    return {
+      indexPatternId: indexPattern.id,
+      columns: {
+        ...layer.columns,
+        [newColumnId]: newColumn,
+      },
+      columnOrder: [...layer.columnOrder, newColumnId],
+    };
+  }
+
+  // If only one metric, replace instead of add
+  const newColumns = { ...layer.columns, [newColumnId]: newColumn };
+  delete newColumns[metrics[0]];
 
   return {
     indexPatternId: indexPattern.id,
-    columns: updatedColumns,
-    columnOrder: updatedColumnOrder,
+    columns: newColumns,
+    columnOrder: [...layer.columnOrder.filter(c => c !== metrics[0]), newColumnId],
   };
 }
 
@@ -231,21 +244,34 @@ function addFieldAsBucketOperation(
     ...layer.columns,
     [newColumnId]: newColumn,
   };
+
+  const oldDateHistogramIndex = layer.columnOrder.findIndex(
+    columnId => layer.columns[columnId].operationType === 'date_histogram'
+  );
+  const oldDateHistogramId =
+    oldDateHistogramIndex > -1 ? layer.columnOrder[oldDateHistogramIndex] : null;
+
   let updatedColumnOrder: string[] = [];
-  if (applicableBucketOperation === 'terms') {
-    updatedColumnOrder = [newColumnId, ...buckets, ...metrics];
-  } else {
-    const oldDateHistogramColumn = layer.columnOrder.find(
-      columnId => layer.columns[columnId].operationType === 'date_histogram'
-    );
-    if (oldDateHistogramColumn) {
-      delete updatedColumns[oldDateHistogramColumn];
+  if (oldDateHistogramId) {
+    if (applicableBucketOperation === 'terms') {
+      // Insert the new terms bucket above the first date histogram
+      updatedColumnOrder = [
+        ...buckets.slice(0, oldDateHistogramIndex),
+        newColumnId,
+        ...buckets.slice(oldDateHistogramIndex, buckets.length),
+        ...metrics,
+      ];
+    } else if (applicableBucketOperation === 'date_histogram') {
+      // Replace date histogram with new date histogram
+      delete updatedColumns[oldDateHistogramId];
       updatedColumnOrder = layer.columnOrder.map(columnId =>
-        columnId !== oldDateHistogramColumn ? columnId : newColumnId
+        columnId !== oldDateHistogramId ? columnId : newColumnId
       );
-    } else {
-      updatedColumnOrder = [...buckets, newColumnId, ...metrics];
     }
+  } else {
+    // Insert the new bucket after existing buckets. Users will see the same data
+    // they already had, with an extra level of detail.
+    updatedColumnOrder = [...buckets, newColumnId, ...metrics];
   }
   return {
     indexPatternId: indexPattern.id,
diff --git a/x-pack/legacy/plugins/lens/public/metric_visualization/metric_visualization.test.ts b/x-pack/legacy/plugins/lens/public/metric_visualization/metric_visualization.test.ts
index 276f24433c670..62f47a21c85b0 100644
--- a/x-pack/legacy/plugins/lens/public/metric_visualization/metric_visualization.test.ts
+++ b/x-pack/legacy/plugins/lens/public/metric_visualization/metric_visualization.test.ts
@@ -72,6 +72,46 @@ describe('metric_visualization', () => {
     });
   });
 
+  describe('#getConfiguration', () => {
+    it('can add a metric when there is no accessor', () => {
+      expect(
+        metricVisualization.getConfiguration({
+          state: {
+            accessor: undefined,
+            layerId: 'l1',
+          },
+          layerId: 'l1',
+          frame: mockFrame(),
+        })
+      ).toEqual({
+        groups: [
+          expect.objectContaining({
+            supportsMoreColumns: true,
+          }),
+        ],
+      });
+    });
+
+    it('is not allowed to add a metric once one accessor is set', () => {
+      expect(
+        metricVisualization.getConfiguration({
+          state: {
+            accessor: 'a',
+            layerId: 'l1',
+          },
+          layerId: 'l1',
+          frame: mockFrame(),
+        })
+      ).toEqual({
+        groups: [
+          expect.objectContaining({
+            supportsMoreColumns: false,
+          }),
+        ],
+      });
+    });
+  });
+
   describe('#setDimension', () => {
     it('sets the accessor', () => {
       expect(
diff --git a/x-pack/legacy/plugins/lens/public/metric_visualization/metric_visualization.tsx b/x-pack/legacy/plugins/lens/public/metric_visualization/metric_visualization.tsx
index 44256df5aed6d..73b8019a31eaa 100644
--- a/x-pack/legacy/plugins/lens/public/metric_visualization/metric_visualization.tsx
+++ b/x-pack/legacy/plugins/lens/public/metric_visualization/metric_visualization.tsx
@@ -94,7 +94,7 @@ export const metricVisualization: Visualization<State, PersistableState> = {
           groupLabel: i18n.translate('xpack.lens.metric.label', { defaultMessage: 'Metric' }),
           layerId: props.state.layerId,
           accessors: props.state.accessor ? [props.state.accessor] : [],
-          supportsMoreColumns: false,
+          supportsMoreColumns: !props.state.accessor,
           filterOperations: (op: OperationMetadata) => !op.isBucketed && op.dataType === 'number',
         },
       ],
diff --git a/x-pack/legacy/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap b/x-pack/legacy/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap
index 44398c929a2b9..4b19ad288ddaa 100644
--- a/x-pack/legacy/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap
+++ b/x-pack/legacy/plugins/lens/public/xy_visualization/__snapshots__/xy_expression.test.tsx.snap
@@ -29,24 +29,23 @@ exports[`xy_expression XYChart component it renders area 1`] = `
     data={
       Array [
         Object {
-          "Label A": 1,
-          "Label B": 2,
-          "Label D": "Foo",
+          "a": 1,
+          "b": 2,
           "c": "I",
           "d": "Foo",
         },
         Object {
-          "Label A": 1,
-          "Label B": 5,
-          "Label D": "Bar",
+          "a": 1,
+          "b": 5,
           "c": "J",
           "d": "Bar",
         },
       ]
     }
     enableHistogramMode={false}
-    id="Label D"
+    id="d"
     key="0"
+    name={[Function]}
     splitSeriesAccessors={
       Array [
         "d",
@@ -58,8 +57,8 @@ exports[`xy_expression XYChart component it renders area 1`] = `
     xScaleType="ordinal"
     yAccessors={
       Array [
-        "Label A",
-        "Label B",
+        "a",
+        "b",
       ]
     }
     yScaleType="linear"
@@ -96,24 +95,23 @@ exports[`xy_expression XYChart component it renders bar 1`] = `
     data={
       Array [
         Object {
-          "Label A": 1,
-          "Label B": 2,
-          "Label D": "Foo",
+          "a": 1,
+          "b": 2,
           "c": "I",
           "d": "Foo",
         },
         Object {
-          "Label A": 1,
-          "Label B": 5,
-          "Label D": "Bar",
+          "a": 1,
+          "b": 5,
           "c": "J",
           "d": "Bar",
         },
       ]
     }
     enableHistogramMode={false}
-    id="Label D"
+    id="d"
     key="0"
+    name={[Function]}
     splitSeriesAccessors={
       Array [
         "d",
@@ -125,8 +123,8 @@ exports[`xy_expression XYChart component it renders bar 1`] = `
     xScaleType="ordinal"
     yAccessors={
       Array [
-        "Label A",
-        "Label B",
+        "a",
+        "b",
       ]
     }
     yScaleType="linear"
@@ -163,24 +161,23 @@ exports[`xy_expression XYChart component it renders horizontal bar 1`] = `
     data={
       Array [
         Object {
-          "Label A": 1,
-          "Label B": 2,
-          "Label D": "Foo",
+          "a": 1,
+          "b": 2,
           "c": "I",
           "d": "Foo",
         },
         Object {
-          "Label A": 1,
-          "Label B": 5,
-          "Label D": "Bar",
+          "a": 1,
+          "b": 5,
           "c": "J",
           "d": "Bar",
         },
       ]
     }
     enableHistogramMode={false}
-    id="Label D"
+    id="d"
     key="0"
+    name={[Function]}
     splitSeriesAccessors={
       Array [
         "d",
@@ -192,8 +189,8 @@ exports[`xy_expression XYChart component it renders horizontal bar 1`] = `
     xScaleType="ordinal"
     yAccessors={
       Array [
-        "Label A",
-        "Label B",
+        "a",
+        "b",
       ]
     }
     yScaleType="linear"
@@ -230,24 +227,23 @@ exports[`xy_expression XYChart component it renders line 1`] = `
     data={
       Array [
         Object {
-          "Label A": 1,
-          "Label B": 2,
-          "Label D": "Foo",
+          "a": 1,
+          "b": 2,
           "c": "I",
           "d": "Foo",
         },
         Object {
-          "Label A": 1,
-          "Label B": 5,
-          "Label D": "Bar",
+          "a": 1,
+          "b": 5,
           "c": "J",
           "d": "Bar",
         },
       ]
     }
     enableHistogramMode={false}
-    id="Label D"
+    id="d"
     key="0"
+    name={[Function]}
     splitSeriesAccessors={
       Array [
         "d",
@@ -259,8 +255,8 @@ exports[`xy_expression XYChart component it renders line 1`] = `
     xScaleType="ordinal"
     yAccessors={
       Array [
-        "Label A",
-        "Label B",
+        "a",
+        "b",
       ]
     }
     yScaleType="linear"
@@ -297,24 +293,23 @@ exports[`xy_expression XYChart component it renders stacked area 1`] = `
     data={
       Array [
         Object {
-          "Label A": 1,
-          "Label B": 2,
-          "Label D": "Foo",
+          "a": 1,
+          "b": 2,
           "c": "I",
           "d": "Foo",
         },
         Object {
-          "Label A": 1,
-          "Label B": 5,
-          "Label D": "Bar",
+          "a": 1,
+          "b": 5,
           "c": "J",
           "d": "Bar",
         },
       ]
     }
     enableHistogramMode={false}
-    id="Label D"
+    id="d"
     key="0"
+    name={[Function]}
     splitSeriesAccessors={
       Array [
         "d",
@@ -330,8 +325,8 @@ exports[`xy_expression XYChart component it renders stacked area 1`] = `
     xScaleType="ordinal"
     yAccessors={
       Array [
-        "Label A",
-        "Label B",
+        "a",
+        "b",
       ]
     }
     yScaleType="linear"
@@ -368,24 +363,23 @@ exports[`xy_expression XYChart component it renders stacked bar 1`] = `
     data={
       Array [
         Object {
-          "Label A": 1,
-          "Label B": 2,
-          "Label D": "Foo",
+          "a": 1,
+          "b": 2,
           "c": "I",
           "d": "Foo",
         },
         Object {
-          "Label A": 1,
-          "Label B": 5,
-          "Label D": "Bar",
+          "a": 1,
+          "b": 5,
           "c": "J",
           "d": "Bar",
         },
       ]
     }
     enableHistogramMode={false}
-    id="Label D"
+    id="d"
     key="0"
+    name={[Function]}
     splitSeriesAccessors={
       Array [
         "d",
@@ -401,8 +395,8 @@ exports[`xy_expression XYChart component it renders stacked bar 1`] = `
     xScaleType="ordinal"
     yAccessors={
       Array [
-        "Label A",
-        "Label B",
+        "a",
+        "b",
       ]
     }
     yScaleType="linear"
@@ -439,24 +433,23 @@ exports[`xy_expression XYChart component it renders stacked horizontal bar 1`] =
     data={
       Array [
         Object {
-          "Label A": 1,
-          "Label B": 2,
-          "Label D": "Foo",
+          "a": 1,
+          "b": 2,
           "c": "I",
           "d": "Foo",
         },
         Object {
-          "Label A": 1,
-          "Label B": 5,
-          "Label D": "Bar",
+          "a": 1,
+          "b": 5,
           "c": "J",
           "d": "Bar",
         },
       ]
     }
     enableHistogramMode={false}
-    id="Label D"
+    id="d"
     key="0"
+    name={[Function]}
     splitSeriesAccessors={
       Array [
         "d",
@@ -472,8 +465,8 @@ exports[`xy_expression XYChart component it renders stacked horizontal bar 1`] =
     xScaleType="ordinal"
     yAccessors={
       Array [
-        "Label A",
-        "Label B",
+        "a",
+        "b",
       ]
     }
     yScaleType="linear"
diff --git a/x-pack/legacy/plugins/lens/public/xy_visualization/xy_expression.test.tsx b/x-pack/legacy/plugins/lens/public/xy_visualization/xy_expression.test.tsx
index 6323a063c988b..adf64fece2942 100644
--- a/x-pack/legacy/plugins/lens/public/xy_visualization/xy_expression.test.tsx
+++ b/x-pack/legacy/plugins/lens/public/xy_visualization/xy_expression.test.tsx
@@ -12,6 +12,7 @@ import {
   LineSeries,
   Settings,
   ScaleType,
+  SeriesNameFn,
 } from '@elastic/charts';
 import { xyChart, XYChart } from './xy_expression';
 import { LensMultiTable } from '../types';
@@ -367,7 +368,7 @@ describe('xy_expression', () => {
       expect(component.find(BarSeries).prop('enableHistogramMode')).toEqual(false);
     });
 
-    test('it rewrites the rows based on provided labels', () => {
+    test('it names the series for multiple accessors', () => {
       const { data, args } = sampleArgs();
 
       const component = shallow(
@@ -379,25 +380,56 @@ describe('xy_expression', () => {
           chartTheme={{}}
         />
       );
-      expect(component.find(LineSeries).prop('data')).toEqual([
-        { 'Label A': 1, 'Label B': 2, c: 'I', 'Label D': 'Foo', d: 'Foo' },
-        { 'Label A': 1, 'Label B': 5, c: 'J', 'Label D': 'Bar', d: 'Bar' },
-      ]);
+      const nameFn = component.find(LineSeries).prop('name') as SeriesNameFn;
+
+      expect(
+        nameFn(
+          {
+            seriesKeys: ['a', 'b', 'c', 'd'],
+            key: '',
+            specId: 'a',
+            yAccessor: '',
+            splitAccessors: new Map(),
+          },
+          false
+        )
+      ).toEqual('Label A - Label B - c - Label D');
     });
 
-    test('it uses labels as Y accessors', () => {
+    test('it names the series for a single accessor', () => {
       const { data, args } = sampleArgs();
 
       const component = shallow(
         <XYChart
           data={data}
-          args={args}
+          args={{
+            ...args,
+            layers: [
+              {
+                ...args.layers[0],
+                accessors: ['a'],
+              },
+            ],
+          }}
           formatFactory={getFormatSpy}
           timeZone="UTC"
           chartTheme={{}}
         />
       );
-      expect(component.find(LineSeries).prop('yAccessors')).toEqual(['Label A', 'Label B']);
+      const nameFn = component.find(LineSeries).prop('name') as SeriesNameFn;
+
+      expect(
+        nameFn(
+          {
+            seriesKeys: ['a', 'b', 'c', 'd'],
+            key: '',
+            specId: 'a',
+            yAccessor: '',
+            splitAccessors: new Map(),
+          },
+          false
+        )
+      ).toEqual('Label A');
     });
 
     test('it set the scale of the x axis according to the args prop', () => {
diff --git a/x-pack/legacy/plugins/lens/public/xy_visualization/xy_expression.tsx b/x-pack/legacy/plugins/lens/public/xy_visualization/xy_expression.tsx
index cc30e5d18a7f7..ce966ee6150a0 100644
--- a/x-pack/legacy/plugins/lens/public/xy_visualization/xy_expression.tsx
+++ b/x-pack/legacy/plugins/lens/public/xy_visualization/xy_expression.tsx
@@ -18,7 +18,6 @@ import {
 } from '@elastic/charts';
 import { I18nProvider } from '@kbn/i18n/react';
 import {
-  KibanaDatatable,
   IInterpreterRenderHandlers,
   ExpressionRenderDefinition,
   ExpressionFunctionDefinition,
@@ -33,6 +32,11 @@ import { XYArgs, SeriesType, visualizationTypes } from './types';
 import { VisualizationContainer } from '../visualization_container';
 import { isHorizontalChart } from './state_helpers';
 
+type InferPropType<T> = T extends React.FunctionComponent<infer P> ? P : T;
+type SeriesSpec = InferPropType<typeof LineSeries> &
+  InferPropType<typeof BarSeries> &
+  InferPropType<typeof AreaSeries>;
+
 export interface XYChartProps {
   data: LensMultiTable;
   args: XYArgs;
@@ -247,80 +251,43 @@ export function XYChart({ data, args, formatFactory, timeZone, chartTheme }: XYC
             return;
           }
 
-          const columnToLabelMap = columnToLabel ? JSON.parse(columnToLabel) : {};
-          const splitAccessorLabel = splitAccessor ? columnToLabelMap[splitAccessor] : '';
-          const yAccessors = accessors.map(accessor => columnToLabelMap[accessor] || accessor);
-          const idForLegend = splitAccessorLabel || yAccessors;
-          const sanitized = sanitizeRows({
-            splitAccessor,
-            formatFactory,
-            columnToLabelMap,
-            table: data.tables[layerId],
-          });
-
-          const seriesProps = {
-            key: index,
-            splitSeriesAccessors: sanitized.splitAccessor ? [sanitized.splitAccessor] : [],
+          const columnToLabelMap: Record<string, string> = columnToLabel
+            ? JSON.parse(columnToLabel)
+            : {};
+          const table = data.tables[layerId];
+          const seriesProps: SeriesSpec = {
+            splitSeriesAccessors: splitAccessor ? [splitAccessor] : [],
             stackAccessors: seriesType.includes('stacked') ? [xAccessor] : [],
-            id: idForLegend,
+            id: splitAccessor || accessors.join(','),
             xAccessor,
-            yAccessors,
-            data: sanitized.rows,
+            yAccessors: accessors,
+            data: table.rows,
             xScaleType,
             yScaleType,
             enableHistogramMode: isHistogram && (seriesType.includes('stacked') || !splitAccessor),
             timeZone,
+            name(d) {
+              if (accessors.length > 1) {
+                return d.seriesKeys
+                  .map((key: string | number) => columnToLabelMap[key] || key)
+                  .join(' - ');
+              }
+              return columnToLabelMap[d.seriesKeys[0]] ?? d.seriesKeys[0];
+            },
           };
 
           return seriesType === 'line' ? (
-            <LineSeries {...seriesProps} />
+            <LineSeries key={index} {...seriesProps} />
           ) : seriesType === 'bar' ||
             seriesType === 'bar_stacked' ||
             seriesType === 'bar_horizontal' ||
             seriesType === 'bar_horizontal_stacked' ? (
-            <BarSeries {...seriesProps} />
+            <BarSeries key={index} {...seriesProps} />
           ) : (
-            <AreaSeries {...seriesProps} />
+            <AreaSeries key={index} {...seriesProps} />
           );
         }
       )}
     </Chart>
   );
 }
-
-/**
- * Renames the columns to match the user-configured accessors in
- * columnToLabelMap. If a splitAccessor is provided, formats the
- * values in that column.
- */
-function sanitizeRows({
-  splitAccessor,
-  table,
-  formatFactory,
-  columnToLabelMap,
-}: {
-  splitAccessor?: string;
-  table: KibanaDatatable;
-  formatFactory: FormatFactory;
-  columnToLabelMap: Record<string, string | undefined>;
-}) {
-  const column = table.columns.find(c => c.id === splitAccessor);
-  const formatter = formatFactory(column && column.formatHint);
-
-  return {
-    splitAccessor: column && column.id,
-    rows: table.rows.map(r => {
-      const newRow: typeof r = {};
-
-      if (column) {
-        newRow[column.id] = formatter.convert(r[column.id]);
-      }
-
-      Object.keys(r).forEach(key => {
-        const newKey = columnToLabelMap[key] || key;
-        newRow[newKey] = r[key];
-      });
-      return newRow;
-    }),
-  };
-}
diff --git a/x-pack/legacy/plugins/maps/public/actions/map_actions.d.ts b/x-pack/legacy/plugins/maps/public/actions/map_actions.d.ts
index 418f2880c1077..3a61d5affd861 100644
--- a/x-pack/legacy/plugins/maps/public/actions/map_actions.d.ts
+++ b/x-pack/legacy/plugins/maps/public/actions/map_actions.d.ts
@@ -5,6 +5,7 @@
  */
 /* eslint-disable @typescript-eslint/consistent-type-definitions */
 
+import { LAYER_TYPE } from '../../common/constants';
 import { DataMeta, MapFilters } from '../../common/data_request_descriptor_types';
 
 export type SyncContext = {
@@ -16,3 +17,10 @@ export type SyncContext = {
   registerCancelCallback(requestToken: symbol, callback: () => void): void;
   dataFilters: MapFilters;
 };
+
+export function updateSourceProp(
+  layerId: string,
+  propName: string,
+  value: unknown,
+  newLayerType?: LAYER_TYPE
+): void;
diff --git a/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/view.d.ts b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/view.d.ts
new file mode 100644
index 0000000000000..6d1d076c723ad
--- /dev/null
+++ b/x-pack/legacy/plugins/maps/public/connected_components/layer_panel/view.d.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+/* eslint-disable @typescript-eslint/consistent-type-definitions */
+
+import { LAYER_TYPE } from '../../../common/constants';
+
+export type OnSourceChangeArgs = {
+  propName: string;
+  value: unknown;
+  newLayerType?: LAYER_TYPE;
+};
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap
new file mode 100644
index 0000000000000..967225d6f0fdc
--- /dev/null
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/scaling_form.test.tsx.snap
@@ -0,0 +1,205 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`should not render clusters option when clustering is not supported 1`] = `
+<Fragment>
+  <EuiTitle
+    size="xs"
+  >
+    <h5>
+      <FormattedMessage
+        defaultMessage="Scaling"
+        id="xpack.maps.esSearch.scaleTitle"
+        values={Object {}}
+      />
+    </h5>
+  </EuiTitle>
+  <EuiSpacer
+    size="m"
+  />
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    labelType="label"
+  >
+    <EuiRadioGroup
+      idSelected="LIMIT"
+      onChange={[Function]}
+      options={
+        Array [
+          Object {
+            "id": "LIMIT",
+            "label": "Limit results to 10000.",
+          },
+          Object {
+            "id": "TOP_HITS",
+            "label": "Show top hits per entity.",
+          },
+        ]
+      }
+    />
+  </EuiFormRow>
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    labelType="label"
+  >
+    <EuiSwitch
+      checked={true}
+      compressed={true}
+      label="Dynamically filter for data in the visible map area"
+      onChange={[Function]}
+    />
+  </EuiFormRow>
+</Fragment>
+`;
+
+exports[`should render 1`] = `
+<Fragment>
+  <EuiTitle
+    size="xs"
+  >
+    <h5>
+      <FormattedMessage
+        defaultMessage="Scaling"
+        id="xpack.maps.esSearch.scaleTitle"
+        values={Object {}}
+      />
+    </h5>
+  </EuiTitle>
+  <EuiSpacer
+    size="m"
+  />
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    labelType="label"
+  >
+    <EuiRadioGroup
+      idSelected="LIMIT"
+      onChange={[Function]}
+      options={
+        Array [
+          Object {
+            "id": "LIMIT",
+            "label": "Limit results to 10000.",
+          },
+          Object {
+            "id": "TOP_HITS",
+            "label": "Show top hits per entity.",
+          },
+          Object {
+            "id": "CLUSTERS",
+            "label": "Show clusters when results exceed 10000.",
+          },
+        ]
+      }
+    />
+  </EuiFormRow>
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    labelType="label"
+  >
+    <EuiSwitch
+      checked={true}
+      compressed={true}
+      label="Dynamically filter for data in the visible map area"
+      onChange={[Function]}
+    />
+  </EuiFormRow>
+</Fragment>
+`;
+
+exports[`should render top hits form when scaling type is TOP_HITS 1`] = `
+<Fragment>
+  <EuiTitle
+    size="xs"
+  >
+    <h5>
+      <FormattedMessage
+        defaultMessage="Scaling"
+        id="xpack.maps.esSearch.scaleTitle"
+        values={Object {}}
+      />
+    </h5>
+  </EuiTitle>
+  <EuiSpacer
+    size="m"
+  />
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    labelType="label"
+  >
+    <EuiRadioGroup
+      idSelected="TOP_HITS"
+      onChange={[Function]}
+      options={
+        Array [
+          Object {
+            "id": "LIMIT",
+            "label": "Limit results to 10000.",
+          },
+          Object {
+            "id": "TOP_HITS",
+            "label": "Show top hits per entity.",
+          },
+          Object {
+            "id": "CLUSTERS",
+            "label": "Show clusters when results exceed 10000.",
+          },
+        ]
+      }
+    />
+  </EuiFormRow>
+  <EuiFormRow
+    describedByIds={Array []}
+    display="row"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    labelType="label"
+  >
+    <EuiSwitch
+      checked={true}
+      compressed={true}
+      label="Dynamically filter for data in the visible map area"
+      onChange={[Function]}
+    />
+  </EuiFormRow>
+  <EuiHorizontalRule
+    margin="xs"
+  />
+  <EuiFormRow
+    describedByIds={Array []}
+    display="columnCompressed"
+    fullWidth={false}
+    hasChildLabel={true}
+    hasEmptyLabelSpace={false}
+    label="Entity"
+    labelType="label"
+  >
+    <SingleFieldSelect
+      compressed={true}
+      fields={Array []}
+      onChange={[Function]}
+      placeholder="Select entity field"
+    />
+  </EuiFormRow>
+</Fragment>
+`;
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap
index c94f305773f35..0cb7f67fb9c92 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/__snapshots__/update_source_editor.test.js.snap
@@ -91,253 +91,16 @@ exports[`should enable sort order select when sort field provided 1`] = `
     size="s"
   />
   <EuiPanel>
-    <EuiTitle
-      size="xs"
-    >
-      <h5>
-        <FormattedMessage
-          defaultMessage="Scaling"
-          id="xpack.maps.esSearch.scaleTitle"
-          values={Object {}}
-        />
-      </h5>
-    </EuiTitle>
-    <EuiSpacer
-      size="m"
-    />
-    <EuiFormRow
-      describedByIds={Array []}
-      display="row"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      labelType="label"
-    >
-      <EuiRadioGroup
-        idSelected="LIMIT"
-        onChange={[Function]}
-        options={
-          Array [
-            Object {
-              "id": "LIMIT",
-              "label": "Limit results to 10000.",
-            },
-            Object {
-              "id": "TOP_HITS",
-              "label": "Show top hits per entity.",
-            },
-          ]
-        }
-      />
-    </EuiFormRow>
-    <EuiFormRow
-      describedByIds={Array []}
-      display="row"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      labelType="label"
-    >
-      <EuiSwitch
-        checked={true}
-        compressed={true}
-        label="Dynamically filter for data in the visible map area"
-        onChange={[Function]}
-      />
-    </EuiFormRow>
-  </EuiPanel>
-  <EuiSpacer
-    size="s"
-  />
-</Fragment>
-`;
-
-exports[`should render top hits form when scaling type is TOP_HITS 1`] = `
-<Fragment>
-  <EuiPanel>
-    <EuiTitle
-      size="xs"
-    >
-      <h5>
-        <FormattedMessage
-          defaultMessage="Tooltip fields"
-          id="xpack.maps.esSearch.tooltipsTitle"
-          values={Object {}}
-        />
-      </h5>
-    </EuiTitle>
-    <EuiSpacer
-      size="m"
-    />
-    <TooltipSelector
-      fields={null}
+    <ScalingForm
+      filterByMapBounds={true}
+      indexPatternId="indexPattern1"
       onChange={[Function]}
-      tooltipFields={Array []}
-    />
-  </EuiPanel>
-  <EuiSpacer
-    size="s"
-  />
-  <EuiPanel>
-    <EuiTitle
-      size="xs"
-    >
-      <h5>
-        <FormattedMessage
-          defaultMessage="Sorting"
-          id="xpack.maps.esSearch.sortTitle"
-          values={Object {}}
-        />
-      </h5>
-    </EuiTitle>
-    <EuiSpacer
-      size="m"
-    />
-    <EuiFormRow
-      describedByIds={Array []}
-      display="columnCompressed"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      label="Field"
-      labelType="label"
-    >
-      <SingleFieldSelect
-        compressed={true}
-        fields={null}
-        onChange={[Function]}
-        placeholder="Select sort field"
-      />
-    </EuiFormRow>
-    <EuiFormRow
-      describedByIds={Array []}
-      display="columnCompressed"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      label="Order"
-      labelType="label"
-    >
-      <EuiSelect
-        compressed={true}
-        disabled={true}
-        onChange={[Function]}
-        options={
-          Array [
-            Object {
-              "text": "ascending",
-              "value": "asc",
-            },
-            Object {
-              "text": "descending",
-              "value": "desc",
-            },
-          ]
-        }
-        value="DESC"
-      />
-    </EuiFormRow>
-  </EuiPanel>
-  <EuiSpacer
-    size="s"
-  />
-  <EuiPanel>
-    <EuiTitle
-      size="xs"
-    >
-      <h5>
-        <FormattedMessage
-          defaultMessage="Scaling"
-          id="xpack.maps.esSearch.scaleTitle"
-          values={Object {}}
-        />
-      </h5>
-    </EuiTitle>
-    <EuiSpacer
-      size="m"
+      scalingType="LIMIT"
+      supportsClustering={false}
+      termFields={null}
+      topHitsSize={1}
+      topHitsSplitField="trackId"
     />
-    <EuiFormRow
-      describedByIds={Array []}
-      display="row"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      labelType="label"
-    >
-      <EuiRadioGroup
-        idSelected="TOP_HITS"
-        onChange={[Function]}
-        options={
-          Array [
-            Object {
-              "id": "LIMIT",
-              "label": "Limit results to 10000.",
-            },
-            Object {
-              "id": "TOP_HITS",
-              "label": "Show top hits per entity.",
-            },
-          ]
-        }
-      />
-    </EuiFormRow>
-    <EuiFormRow
-      describedByIds={Array []}
-      display="row"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      labelType="label"
-    >
-      <EuiSwitch
-        checked={true}
-        compressed={true}
-        label="Dynamically filter for data in the visible map area"
-        onChange={[Function]}
-      />
-    </EuiFormRow>
-    <EuiHorizontalRule
-      margin="xs"
-    />
-    <EuiFormRow
-      describedByIds={Array []}
-      display="columnCompressed"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      label="Entity"
-      labelType="label"
-    >
-      <SingleFieldSelect
-        compressed={true}
-        fields={null}
-        onChange={[Function]}
-        placeholder="Select entity field"
-        value="trackId"
-      />
-    </EuiFormRow>
-    <EuiFormRow
-      describedByIds={Array []}
-      display="columnCompressed"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      label="Documents per entity"
-      labelType="label"
-    >
-      <ValidatedRange
-        compressed={true}
-        data-test-subj="layerPanelTopHitsSize"
-        max={100}
-        min={1}
-        onChange={[Function]}
-        showInput={true}
-        showLabels={true}
-        showRange={true}
-        step={1}
-        value={1}
-      />
-    </EuiFormRow>
   </EuiPanel>
   <EuiSpacer
     size="s"
@@ -435,60 +198,16 @@ exports[`should render update source editor 1`] = `
     size="s"
   />
   <EuiPanel>
-    <EuiTitle
-      size="xs"
-    >
-      <h5>
-        <FormattedMessage
-          defaultMessage="Scaling"
-          id="xpack.maps.esSearch.scaleTitle"
-          values={Object {}}
-        />
-      </h5>
-    </EuiTitle>
-    <EuiSpacer
-      size="m"
+    <ScalingForm
+      filterByMapBounds={true}
+      indexPatternId="indexPattern1"
+      onChange={[Function]}
+      scalingType="LIMIT"
+      supportsClustering={false}
+      termFields={null}
+      topHitsSize={1}
+      topHitsSplitField="trackId"
     />
-    <EuiFormRow
-      describedByIds={Array []}
-      display="row"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      labelType="label"
-    >
-      <EuiRadioGroup
-        idSelected="LIMIT"
-        onChange={[Function]}
-        options={
-          Array [
-            Object {
-              "id": "LIMIT",
-              "label": "Limit results to 10000.",
-            },
-            Object {
-              "id": "TOP_HITS",
-              "label": "Show top hits per entity.",
-            },
-          ]
-        }
-      />
-    </EuiFormRow>
-    <EuiFormRow
-      describedByIds={Array []}
-      display="row"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={false}
-      labelType="label"
-    >
-      <EuiSwitch
-        checked={true}
-        compressed={true}
-        label="Dynamically filter for data in the visible map area"
-        onChange={[Function]}
-      />
-    </EuiFormRow>
   </EuiPanel>
   <EuiSpacer
     size="s"
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
index 895ad12f107d9..73bea574ace28 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/create_source_editor.js
@@ -7,24 +7,17 @@
 import _ from 'lodash';
 import React, { Fragment, Component } from 'react';
 import PropTypes from 'prop-types';
-import { EuiFormRow, EuiSpacer, EuiSwitch, EuiCallOut } from '@elastic/eui';
+import { EuiFormRow, EuiSpacer } from '@elastic/eui';
 
 import { SingleFieldSelect } from '../../../components/single_field_select';
-import {
-  getIndexPatternService,
-  getIndexPatternSelectComponent,
-  getHttp,
-} from '../../../kibana_services';
+import { getIndexPatternService, getIndexPatternSelectComponent } from '../../../kibana_services';
 import { NoIndexPatternCallout } from '../../../components/no_index_pattern_callout';
-import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
-import {
-  ES_GEO_FIELD_TYPE,
-  GIS_API_PATH,
-  DEFAULT_MAX_RESULT_WINDOW,
-} from '../../../../common/constants';
+import { ES_GEO_FIELD_TYPE, SCALING_TYPES } from '../../../../common/constants';
 import { DEFAULT_FILTER_BY_MAP_BOUNDS } from './constants';
 import { indexPatterns } from '../../../../../../../../src/plugins/data/public';
+import { ScalingForm } from './scaling_form';
+import { getTermsFields } from '../../../index_pattern_util';
 
 function getGeoFields(fields) {
   return fields.filter(field => {
@@ -34,11 +27,26 @@ function getGeoFields(fields) {
     );
   });
 }
+
+function isGeoFieldAggregatable(indexPattern, geoFieldName) {
+  if (!indexPattern) {
+    return false;
+  }
+
+  const geoField = indexPattern.fields.getByName(geoFieldName);
+  return geoField && geoField.aggregatable;
+}
+
 const RESET_INDEX_PATTERN_STATE = {
   indexPattern: undefined,
-  geoField: undefined,
+  geoFields: undefined,
+
+  // ES search source descriptor state
+  geoFieldName: undefined,
   filterByMapBounds: DEFAULT_FILTER_BY_MAP_BOUNDS,
-  showFilterByBoundsSwitch: false,
+  scalingType: SCALING_TYPES.CLUSTERS, // turn on clusting by default
+  topHitsSplitField: undefined,
+  topHitsSize: 1,
 };
 
 export class CreateSourceEditor extends Component {
@@ -58,41 +66,28 @@ export class CreateSourceEditor extends Component {
 
   componentDidMount() {
     this._isMounted = true;
-    this.loadIndexPattern(this.state.indexPatternId);
   }
 
-  onIndexPatternSelect = indexPatternId => {
+  _onIndexPatternSelect = indexPatternId => {
     this.setState(
       {
         indexPatternId,
       },
-      this.loadIndexPattern(indexPatternId)
+      this._loadIndexPattern(indexPatternId)
     );
   };
 
-  loadIndexPattern = indexPatternId => {
+  _loadIndexPattern = indexPatternId => {
     this.setState(
       {
         isLoadingIndexPattern: true,
         ...RESET_INDEX_PATTERN_STATE,
       },
-      this.debouncedLoad.bind(null, indexPatternId)
+      this._debouncedLoad.bind(null, indexPatternId)
     );
   };
 
-  loadIndexDocCount = async indexPatternTitle => {
-    const http = getHttp();
-    const { count } = await http.fetch(`../${GIS_API_PATH}/indexCount`, {
-      method: 'GET',
-      credentials: 'same-origin',
-      query: {
-        index: indexPatternTitle,
-      },
-    });
-    return count;
-  };
-
-  debouncedLoad = _.debounce(async indexPatternId => {
+  _debouncedLoad = _.debounce(async indexPatternId => {
     if (!indexPatternId || indexPatternId.length === 0) {
       return;
     }
@@ -105,15 +100,6 @@ export class CreateSourceEditor extends Component {
       return;
     }
 
-    let indexHasSmallDocCount = false;
-    try {
-      const indexDocCount = await this.loadIndexDocCount(indexPattern.title);
-      indexHasSmallDocCount = indexDocCount <= DEFAULT_MAX_RESULT_WINDOW;
-    } catch (error) {
-      // retrieving index count is a nice to have and is not essential
-      // do not interrupt user flow if unable to retrieve count
-    }
-
     if (!this._isMounted) {
       return;
     }
@@ -124,43 +110,71 @@ export class CreateSourceEditor extends Component {
       return;
     }
 
+    const geoFields = getGeoFields(indexPattern.fields);
     this.setState({
       isLoadingIndexPattern: false,
       indexPattern: indexPattern,
-      filterByMapBounds: !indexHasSmallDocCount, // Turn off filterByMapBounds when index contains a limited number of documents
-      showFilterByBoundsSwitch: indexHasSmallDocCount,
+      geoFields,
     });
 
-    //make default selection
-    const geoFields = getGeoFields(indexPattern.fields);
-    if (geoFields[0]) {
-      this.onGeoFieldSelect(geoFields[0].name);
+    if (geoFields.length) {
+      // make default selection, prefer aggregatable field over the first available
+      const firstAggregatableGeoField = geoFields.find(geoField => {
+        return geoField.aggregatable;
+      });
+      const defaultGeoFieldName = firstAggregatableGeoField
+        ? firstAggregatableGeoField
+        : geoFields[0];
+      this._onGeoFieldSelect(defaultGeoFieldName.name);
     }
   }, 300);
 
-  onGeoFieldSelect = geoField => {
+  _onGeoFieldSelect = geoFieldName => {
+    // Respect previous scaling type selection unless newly selected geo field does not support clustering.
+    const scalingType =
+      this.state.scalingType === SCALING_TYPES.CLUSTERS &&
+      !isGeoFieldAggregatable(this.state.indexPattern, geoFieldName)
+        ? SCALING_TYPES.LIMIT
+        : this.state.scalingType;
     this.setState(
       {
-        geoField,
+        geoFieldName,
+        scalingType,
       },
-      this.previewLayer
+      this._previewLayer
     );
   };
 
-  onFilterByMapBoundsChange = event => {
+  _onScalingPropChange = ({ propName, value }) => {
     this.setState(
       {
-        filterByMapBounds: event.target.checked,
+        [propName]: value,
       },
-      this.previewLayer
+      this._previewLayer
     );
   };
 
-  previewLayer = () => {
-    const { indexPatternId, geoField, filterByMapBounds } = this.state;
+  _previewLayer = () => {
+    const {
+      indexPatternId,
+      geoFieldName,
+      filterByMapBounds,
+      scalingType,
+      topHitsSplitField,
+      topHitsSize,
+    } = this.state;
 
     const sourceConfig =
-      indexPatternId && geoField ? { indexPatternId, geoField, filterByMapBounds } : null;
+      indexPatternId && geoFieldName
+        ? {
+            indexPatternId,
+            geoField: geoFieldName,
+            filterByMapBounds,
+            scalingType,
+            topHitsSplitField,
+            topHitsSize,
+          }
+        : null;
     this.props.onSourceConfigChange(sourceConfig);
   };
 
@@ -183,56 +197,35 @@ export class CreateSourceEditor extends Component {
           placeholder={i18n.translate('xpack.maps.source.esSearch.selectLabel', {
             defaultMessage: 'Select geo field',
           })}
-          value={this.state.geoField}
-          onChange={this.onGeoFieldSelect}
-          fields={
-            this.state.indexPattern ? getGeoFields(this.state.indexPattern.fields) : undefined
-          }
+          value={this.state.geoFieldName}
+          onChange={this._onGeoFieldSelect}
+          fields={this.state.geoFields}
         />
       </EuiFormRow>
     );
   }
 
-  _renderFilterByMapBounds() {
-    if (!this.state.showFilterByBoundsSwitch) {
+  _renderScalingPanel() {
+    if (!this.state.indexPattern || !this.state.geoFieldName) {
       return null;
     }
 
     return (
       <Fragment>
-        <EuiCallOut
-          title={i18n.translate('xpack.maps.source.esSearch.disableFilterByMapBoundsTitle', {
-            defaultMessage: `Dynamic data filter disabled`,
-          })}
-        >
-          <p>
-            <FormattedMessage
-              id="xpack.maps.source.esSearch.disableFilterByMapBoundsExplainMsg"
-              defaultMessage="Index '{indexPatternTitle}' has a small number of documents and does not require dynamic filtering."
-              values={{
-                indexPatternTitle: this.state.indexPattern
-                  ? this.state.indexPattern.title
-                  : this.state.indexPatternId,
-              }}
-            />
-          </p>
-          <p>
-            <FormattedMessage
-              id="xpack.maps.source.esSearch.disableFilterByMapBoundsTurnOnMsg"
-              defaultMessage="Turn on dynamic filtering if you expect the number of documents to increase."
-            />
-          </p>
-        </EuiCallOut>
-        <EuiSpacer size="s" />
-        <EuiFormRow>
-          <EuiSwitch
-            label={i18n.translate('xpack.maps.source.esSearch.extentFilterLabel', {
-              defaultMessage: `Dynamically filter for data in the visible map area`,
-            })}
-            checked={this.state.filterByMapBounds}
-            onChange={this.onFilterByMapBoundsChange}
-          />
-        </EuiFormRow>
+        <EuiSpacer size="m" />
+        <ScalingForm
+          filterByMapBounds={this.state.filterByMapBounds}
+          indexPatternId={this.state.indexPatternId}
+          onChange={this._onScalingPropChange}
+          scalingType={this.state.scalingType}
+          supportsClustering={isGeoFieldAggregatable(
+            this.state.indexPattern,
+            this.state.geoFieldName
+          )}
+          termFields={getTermsFields(this.state.indexPattern.fields)}
+          topHitsSplitField={this.state.topHitsSplitField}
+          topHitsSize={this.state.topHitsSize}
+        />
       </Fragment>
     );
   }
@@ -265,7 +258,7 @@ export class CreateSourceEditor extends Component {
           <IndexPatternSelect
             isDisabled={this.state.noGeoIndexPatternsExist}
             indexPatternId={this.state.indexPatternId}
-            onChange={this.onIndexPatternSelect}
+            onChange={this._onIndexPatternSelect}
             placeholder={i18n.translate(
               'xpack.maps.source.esSearch.selectIndexPatternPlaceholder',
               {
@@ -279,7 +272,7 @@ export class CreateSourceEditor extends Component {
 
         {this._renderGeoSelect()}
 
-        {this._renderFilterByMapBounds()}
+        {this._renderScalingPanel()}
       </Fragment>
     );
   }
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.js b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.js
index 440b9aa89a945..cd44ef49623fa 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.js
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/es_search_source.js
@@ -149,11 +149,14 @@ export class ESSearchSource extends AbstractESSource {
   }
 
   renderSourceSettingsEditor({ onChange }) {
+    const getGeoField = () => {
+      return this._getGeoField();
+    };
     return (
       <UpdateSourceEditor
         source={this}
         indexPatternId={this.getIndexPatternId()}
-        getGeoField={this._getGeoField}
+        getGeoField={getGeoField}
         onChange={onChange}
         tooltipFields={this._tooltipFields}
         sortField={this._descriptor.sortField}
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.test.tsx b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.test.tsx
new file mode 100644
index 0000000000000..03f29685891ec
--- /dev/null
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.test.tsx
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+jest.mock('../../../kibana_services', () => ({}));
+
+jest.mock('./load_index_settings', () => ({
+  loadIndexSettings: async () => {
+    return { maxInnerResultWindow: 100, maxResultWindow: 10000 };
+  },
+}));
+
+import React from 'react';
+import { shallow } from 'enzyme';
+
+import { ScalingForm } from './scaling_form';
+import { SCALING_TYPES } from '../../../../common/constants';
+
+const defaultProps = {
+  filterByMapBounds: true,
+  indexPatternId: 'myIndexPattern',
+  onChange: () => {},
+  scalingType: SCALING_TYPES.LIMIT,
+  supportsClustering: true,
+  termFields: [],
+  topHitsSize: 1,
+};
+
+test('should render', async () => {
+  const component = shallow(<ScalingForm {...defaultProps} />);
+
+  expect(component).toMatchSnapshot();
+});
+
+test('should not render clusters option when clustering is not supported', async () => {
+  const component = shallow(<ScalingForm {...defaultProps} supportsClustering={false} />);
+
+  expect(component).toMatchSnapshot();
+});
+
+test('should render top hits form when scaling type is TOP_HITS', async () => {
+  const component = shallow(<ScalingForm {...defaultProps} scalingType={SCALING_TYPES.TOP_HITS} />);
+
+  expect(component).toMatchSnapshot();
+});
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.tsx b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.tsx
new file mode 100644
index 0000000000000..c5950f1132974
--- /dev/null
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/scaling_form.tsx
@@ -0,0 +1,230 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { Fragment, Component } from 'react';
+import {
+  EuiFormRow,
+  EuiSwitch,
+  EuiSwitchEvent,
+  EuiTitle,
+  EuiSpacer,
+  EuiHorizontalRule,
+  EuiRadioGroup,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+// @ts-ignore
+import { SingleFieldSelect } from '../../../components/single_field_select';
+
+// @ts-ignore
+import { indexPatternService } from '../../../kibana_services';
+// @ts-ignore
+import { getTermsFields, getSourceFields } from '../../../index_pattern_util';
+// @ts-ignore
+import { ValidatedRange } from '../../../components/validated_range';
+import {
+  DEFAULT_MAX_INNER_RESULT_WINDOW,
+  DEFAULT_MAX_RESULT_WINDOW,
+  SCALING_TYPES,
+  LAYER_TYPE,
+} from '../../../../common/constants';
+// @ts-ignore
+import { loadIndexSettings } from './load_index_settings';
+import { IFieldType } from '../../../../../../../../src/plugins/data/public';
+import { OnSourceChangeArgs } from '../../../connected_components/layer_panel/view';
+
+interface Props {
+  filterByMapBounds: boolean;
+  indexPatternId: string;
+  onChange: (args: OnSourceChangeArgs) => void;
+  scalingType: SCALING_TYPES;
+  supportsClustering: boolean;
+  termFields: IFieldType[];
+  topHitsSplitField?: string;
+  topHitsSize: number;
+}
+
+interface State {
+  maxInnerResultWindow: number;
+  maxResultWindow: number;
+}
+
+export class ScalingForm extends Component<Props, State> {
+  state = {
+    maxInnerResultWindow: DEFAULT_MAX_INNER_RESULT_WINDOW,
+    maxResultWindow: DEFAULT_MAX_RESULT_WINDOW,
+  };
+  _isMounted = false;
+
+  componentDidMount() {
+    this._isMounted = true;
+    this.loadIndexSettings();
+  }
+
+  componentWillUnmount() {
+    this._isMounted = false;
+  }
+
+  async loadIndexSettings() {
+    try {
+      const indexPattern = await indexPatternService.get(this.props.indexPatternId);
+      const { maxInnerResultWindow, maxResultWindow } = await loadIndexSettings(indexPattern.title);
+      if (this._isMounted) {
+        this.setState({ maxInnerResultWindow, maxResultWindow });
+      }
+    } catch (err) {
+      return;
+    }
+  }
+
+  _onScalingTypeChange = (optionId: string): void => {
+    const layerType =
+      optionId === SCALING_TYPES.CLUSTERS ? LAYER_TYPE.BLENDED_VECTOR : LAYER_TYPE.VECTOR;
+    this.props.onChange({ propName: 'scalingType', value: optionId, newLayerType: layerType });
+  };
+
+  _onFilterByMapBoundsChange = (event: EuiSwitchEvent) => {
+    this.props.onChange({ propName: 'filterByMapBounds', value: event.target.checked });
+  };
+
+  _onTopHitsSplitFieldChange = (topHitsSplitField: string) => {
+    this.props.onChange({ propName: 'topHitsSplitField', value: topHitsSplitField });
+  };
+
+  _onTopHitsSizeChange = (size: number) => {
+    this.props.onChange({ propName: 'topHitsSize', value: size });
+  };
+
+  _renderTopHitsForm() {
+    let sizeSlider;
+    if (this.props.topHitsSplitField) {
+      sizeSlider = (
+        <EuiFormRow
+          label={i18n.translate('xpack.maps.source.esSearch.topHitsSizeLabel', {
+            defaultMessage: 'Documents per entity',
+          })}
+          display="columnCompressed"
+        >
+          <ValidatedRange
+            min={1}
+            max={this.state.maxInnerResultWindow}
+            step={1}
+            value={this.props.topHitsSize}
+            onChange={this._onTopHitsSizeChange}
+            showLabels
+            showInput
+            showRange
+            data-test-subj="layerPanelTopHitsSize"
+            compressed
+          />
+        </EuiFormRow>
+      );
+    }
+
+    return (
+      <Fragment>
+        <EuiFormRow
+          label={i18n.translate('xpack.maps.source.esSearch.topHitsSplitFieldLabel', {
+            defaultMessage: 'Entity',
+          })}
+          display="columnCompressed"
+        >
+          <SingleFieldSelect
+            placeholder={i18n.translate(
+              'xpack.maps.source.esSearch.topHitsSplitFieldSelectPlaceholder',
+              {
+                defaultMessage: 'Select entity field',
+              }
+            )}
+            value={this.props.topHitsSplitField}
+            onChange={this._onTopHitsSplitFieldChange}
+            fields={this.props.termFields}
+            compressed
+          />
+        </EuiFormRow>
+
+        {sizeSlider}
+      </Fragment>
+    );
+  }
+
+  render() {
+    const scalingOptions = [
+      {
+        id: SCALING_TYPES.LIMIT,
+        label: i18n.translate('xpack.maps.source.esSearch.limitScalingLabel', {
+          defaultMessage: 'Limit results to {maxResultWindow}.',
+          values: { maxResultWindow: this.state.maxResultWindow },
+        }),
+      },
+      {
+        id: SCALING_TYPES.TOP_HITS,
+        label: i18n.translate('xpack.maps.source.esSearch.useTopHitsLabel', {
+          defaultMessage: 'Show top hits per entity.',
+        }),
+      },
+    ];
+    if (this.props.supportsClustering) {
+      scalingOptions.push({
+        id: SCALING_TYPES.CLUSTERS,
+        label: i18n.translate('xpack.maps.source.esSearch.clusterScalingLabel', {
+          defaultMessage: 'Show clusters when results exceed {maxResultWindow}.',
+          values: { maxResultWindow: this.state.maxResultWindow },
+        }),
+      });
+    }
+
+    let filterByBoundsSwitch;
+    if (this.props.scalingType !== SCALING_TYPES.CLUSTERS) {
+      filterByBoundsSwitch = (
+        <EuiFormRow>
+          <EuiSwitch
+            label={i18n.translate('xpack.maps.source.esSearch.extentFilterLabel', {
+              defaultMessage: 'Dynamically filter for data in the visible map area',
+            })}
+            checked={this.props.filterByMapBounds}
+            onChange={this._onFilterByMapBoundsChange}
+            compressed
+          />
+        </EuiFormRow>
+      );
+    }
+
+    let scalingForm = null;
+    if (this.props.scalingType === SCALING_TYPES.TOP_HITS) {
+      scalingForm = (
+        <Fragment>
+          <EuiHorizontalRule margin="xs" />
+          {this._renderTopHitsForm()}
+        </Fragment>
+      );
+    }
+
+    return (
+      <Fragment>
+        <EuiTitle size="xs">
+          <h5>
+            <FormattedMessage id="xpack.maps.esSearch.scaleTitle" defaultMessage="Scaling" />
+          </h5>
+        </EuiTitle>
+
+        <EuiSpacer size="m" />
+
+        <EuiFormRow>
+          <EuiRadioGroup
+            options={scalingOptions}
+            idSelected={this.props.scalingType}
+            onChange={this._onScalingTypeChange}
+          />
+        </EuiFormRow>
+
+        {filterByBoundsSwitch}
+
+        {scalingForm}
+      </Fragment>
+    );
+  }
+}
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js
index 4d1e32087ab8c..9c92ec5801e49 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.js
@@ -6,34 +6,18 @@
 
 import React, { Fragment, Component } from 'react';
 import PropTypes from 'prop-types';
-import {
-  EuiFormRow,
-  EuiSwitch,
-  EuiSelect,
-  EuiTitle,
-  EuiPanel,
-  EuiSpacer,
-  EuiHorizontalRule,
-  EuiRadioGroup,
-} from '@elastic/eui';
+import { EuiFormRow, EuiSelect, EuiTitle, EuiPanel, EuiSpacer } from '@elastic/eui';
 import { SingleFieldSelect } from '../../../components/single_field_select';
 import { TooltipSelector } from '../../../components/tooltip_selector';
 
 import { getIndexPatternService } from '../../../kibana_services';
 import { i18n } from '@kbn/i18n';
 import { getTermsFields, getSourceFields } from '../../../index_pattern_util';
-import { ValidatedRange } from '../../../components/validated_range';
-import {
-  DEFAULT_MAX_INNER_RESULT_WINDOW,
-  DEFAULT_MAX_RESULT_WINDOW,
-  SORT_ORDER,
-  SCALING_TYPES,
-  LAYER_TYPE,
-} from '../../../../common/constants';
+import { SORT_ORDER } from '../../../../common/constants';
 import { ESDocField } from '../../fields/es_doc_field';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { loadIndexSettings } from './load_index_settings';
 import { indexPatterns } from '../../../../../../../../src/plugins/data/public';
+import { ScalingForm } from './scaling_form';
 
 export class UpdateSourceEditor extends Component {
   static propTypes = {
@@ -52,33 +36,18 @@ export class UpdateSourceEditor extends Component {
     sourceFields: null,
     termFields: null,
     sortFields: null,
-    maxInnerResultWindow: DEFAULT_MAX_INNER_RESULT_WINDOW,
-    maxResultWindow: DEFAULT_MAX_RESULT_WINDOW,
     supportsClustering: false,
   };
 
   componentDidMount() {
     this._isMounted = true;
     this.loadFields();
-    this.loadIndexSettings();
   }
 
   componentWillUnmount() {
     this._isMounted = false;
   }
 
-  async loadIndexSettings() {
-    try {
-      const indexPattern = await getIndexPatternService().get(this.props.indexPatternId);
-      const { maxInnerResultWindow, maxResultWindow } = await loadIndexSettings(indexPattern.title);
-      if (this._isMounted) {
-        this.setState({ maxInnerResultWindow, maxResultWindow });
-      }
-    } catch (err) {
-      return;
-    }
-  }
-
   async loadFields() {
     let indexPattern;
     try {
@@ -133,85 +102,14 @@ export class UpdateSourceEditor extends Component {
     this.props.onChange({ propName: 'tooltipProperties', value: propertyNames });
   };
 
-  _onScalingTypeChange = optionId => {
-    const layerType =
-      optionId === SCALING_TYPES.CLUSTERS ? LAYER_TYPE.BLENDED_VECTOR : LAYER_TYPE.VECTOR;
-    this.props.onChange({ propName: 'scalingType', value: optionId, newLayerType: layerType });
-  };
-
-  _onFilterByMapBoundsChange = event => {
-    this.props.onChange({ propName: 'filterByMapBounds', value: event.target.checked });
-  };
-
-  onTopHitsSplitFieldChange = topHitsSplitField => {
-    this.props.onChange({ propName: 'topHitsSplitField', value: topHitsSplitField });
-  };
-
-  onSortFieldChange = sortField => {
+  _onSortFieldChange = sortField => {
     this.props.onChange({ propName: 'sortField', value: sortField });
   };
 
-  onSortOrderChange = e => {
+  _onSortOrderChange = e => {
     this.props.onChange({ propName: 'sortOrder', value: e.target.value });
   };
 
-  onTopHitsSizeChange = size => {
-    this.props.onChange({ propName: 'topHitsSize', value: size });
-  };
-
-  _renderTopHitsForm() {
-    let sizeSlider;
-    if (this.props.topHitsSplitField) {
-      sizeSlider = (
-        <EuiFormRow
-          label={i18n.translate('xpack.maps.source.esSearch.topHitsSizeLabel', {
-            defaultMessage: 'Documents per entity',
-          })}
-          display="columnCompressed"
-        >
-          <ValidatedRange
-            min={1}
-            max={this.state.maxInnerResultWindow}
-            step={1}
-            value={this.props.topHitsSize}
-            onChange={this.onTopHitsSizeChange}
-            showLabels
-            showInput
-            showRange
-            data-test-subj="layerPanelTopHitsSize"
-            compressed
-          />
-        </EuiFormRow>
-      );
-    }
-
-    return (
-      <Fragment>
-        <EuiFormRow
-          label={i18n.translate('xpack.maps.source.esSearch.topHitsSplitFieldLabel', {
-            defaultMessage: 'Entity',
-          })}
-          display="columnCompressed"
-        >
-          <SingleFieldSelect
-            placeholder={i18n.translate(
-              'xpack.maps.source.esSearch.topHitsSplitFieldSelectPlaceholder',
-              {
-                defaultMessage: 'Select entity field',
-              }
-            )}
-            value={this.props.topHitsSplitField}
-            onChange={this.onTopHitsSplitFieldChange}
-            fields={this.state.termFields}
-            compressed
-          />
-        </EuiFormRow>
-
-        {sizeSlider}
-      </Fragment>
-    );
-  }
-
   _renderTooltipsPanel() {
     return (
       <EuiPanel>
@@ -257,7 +155,7 @@ export class UpdateSourceEditor extends Component {
               defaultMessage: 'Select sort field',
             })}
             value={this.props.sortField}
-            onChange={this.onSortFieldChange}
+            onChange={this._onSortFieldChange}
             fields={this.state.sortFields}
             compressed
           />
@@ -286,7 +184,7 @@ export class UpdateSourceEditor extends Component {
               },
             ]}
             value={this.props.sortOrder}
-            onChange={this.onSortOrderChange}
+            onChange={this._onSortOrderChange}
             compressed
           />
         </EuiFormRow>
@@ -295,78 +193,18 @@ export class UpdateSourceEditor extends Component {
   }
 
   _renderScalingPanel() {
-    const scalingOptions = [
-      {
-        id: SCALING_TYPES.LIMIT,
-        label: i18n.translate('xpack.maps.source.esSearch.limitScalingLabel', {
-          defaultMessage: 'Limit results to {maxResultWindow}.',
-          values: { maxResultWindow: this.state.maxResultWindow },
-        }),
-      },
-      {
-        id: SCALING_TYPES.TOP_HITS,
-        label: i18n.translate('xpack.maps.source.esSearch.useTopHitsLabel', {
-          defaultMessage: 'Show top hits per entity.',
-        }),
-      },
-    ];
-    if (this.state.supportsClustering) {
-      scalingOptions.push({
-        id: SCALING_TYPES.CLUSTERS,
-        label: i18n.translate('xpack.maps.source.esSearch.clusterScalingLabel', {
-          defaultMessage: 'Show clusters when results exceed {maxResultWindow}.',
-          values: { maxResultWindow: this.state.maxResultWindow },
-        }),
-      });
-    }
-
-    let filterByBoundsSwitch;
-    if (this.props.scalingType !== SCALING_TYPES.CLUSTERS) {
-      filterByBoundsSwitch = (
-        <EuiFormRow>
-          <EuiSwitch
-            label={i18n.translate('xpack.maps.source.esSearch.extentFilterLabel', {
-              defaultMessage: 'Dynamically filter for data in the visible map area',
-            })}
-            checked={this.props.filterByMapBounds}
-            onChange={this._onFilterByMapBoundsChange}
-            compressed
-          />
-        </EuiFormRow>
-      );
-    }
-
-    let scalingForm = null;
-    if (this.props.scalingType === SCALING_TYPES.TOP_HITS) {
-      scalingForm = (
-        <Fragment>
-          <EuiHorizontalRule margin="xs" />
-          {this._renderTopHitsForm()}
-        </Fragment>
-      );
-    }
-
     return (
       <EuiPanel>
-        <EuiTitle size="xs">
-          <h5>
-            <FormattedMessage id="xpack.maps.esSearch.scaleTitle" defaultMessage="Scaling" />
-          </h5>
-        </EuiTitle>
-
-        <EuiSpacer size="m" />
-
-        <EuiFormRow>
-          <EuiRadioGroup
-            options={scalingOptions}
-            idSelected={this.props.scalingType}
-            onChange={this._onScalingTypeChange}
-          />
-        </EuiFormRow>
-
-        {filterByBoundsSwitch}
-
-        {scalingForm}
+        <ScalingForm
+          filterByMapBounds={this.props.filterByMapBounds}
+          indexPatternId={this.props.indexPatternId}
+          onChange={this.props.onChange}
+          scalingType={this.props.scalingType}
+          supportsClustering={this.state.supportsClustering}
+          termFields={this.state.termFields}
+          topHitsSplitField={this.props.topHitsSplitField}
+          topHitsSize={this.props.topHitsSize}
+        />
       </EuiPanel>
     );
   }
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.test.js b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.test.js
index e8a845c4b1669..65a91ce03994a 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.test.js
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_search_source/update_source_editor.test.js
@@ -40,11 +40,3 @@ test('should enable sort order select when sort field provided', async () => {
 
   expect(component).toMatchSnapshot();
 });
-
-test('should render top hits form when scaling type is TOP_HITS', async () => {
-  const component = shallow(
-    <UpdateSourceEditor {...defaultProps} scalingType={SCALING_TYPES.TOP_HITS} />
-  );
-
-  expect(component).toMatchSnapshot();
-});
diff --git a/x-pack/legacy/plugins/maps/public/layers/sources/es_source.js b/x-pack/legacy/plugins/maps/public/layers/sources/es_source.js
index 8b079b5202f7f..9dc3067a70436 100644
--- a/x-pack/legacy/plugins/maps/public/layers/sources/es_source.js
+++ b/x-pack/legacy/plugins/maps/public/layers/sources/es_source.js
@@ -231,7 +231,7 @@ export class AbstractESSource extends AbstractVectorSource {
     }
   }
 
-  _getGeoField = async () => {
+  async _getGeoField() {
     const indexPattern = await this.getIndexPattern();
     const geoField = indexPattern.fields.getByName(this._descriptor.geoField);
     if (!geoField) {
@@ -243,7 +243,7 @@ export class AbstractESSource extends AbstractVectorSource {
       );
     }
     return geoField;
-  };
+  }
 
   async getDisplayName() {
     try {
diff --git a/x-pack/legacy/plugins/maps/server/plugin.js b/x-pack/legacy/plugins/maps/server/plugin.js
index 02e38ff54b300..5b52a3eba2f23 100644
--- a/x-pack/legacy/plugins/maps/server/plugin.js
+++ b/x-pack/legacy/plugins/maps/server/plugin.js
@@ -23,12 +23,15 @@ export class MapPlugin {
       name: i18n.translate('xpack.maps.featureRegistry.mapsFeatureName', {
         defaultMessage: 'Maps',
       }),
+      order: 600,
       icon: APP_ICON,
       navLinkId: APP_ID,
       app: [APP_ID, 'kibana'],
       catalogue: [APP_ID],
       privileges: {
         all: {
+          app: [APP_ID, 'kibana'],
+          catalogue: [APP_ID],
           savedObject: {
             all: [MAP_SAVED_OBJECT_TYPE, 'query'],
             read: ['index-pattern'],
@@ -36,6 +39,8 @@ export class MapPlugin {
           ui: ['save', 'show', 'saveQuery'],
         },
         read: {
+          app: [APP_ID, 'kibana'],
+          catalogue: [APP_ID],
           savedObject: {
             all: [],
             read: [MAP_SAVED_OBJECT_TYPE, 'index-pattern', 'query'],
diff --git a/x-pack/legacy/plugins/maps/server/routes.js b/x-pack/legacy/plugins/maps/server/routes.js
index 7ca659148449f..6aacfdc41aeea 100644
--- a/x-pack/legacy/plugins/maps/server/routes.js
+++ b/x-pack/legacy/plugins/maps/server/routes.js
@@ -409,26 +409,6 @@ export function initRoutes(server, licenseUid) {
     },
   });
 
-  server.route({
-    method: 'GET',
-    path: `${ROOT}/indexCount`,
-    handler: async (request, h) => {
-      const { server, query } = request;
-
-      if (!query.index) {
-        return h.response().code(400);
-      }
-
-      const { callWithRequest } = server.plugins.elasticsearch.getCluster('data');
-      try {
-        const { count } = await callWithRequest(request, 'count', { index: query.index });
-        return { count };
-      } catch (error) {
-        return h.response().code(400);
-      }
-    },
-  });
-
   server.route({
     method: 'GET',
     path: `/${INDEX_SETTINGS_API_PATH}`,
diff --git a/x-pack/legacy/plugins/monitoring/index.js b/x-pack/legacy/plugins/monitoring/index.js
index fcf704b5f65d3..ccb45dc1f446f 100644
--- a/x-pack/legacy/plugins/monitoring/index.js
+++ b/x-pack/legacy/plugins/monitoring/index.js
@@ -9,7 +9,6 @@ import { resolve } from 'path';
 import { config } from './config';
 import { getUiExports } from './ui_exports';
 import { KIBANA_ALERTING_ENABLED } from './common/constants';
-import { telemetryCollectionManager } from '../../../../src/legacy/core_plugins/telemetry/server';
 
 /**
  * Invokes plugin modules to instantiate the Monitoring plugin for Kibana
@@ -32,7 +31,6 @@ export const monitoring = kibana => {
       if (npMonitoring) {
         const kbnServerStatus = this.kbnServer.status;
         npMonitoring.registerLegacyAPI({
-          telemetryCollectionManager,
           getServerStatus: () => {
             const status = kbnServerStatus.toJSON();
             return get(status, 'overall.state');
diff --git a/x-pack/legacy/plugins/security/index.ts b/x-pack/legacy/plugins/security/index.ts
index deebbccf5aa49..5b2218af1fd52 100644
--- a/x-pack/legacy/plugins/security/index.ts
+++ b/x-pack/legacy/plugins/security/index.ts
@@ -51,10 +51,7 @@ export const security = (kibana: Record<string, any>) =>
     uiExports: {
       hacks: ['plugins/security/hacks/legacy'],
       injectDefaultVars: (server: Server) => {
-        return {
-          secureCookies: getSecurityPluginSetup(server).__legacyCompat.config.secureCookies,
-          enableSpaceAwarePrivileges: server.config().get('xpack.spaces.enabled'),
-        };
+        return { enableSpaceAwarePrivileges: server.config().get('xpack.spaces.enabled') };
       },
     },
 
diff --git a/x-pack/legacy/plugins/siem/common/constants.ts b/x-pack/legacy/plugins/siem/common/constants.ts
index c3fc4aea77863..ec720164e9bd7 100644
--- a/x-pack/legacy/plugins/siem/common/constants.ts
+++ b/x-pack/legacy/plugins/siem/common/constants.ts
@@ -52,12 +52,18 @@ export const IP_REPUTATION_LINKS_SETTING_DEFAULT = `[
  */
 export const SIGNALS_ID = `${APP_ID}.signals`;
 
+/**
+ * Id for the notifications alerting type
+ */
+export const NOTIFICATIONS_ID = `${APP_ID}.notifications`;
+
 /**
  * Special internal structure for tags for signals. This is used
  * to filter out tags that have internal structures within them.
  */
 export const INTERNAL_IDENTIFIER = '__internal';
 export const INTERNAL_RULE_ID_KEY = `${INTERNAL_IDENTIFIER}_rule_id`;
+export const INTERNAL_RULE_ALERT_ID_KEY = `${INTERNAL_IDENTIFIER}_rule_alert_id`;
 export const INTERNAL_IMMUTABLE_KEY = `${INTERNAL_IDENTIFIER}_immutable`;
 
 /**
@@ -87,3 +93,5 @@ export const DETECTION_ENGINE_QUERY_SIGNALS_URL = `${DETECTION_ENGINE_SIGNALS_UR
  * Common naming convention for an unauthenticated user
  */
 export const UNAUTHENTICATED_USER = 'Unauthenticated';
+
+export const NOTIFICATION_THROTTLE_RULE = 'rule';
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/transform_actions.test.ts b/x-pack/legacy/plugins/siem/common/detection_engine/transform_actions.test.ts
similarity index 100%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/transform_actions.test.ts
rename to x-pack/legacy/plugins/siem/common/detection_engine/transform_actions.test.ts
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/transform_actions.ts b/x-pack/legacy/plugins/siem/common/detection_engine/transform_actions.ts
similarity index 83%
rename from x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/transform_actions.ts
rename to x-pack/legacy/plugins/siem/common/detection_engine/transform_actions.ts
index c1c17d2c70836..aeb4d53933022 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/transform_actions.ts
+++ b/x-pack/legacy/plugins/siem/common/detection_engine/transform_actions.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AlertAction } from '../../../../../../../plugins/alerting/common';
-import { RuleAlertAction } from '../types';
+import { AlertAction } from '../../../../../plugins/alerting/common';
+import { RuleAlertAction } from './types';
 
 export const transformRuleToAlertAction = ({
   group,
diff --git a/x-pack/legacy/plugins/siem/common/detection_engine/types.ts b/x-pack/legacy/plugins/siem/common/detection_engine/types.ts
new file mode 100644
index 0000000000000..0de370b11cdaf
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/common/detection_engine/types.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AlertAction } from '../../../../../plugins/alerting/common';
+
+export type RuleAlertAction = Omit<AlertAction, 'actionTypeId'> & {
+  action_type_id: string;
+};
diff --git a/x-pack/legacy/plugins/siem/cypress/integration/detections.spec.ts b/x-pack/legacy/plugins/siem/cypress/integration/detections.spec.ts
index de17f40a3ac71..646132c3f88eb 100644
--- a/x-pack/legacy/plugins/siem/cypress/integration/detections.spec.ts
+++ b/x-pack/legacy/plugins/siem/cypress/integration/detections.spec.ts
@@ -16,6 +16,7 @@ import {
   closeSignals,
   goToClosedSignals,
   goToOpenedSignals,
+  openFirstSignal,
   openSignals,
   selectNumberOfSignals,
   waitForSignalsPanelToBeLoaded,
@@ -28,129 +29,181 @@ import { loginAndWaitForPage } from '../tasks/login';
 import { DETECTIONS } from '../urls/navigation';
 
 describe('Detections', () => {
-  beforeEach(() => {
-    esArchiverLoad('signals');
-    loginAndWaitForPage(DETECTIONS);
+  context('Closing signals', () => {
+    beforeEach(() => {
+      esArchiverLoad('signals');
+      loginAndWaitForPage(DETECTIONS);
+    });
+
+    it('Closes and opens signals', () => {
+      waitForSignalsPanelToBeLoaded();
+      waitForSignalsToBeLoaded();
+
+      cy.get(NUMBER_OF_SIGNALS)
+        .invoke('text')
+        .then(numberOfSignals => {
+          cy.get(SHOWING_SIGNALS)
+            .invoke('text')
+            .should('eql', `Showing ${numberOfSignals} signals`);
+
+          const numberOfSignalsToBeClosed = 3;
+          selectNumberOfSignals(numberOfSignalsToBeClosed);
+
+          cy.get(SELECTED_SIGNALS)
+            .invoke('text')
+            .should('eql', `Selected ${numberOfSignalsToBeClosed} signals`);
+
+          closeSignals();
+          waitForSignals();
+          cy.reload();
+          waitForSignals();
+
+          const expectedNumberOfSignalsAfterClosing = +numberOfSignals - numberOfSignalsToBeClosed;
+          cy.get(NUMBER_OF_SIGNALS)
+            .invoke('text')
+            .should('eq', expectedNumberOfSignalsAfterClosing.toString());
+          cy.get(SHOWING_SIGNALS)
+            .invoke('text')
+            .should('eql', `Showing ${expectedNumberOfSignalsAfterClosing.toString()} signals`);
+
+          goToClosedSignals();
+          waitForSignals();
+
+          cy.get(NUMBER_OF_SIGNALS)
+            .invoke('text')
+            .should('eql', numberOfSignalsToBeClosed.toString());
+          cy.get(SHOWING_SIGNALS)
+            .invoke('text')
+            .should('eql', `Showing ${numberOfSignalsToBeClosed.toString()} signals`);
+          cy.get(SIGNALS).should('have.length', numberOfSignalsToBeClosed);
+
+          const numberOfSignalsToBeOpened = 1;
+          selectNumberOfSignals(numberOfSignalsToBeOpened);
+
+          cy.get(SELECTED_SIGNALS)
+            .invoke('text')
+            .should('eql', `Selected ${numberOfSignalsToBeOpened} signal`);
+
+          openSignals();
+          waitForSignals();
+          cy.reload();
+          waitForSignalsToBeLoaded();
+          waitForSignals();
+          goToClosedSignals();
+          waitForSignals();
+
+          const expectedNumberOfClosedSignalsAfterOpened = 2;
+          cy.get(NUMBER_OF_SIGNALS)
+            .invoke('text')
+            .should('eql', expectedNumberOfClosedSignalsAfterOpened.toString());
+          cy.get(SHOWING_SIGNALS)
+            .invoke('text')
+            .should(
+              'eql',
+              `Showing ${expectedNumberOfClosedSignalsAfterOpened.toString()} signals`
+            );
+          cy.get(SIGNALS).should('have.length', expectedNumberOfClosedSignalsAfterOpened);
+
+          goToOpenedSignals();
+          waitForSignals();
+
+          const expectedNumberOfOpenedSignals =
+            +numberOfSignals - expectedNumberOfClosedSignalsAfterOpened;
+          cy.get(SHOWING_SIGNALS)
+            .invoke('text')
+            .should('eql', `Showing ${expectedNumberOfOpenedSignals.toString()} signals`);
+
+          cy.get('[data-test-subj="server-side-event-count"]')
+            .invoke('text')
+            .should('eql', expectedNumberOfOpenedSignals.toString());
+        });
+    });
+
+    it('Closes one signal when more than one opened signals are selected', () => {
+      waitForSignalsToBeLoaded();
+
+      cy.get(NUMBER_OF_SIGNALS)
+        .invoke('text')
+        .then(numberOfSignals => {
+          const numberOfSignalsToBeClosed = 1;
+          const numberOfSignalsToBeSelected = 3;
+
+          cy.get(OPEN_CLOSE_SIGNALS_BTN).should('have.attr', 'disabled');
+          selectNumberOfSignals(numberOfSignalsToBeSelected);
+          cy.get(OPEN_CLOSE_SIGNALS_BTN).should('not.have.attr', 'disabled');
+
+          closeFirstSignal();
+          cy.reload();
+          waitForSignalsToBeLoaded();
+          waitForSignals();
+
+          const expectedNumberOfSignals = +numberOfSignals - numberOfSignalsToBeClosed;
+          cy.get(NUMBER_OF_SIGNALS)
+            .invoke('text')
+            .should('eq', expectedNumberOfSignals.toString());
+          cy.get(SHOWING_SIGNALS)
+            .invoke('text')
+            .should('eql', `Showing ${expectedNumberOfSignals.toString()} signals`);
+
+          goToClosedSignals();
+          waitForSignals();
+
+          cy.get(NUMBER_OF_SIGNALS)
+            .invoke('text')
+            .should('eql', numberOfSignalsToBeClosed.toString());
+          cy.get(SHOWING_SIGNALS)
+            .invoke('text')
+            .should('eql', `Showing ${numberOfSignalsToBeClosed.toString()} signal`);
+          cy.get(SIGNALS).should('have.length', numberOfSignalsToBeClosed);
+        });
+    });
   });
-
-  it('Closes and opens signals', () => {
-    waitForSignalsPanelToBeLoaded();
-    waitForSignalsToBeLoaded();
-
-    cy.get(NUMBER_OF_SIGNALS)
-      .invoke('text')
-      .then(numberOfSignals => {
-        cy.get(SHOWING_SIGNALS)
-          .invoke('text')
-          .should('eql', `Showing ${numberOfSignals} signals`);
-
-        const numberOfSignalsToBeClosed = 3;
-        selectNumberOfSignals(numberOfSignalsToBeClosed);
-
-        cy.get(SELECTED_SIGNALS)
-          .invoke('text')
-          .should('eql', `Selected ${numberOfSignalsToBeClosed} signals`);
-
-        closeSignals();
-        waitForSignals();
-        cy.reload();
-        waitForSignals();
-        waitForSignalsToBeLoaded();
-
-        const expectedNumberOfSignalsAfterClosing = +numberOfSignals - numberOfSignalsToBeClosed;
-        cy.get(NUMBER_OF_SIGNALS)
-          .invoke('text')
-          .should('eq', expectedNumberOfSignalsAfterClosing.toString());
-        cy.get(SHOWING_SIGNALS)
-          .invoke('text')
-          .should('eql', `Showing ${expectedNumberOfSignalsAfterClosing.toString()} signals`);
-
-        goToClosedSignals();
-        waitForSignals();
-
-        cy.get(NUMBER_OF_SIGNALS)
-          .invoke('text')
-          .should('eql', numberOfSignalsToBeClosed.toString());
-        cy.get(SHOWING_SIGNALS)
-          .invoke('text')
-          .should('eql', `Showing ${numberOfSignalsToBeClosed.toString()} signals`);
-        cy.get(SIGNALS).should('have.length', numberOfSignalsToBeClosed);
-
-        const numberOfSignalsToBeOpened = 1;
-        selectNumberOfSignals(numberOfSignalsToBeOpened);
-
-        cy.get(SELECTED_SIGNALS)
-          .invoke('text')
-          .should('eql', `Selected ${numberOfSignalsToBeOpened} signal`);
-
-        openSignals();
-        waitForSignals();
-        cy.reload();
-        waitForSignalsToBeLoaded();
-        waitForSignals();
-        goToClosedSignals();
-        waitForSignals();
-
-        const expectedNumberOfClosedSignalsAfterOpened = 2;
-        cy.get(NUMBER_OF_SIGNALS)
-          .invoke('text')
-          .should('eql', expectedNumberOfClosedSignalsAfterOpened.toString());
-        cy.get(SHOWING_SIGNALS)
-          .invoke('text')
-          .should('eql', `Showing ${expectedNumberOfClosedSignalsAfterOpened.toString()} signals`);
-        cy.get(SIGNALS).should('have.length', expectedNumberOfClosedSignalsAfterOpened);
-
-        goToOpenedSignals();
-        waitForSignals();
-
-        const expectedNumberOfOpenedSignals =
-          +numberOfSignals - expectedNumberOfClosedSignalsAfterOpened;
-        cy.get(SHOWING_SIGNALS)
-          .invoke('text')
-          .should('eql', `Showing ${expectedNumberOfOpenedSignals.toString()} signals`);
-
-        cy.get('[data-test-subj="server-side-event-count"]')
-          .invoke('text')
-          .should('eql', expectedNumberOfOpenedSignals.toString());
-      });
-  });
-
-  it('Closes one signal when more than one opened signals are selected', () => {
-    waitForSignalsToBeLoaded();
-
-    cy.get(NUMBER_OF_SIGNALS)
-      .invoke('text')
-      .then(numberOfSignals => {
-        const numberOfSignalsToBeClosed = 1;
-        const numberOfSignalsToBeSelected = 3;
-
-        cy.get(OPEN_CLOSE_SIGNALS_BTN).should('have.attr', 'disabled');
-        selectNumberOfSignals(numberOfSignalsToBeSelected);
-        cy.get(OPEN_CLOSE_SIGNALS_BTN).should('not.have.attr', 'disabled');
-
-        closeFirstSignal();
-        cy.reload();
-        waitForSignalsToBeLoaded();
-        waitForSignals();
-
-        const expectedNumberOfSignals = +numberOfSignals - numberOfSignalsToBeClosed;
-        cy.get(NUMBER_OF_SIGNALS)
-          .invoke('text')
-          .should('eq', expectedNumberOfSignals.toString());
-        cy.get(SHOWING_SIGNALS)
-          .invoke('text')
-          .should('eql', `Showing ${expectedNumberOfSignals.toString()} signals`);
-
-        goToClosedSignals();
-        waitForSignals();
-
-        cy.get(NUMBER_OF_SIGNALS)
-          .invoke('text')
-          .should('eql', numberOfSignalsToBeClosed.toString());
-        cy.get(SHOWING_SIGNALS)
-          .invoke('text')
-          .should('eql', `Showing ${numberOfSignalsToBeClosed.toString()} signal`);
-        cy.get(SIGNALS).should('have.length', numberOfSignalsToBeClosed);
-      });
+  context('Opening signals', () => {
+    beforeEach(() => {
+      esArchiverLoad('closed_signals');
+      loginAndWaitForPage(DETECTIONS);
+    });
+
+    it('Open one signal when more than one closed signals are selected', () => {
+      waitForSignals();
+      goToClosedSignals();
+      waitForSignalsToBeLoaded();
+
+      cy.get(NUMBER_OF_SIGNALS)
+        .invoke('text')
+        .then(numberOfSignals => {
+          const numberOfSignalsToBeOpened = 1;
+          const numberOfSignalsToBeSelected = 3;
+
+          cy.get(OPEN_CLOSE_SIGNALS_BTN).should('have.attr', 'disabled');
+          selectNumberOfSignals(numberOfSignalsToBeSelected);
+          cy.get(OPEN_CLOSE_SIGNALS_BTN).should('not.have.attr', 'disabled');
+
+          openFirstSignal();
+          cy.reload();
+          goToClosedSignals();
+          waitForSignalsToBeLoaded();
+          waitForSignals();
+
+          const expectedNumberOfSignals = +numberOfSignals - numberOfSignalsToBeOpened;
+          cy.get(NUMBER_OF_SIGNALS)
+            .invoke('text')
+            .should('eq', expectedNumberOfSignals.toString());
+          cy.get(SHOWING_SIGNALS)
+            .invoke('text')
+            .should('eql', `Showing ${expectedNumberOfSignals.toString()} signals`);
+
+          goToOpenedSignals();
+          waitForSignals();
+
+          cy.get(NUMBER_OF_SIGNALS)
+            .invoke('text')
+            .should('eql', numberOfSignalsToBeOpened.toString());
+          cy.get(SHOWING_SIGNALS)
+            .invoke('text')
+            .should('eql', `Showing ${numberOfSignalsToBeOpened.toString()} signal`);
+          cy.get(SIGNALS).should('have.length', numberOfSignalsToBeOpened);
+        });
+    });
   });
 });
diff --git a/x-pack/legacy/plugins/siem/cypress/integration/signal_detection_rules.spec.ts b/x-pack/legacy/plugins/siem/cypress/integration/signal_detection_rules.spec.ts
index ce73fe1b7c2a5..70e4fb052e172 100644
--- a/x-pack/legacy/plugins/siem/cypress/integration/signal_detection_rules.spec.ts
+++ b/x-pack/legacy/plugins/siem/cypress/integration/signal_detection_rules.spec.ts
@@ -13,10 +13,10 @@ import {
   ABOUT_SEVERITY,
   ABOUT_STEP,
   ABOUT_TAGS,
-  ABOUT_TIMELINE,
   ABOUT_URLS,
   DEFINITION_CUSTOM_QUERY,
   DEFINITION_INDEX_PATTERNS,
+  DEFINITION_TIMELINE,
   DEFINITION_STEP,
   RULE_NAME_HEADER,
   SCHEDULE_LOOPBACK,
@@ -170,10 +170,6 @@ describe('Signal detection rules', () => {
       .eq(ABOUT_RISK)
       .invoke('text')
       .should('eql', newRule.riskScore);
-    cy.get(ABOUT_STEP)
-      .eq(ABOUT_TIMELINE)
-      .invoke('text')
-      .should('eql', 'Default blank timeline');
     cy.get(ABOUT_STEP)
       .eq(ABOUT_URLS)
       .invoke('text')
@@ -202,6 +198,10 @@ describe('Signal detection rules', () => {
       .eq(DEFINITION_CUSTOM_QUERY)
       .invoke('text')
       .should('eql', `${newRule.customQuery} `);
+    cy.get(DEFINITION_STEP)
+      .eq(DEFINITION_TIMELINE)
+      .invoke('text')
+      .should('eql', 'Default blank timeline');
 
     cy.get(SCHEDULE_STEP)
       .eq(SCHEDULE_RUNS)
diff --git a/x-pack/legacy/plugins/siem/cypress/screens/rule_details.ts b/x-pack/legacy/plugins/siem/cypress/screens/rule_details.ts
index 6c16735ba5f24..06e535b37708c 100644
--- a/x-pack/legacy/plugins/siem/cypress/screens/rule_details.ts
+++ b/x-pack/legacy/plugins/siem/cypress/screens/rule_details.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export const ABOUT_FALSE_POSITIVES = 4;
+export const ABOUT_FALSE_POSITIVES = 3;
 
-export const ABOUT_MITRE = 5;
+export const ABOUT_MITRE = 4;
 
 export const ABOUT_RULE_DESCRIPTION = '[data-test-subj=stepAboutRuleDetailsToggleDescriptionText]';
 
@@ -16,14 +16,14 @@ export const ABOUT_SEVERITY = 0;
 
 export const ABOUT_STEP = '[data-test-subj="aboutRule"] .euiDescriptionList__description';
 
-export const ABOUT_TAGS = 6;
+export const ABOUT_TAGS = 5;
 
-export const ABOUT_TIMELINE = 2;
-
-export const ABOUT_URLS = 3;
+export const ABOUT_URLS = 2;
 
 export const DEFINITION_CUSTOM_QUERY = 1;
 
+export const DEFINITION_TIMELINE = 3;
+
 export const DEFINITION_INDEX_PATTERNS =
   '[data-test-subj=definitionRule] [data-test-subj="listItemColumnStepRuleDescription"] .euiDescriptionList__description .euiBadge__text';
 
diff --git a/x-pack/legacy/plugins/siem/cypress/tasks/detections.ts b/x-pack/legacy/plugins/siem/cypress/tasks/detections.ts
index 3416e3eb81de3..abea4a887b8ba 100644
--- a/x-pack/legacy/plugins/siem/cypress/tasks/detections.ts
+++ b/x-pack/legacy/plugins/siem/cypress/tasks/detections.ts
@@ -40,6 +40,12 @@ export const goToOpenedSignals = () => {
   cy.get(OPENED_SIGNALS_BTN).click({ force: true });
 };
 
+export const openFirstSignal = () => {
+  cy.get(OPEN_CLOSE_SIGNAL_BTN)
+    .first()
+    .click({ force: true });
+};
+
 export const openSignals = () => {
   cy.get(OPEN_CLOSE_SIGNALS_BTN).click({ force: true });
 };
diff --git a/x-pack/legacy/plugins/siem/public/components/link_to/redirect_to_case.tsx b/x-pack/legacy/plugins/siem/public/components/link_to/redirect_to_case.tsx
index 3056b166c1153..6ec15b55ba83d 100644
--- a/x-pack/legacy/plugins/siem/public/components/link_to/redirect_to_case.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/link_to/redirect_to_case.tsx
@@ -6,6 +6,7 @@
 
 import React from 'react';
 import { RouteComponentProps } from 'react-router-dom';
+import { appendSearch } from './helpers';
 import { RedirectWrapper } from './redirect_wrapper';
 import { SiemPageName } from '../../pages/home/types';
 
@@ -30,7 +31,14 @@ export const RedirectToConfigureCasesPage = () => (
 
 const baseCaseUrl = `#/link-to/${SiemPageName.case}`;
 
-export const getCaseUrl = () => baseCaseUrl;
-export const getCaseDetailsUrl = (detailName: string) => `${baseCaseUrl}/${detailName}`;
-export const getCreateCaseUrl = () => `${baseCaseUrl}/create`;
-export const getConfigureCasesUrl = () => `${baseCaseUrl}/configure`;
+export const getCaseUrl = (search: string | null) =>
+  `${baseCaseUrl}${appendSearch(search ?? undefined)}`;
+
+export const getCaseDetailsUrl = ({ id, search }: { id: string; search: string | null }) =>
+  `${baseCaseUrl}/${encodeURIComponent(id)}${appendSearch(search ?? undefined)}`;
+
+export const getCreateCaseUrl = (search: string | null) =>
+  `${baseCaseUrl}/create${appendSearch(search ?? undefined)}`;
+
+export const getConfigureCasesUrl = (search: string) =>
+  `${baseCaseUrl}/configure${appendSearch(search ?? undefined)}`;
diff --git a/x-pack/legacy/plugins/siem/public/components/links/index.tsx b/x-pack/legacy/plugins/siem/public/components/links/index.tsx
index 04de0b1d5d3bf..14dc5e7999a65 100644
--- a/x-pack/legacy/plugins/siem/public/components/links/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/links/index.tsx
@@ -26,6 +26,8 @@ import { IP_REPUTATION_LINKS_SETTING } from '../../../common/constants';
 import * as i18n from '../page/network/ip_overview/translations';
 import { isUrlInvalid } from '../../pages/detection_engine/rules/components/step_about_rule/helpers';
 import { ExternalLinkIcon } from '../external_link_icon';
+import { navTabs } from '../../pages/home/home_navigations';
+import { useGetUrlSearch } from '../navigation/use_get_url_search';
 
 export const DEFAULT_NUMBER_OF_LINK = 5;
 
@@ -89,20 +91,25 @@ export const IPDetailsLink = React.memo(IPDetailsLinkComponent);
 const CaseDetailsLinkComponent: React.FC<{ children?: React.ReactNode; detailName: string }> = ({
   children,
   detailName,
-}) => (
-  <EuiLink
-    href={getCaseDetailsUrl(encodeURIComponent(detailName))}
-    data-test-subj="case-details-link"
-  >
-    {children ? children : detailName}
-  </EuiLink>
-);
+}) => {
+  const search = useGetUrlSearch(navTabs.case);
+
+  return (
+    <EuiLink
+      href={getCaseDetailsUrl({ id: detailName, search })}
+      data-test-subj="case-details-link"
+    >
+      {children ? children : detailName}
+    </EuiLink>
+  );
+};
 export const CaseDetailsLink = React.memo(CaseDetailsLinkComponent);
 CaseDetailsLink.displayName = 'CaseDetailsLink';
 
-export const CreateCaseLink = React.memo<{ children: React.ReactNode }>(({ children }) => (
-  <EuiLink href={getCreateCaseUrl()}>{children}</EuiLink>
-));
+export const CreateCaseLink = React.memo<{ children: React.ReactNode }>(({ children }) => {
+  const search = useGetUrlSearch(navTabs.case);
+  return <EuiLink href={getCreateCaseUrl(search)}>{children}</EuiLink>;
+});
 
 CreateCaseLink.displayName = 'CreateCaseLink';
 
diff --git a/x-pack/legacy/plugins/siem/public/components/markdown/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/markdown/index.test.tsx
index de662c162fc0a..89af9202a597e 100644
--- a/x-pack/legacy/plugins/siem/public/components/markdown/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/markdown/index.test.tsx
@@ -126,6 +126,17 @@ describe('Markdown', () => {
       ).toHaveProperty('href', 'https://google.com/');
     });
 
+    test('it does NOT render the href if links are disabled', () => {
+      const wrapper = mount(<Markdown disableLinks={true} raw={markdownWithLink} />);
+
+      expect(
+        wrapper
+          .find('[data-test-subj="markdown-link"]')
+          .first()
+          .getDOMNode()
+      ).not.toHaveProperty('href');
+    });
+
     test('it opens links in a new tab via target="_blank"', () => {
       const wrapper = mount(<Markdown raw={markdownWithLink} />);
 
diff --git a/x-pack/legacy/plugins/siem/public/components/markdown/index.tsx b/x-pack/legacy/plugins/siem/public/components/markdown/index.tsx
index 30695c9d0c7e2..1368c13619d6b 100644
--- a/x-pack/legacy/plugins/siem/public/components/markdown/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/markdown/index.tsx
@@ -26,51 +26,53 @@ const REL_NOFOLLOW = 'nofollow';
 /** prevents the browser from sending the current address as referrer via the Referer HTTP header */
 const REL_NOREFERRER = 'noreferrer';
 
-export const Markdown = React.memo<{ raw?: string; size?: 'xs' | 's' | 'm' }>(
-  ({ raw, size = 's' }) => {
-    const markdownRenderers = {
-      root: ({ children }: { children: React.ReactNode[] }) => (
-        <EuiText data-test-subj="markdown-root" grow={true} size={size}>
+export const Markdown = React.memo<{
+  disableLinks?: boolean;
+  raw?: string;
+  size?: 'xs' | 's' | 'm';
+}>(({ disableLinks = false, raw, size = 's' }) => {
+  const markdownRenderers = {
+    root: ({ children }: { children: React.ReactNode[] }) => (
+      <EuiText data-test-subj="markdown-root" grow={true} size={size}>
+        {children}
+      </EuiText>
+    ),
+    table: ({ children }: { children: React.ReactNode[] }) => (
+      <table data-test-subj="markdown-table" className="euiTable euiTable--responsive">
+        {children}
+      </table>
+    ),
+    tableHead: ({ children }: { children: React.ReactNode[] }) => (
+      <TableHeader data-test-subj="markdown-table-header">{children}</TableHeader>
+    ),
+    tableRow: ({ children }: { children: React.ReactNode[] }) => (
+      <EuiTableRow data-test-subj="markdown-table-row">{children}</EuiTableRow>
+    ),
+    tableCell: ({ children }: { children: React.ReactNode[] }) => (
+      <EuiTableRowCell data-test-subj="markdown-table-cell">{children}</EuiTableRowCell>
+    ),
+    link: ({ children, href }: { children: React.ReactNode[]; href?: string }) => (
+      <EuiToolTip content={href}>
+        <EuiLink
+          href={disableLinks ? undefined : href}
+          data-test-subj="markdown-link"
+          rel={`${REL_NOOPENER} ${REL_NOFOLLOW} ${REL_NOREFERRER}`}
+          target="_blank"
+        >
           {children}
-        </EuiText>
-      ),
-      table: ({ children }: { children: React.ReactNode[] }) => (
-        <table data-test-subj="markdown-table" className="euiTable euiTable--responsive">
-          {children}
-        </table>
-      ),
-      tableHead: ({ children }: { children: React.ReactNode[] }) => (
-        <TableHeader data-test-subj="markdown-table-header">{children}</TableHeader>
-      ),
-      tableRow: ({ children }: { children: React.ReactNode[] }) => (
-        <EuiTableRow data-test-subj="markdown-table-row">{children}</EuiTableRow>
-      ),
-      tableCell: ({ children }: { children: React.ReactNode[] }) => (
-        <EuiTableRowCell data-test-subj="markdown-table-cell">{children}</EuiTableRowCell>
-      ),
-      link: ({ children, href }: { children: React.ReactNode[]; href?: string }) => (
-        <EuiToolTip content={href}>
-          <EuiLink
-            href={href}
-            data-test-subj="markdown-link"
-            rel={`${REL_NOOPENER} ${REL_NOFOLLOW} ${REL_NOREFERRER}`}
-            target="_blank"
-          >
-            {children}
-          </EuiLink>
-        </EuiToolTip>
-      ),
-    };
+        </EuiLink>
+      </EuiToolTip>
+    ),
+  };
 
-    return (
-      <ReactMarkdown
-        data-test-subj="markdown"
-        linkTarget="_blank"
-        renderers={markdownRenderers}
-        source={raw}
-      />
-    );
-  }
-);
+  return (
+    <ReactMarkdown
+      data-test-subj="markdown"
+      linkTarget="_blank"
+      renderers={markdownRenderers}
+      source={raw}
+    />
+  );
+});
 
 Markdown.displayName = 'Markdown';
diff --git a/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.ts b/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.ts
index e25fb4374bb14..155f63145ca95 100644
--- a/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.ts
+++ b/x-pack/legacy/plugins/siem/public/components/navigation/breadcrumbs/index.ts
@@ -107,7 +107,22 @@ export const getBreadcrumbsForRoute = (
     ];
   }
   if (isCaseRoutes(spyState) && object.navTabs) {
-    return [...siemRootBreadcrumb, ...getCaseDetailsBreadcrumbs(spyState)];
+    const tempNav: SearchNavTab = { urlKey: 'case', isDetailPage: false };
+    let urlStateKeys = [getOr(tempNav, spyState.pageName, object.navTabs)];
+    if (spyState.tabName != null) {
+      urlStateKeys = [...urlStateKeys, getOr(tempNav, spyState.tabName, object.navTabs)];
+    }
+
+    return [
+      ...siemRootBreadcrumb,
+      ...getCaseDetailsBreadcrumbs(
+        spyState,
+        urlStateKeys.reduce(
+          (acc: string[], item: SearchNavTab) => [...acc, getSearch(item, object)],
+          []
+        )
+      ),
+    ];
   }
   if (
     spyState != null &&
diff --git a/x-pack/legacy/plugins/siem/public/components/news_feed/news_feed.tsx b/x-pack/legacy/plugins/siem/public/components/news_feed/news_feed.tsx
index 98eea1eaa6454..cd356212b4400 100644
--- a/x-pack/legacy/plugins/siem/public/components/news_feed/news_feed.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/news_feed/news_feed.tsx
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiSpacer } from '@elastic/eui';
 import React from 'react';
 
 import { LoadingPlaceholders } from '../page/overview/loading_placeholders';
@@ -30,12 +29,7 @@ const NewsFeedComponent: React.FC<Props> = ({ news }) => (
     ) : news.length === 0 ? (
       <NoNews />
     ) : (
-      news.map((n: NewsItem) => (
-        <React.Fragment key={n.hash}>
-          <Post newsItem={n} />
-          <EuiSpacer size="l" />
-        </React.Fragment>
-      ))
+      news.map((n: NewsItem) => <Post key={n.hash} newsItem={n} />)
     )}
   </>
 );
diff --git a/x-pack/legacy/plugins/siem/public/components/news_feed/post/index.tsx b/x-pack/legacy/plugins/siem/public/components/news_feed/post/index.tsx
index cb2542a497f08..9cab78c9f20b1 100644
--- a/x-pack/legacy/plugins/siem/public/components/news_feed/post/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/news_feed/post/index.tsx
@@ -45,6 +45,7 @@ export const Post = React.memo<{ newsItem: NewsItem }>(({ newsItem }) => {
           <PreferenceFormattedP1DTDate value={publishOn} />
           <EuiSpacer size="s" />
           <div>{description}</div>
+          <EuiSpacer size="l" />
         </EuiText>
       </EuiFlexItem>
 
diff --git a/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/__snapshots__/index.test.tsx.snap b/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/__snapshots__/index.test.tsx.snap
index 85b028cf7cd51..8b7d8efa7ac37 100644
--- a/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/__snapshots__/index.test.tsx.snap
+++ b/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/__snapshots__/index.test.tsx.snap
@@ -10,14 +10,7 @@ exports[`Tls Table Component Rendering it renders the default Domains table 1`]
         },
         "node": Object {
           "_id": "2fe3bdf168af35b9e0ce5dc583bab007c40d47de",
-          "alternativeNames": Array [
-            "*.elastic.co",
-            "elastic.co",
-          ],
-          "commonNames": Array [
-            "*.elastic.co",
-          ],
-          "issuerNames": Array [
+          "issuers": Array [
             "DigiCert SHA2 Secure Server CA",
           ],
           "ja3": Array [
@@ -27,6 +20,9 @@ exports[`Tls Table Component Rendering it renders the default Domains table 1`]
           "notAfter": Array [
             "2021-04-22T12:00:00.000Z",
           ],
+          "subjects": Array [
+            "*.elastic.co",
+          ],
         },
       },
       Object {
@@ -35,13 +31,7 @@ exports[`Tls Table Component Rendering it renders the default Domains table 1`]
         },
         "node": Object {
           "_id": "61749734b3246f1584029deb4f5276c64da00ada",
-          "alternativeNames": Array [
-            "api.snapcraft.io",
-          ],
-          "commonNames": Array [
-            "api.snapcraft.io",
-          ],
-          "issuerNames": Array [
+          "issuers": Array [
             "DigiCert SHA2 Secure Server CA",
           ],
           "ja3": Array [
@@ -50,6 +40,9 @@ exports[`Tls Table Component Rendering it renders the default Domains table 1`]
           "notAfter": Array [
             "2019-05-22T12:00:00.000Z",
           ],
+          "subjects": Array [
+            "api.snapcraft.io",
+          ],
         },
       },
       Object {
@@ -58,14 +51,7 @@ exports[`Tls Table Component Rendering it renders the default Domains table 1`]
         },
         "node": Object {
           "_id": "6560d3b7dd001c989b85962fa64beb778cdae47a",
-          "alternativeNames": Array [
-            "changelogs.ubuntu.com",
-            "manpages.ubuntu.com",
-          ],
-          "commonNames": Array [
-            "changelogs.ubuntu.com",
-          ],
-          "issuerNames": Array [
+          "issuers": Array [
             "Let's Encrypt Authority X3",
           ],
           "ja3": Array [
@@ -74,6 +60,9 @@ exports[`Tls Table Component Rendering it renders the default Domains table 1`]
           "notAfter": Array [
             "2019-06-27T01:09:59.000Z",
           ],
+          "subjects": Array [
+            "changelogs.ubuntu.com",
+          ],
         },
       },
     ]
diff --git a/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/columns.tsx b/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/columns.tsx
index 44a538871d951..f95475819abc9 100644
--- a/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/columns.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/columns.tsx
@@ -32,11 +32,11 @@ export const getTlsColumns = (tableId: string): TlsColumns => [
     truncateText: false,
     hideForMobile: false,
     sortable: false,
-    render: ({ _id, issuerNames }) =>
+    render: ({ _id, issuers }) =>
       getRowItemDraggables({
-        rowItems: issuerNames,
-        attrName: 'tls.server_certificate.issuer.common_name',
-        idPrefix: `${tableId}-${_id}-table-issuerNames`,
+        rowItems: issuers,
+        attrName: 'tls.server.issuer',
+        idPrefix: `${tableId}-${_id}-table-issuers`,
       }),
   },
   {
@@ -45,18 +45,12 @@ export const getTlsColumns = (tableId: string): TlsColumns => [
     truncateText: false,
     hideForMobile: false,
     sortable: false,
-    render: ({ _id, alternativeNames, commonNames }) =>
-      alternativeNames != null && alternativeNames.length > 0
-        ? getRowItemDraggables({
-            rowItems: alternativeNames,
-            attrName: 'tls.server_certificate.alternative_names',
-            idPrefix: `${tableId}-${_id}-table-alternative-name`,
-          })
-        : getRowItemDraggables({
-            rowItems: commonNames,
-            attrName: 'tls.server_certificate.subject.common_name',
-            idPrefix: `${tableId}-${_id}-table-common-name`,
-          }),
+    render: ({ _id, subjects }) =>
+      getRowItemDraggables({
+        rowItems: subjects,
+        attrName: 'tls.server.subject',
+        idPrefix: `${tableId}-${_id}-table-subjects`,
+      }),
   },
   {
     field: 'node._id',
diff --git a/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/mock.ts b/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/mock.ts
index 77148bf50c038..453bd8fc84dfa 100644
--- a/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/mock.ts
+++ b/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/mock.ts
@@ -12,10 +12,9 @@ export const mockTlsData: TlsData = {
     {
       node: {
         _id: '2fe3bdf168af35b9e0ce5dc583bab007c40d47de',
-        alternativeNames: ['*.elastic.co', 'elastic.co'],
-        commonNames: ['*.elastic.co'],
+        subjects: ['*.elastic.co'],
         ja3: ['7851693188210d3b271aa1713d8c68c2', 'fb4726d465c5f28b84cd6d14cedd13a7'],
-        issuerNames: ['DigiCert SHA2 Secure Server CA'],
+        issuers: ['DigiCert SHA2 Secure Server CA'],
         notAfter: ['2021-04-22T12:00:00.000Z'],
       },
       cursor: {
@@ -25,10 +24,9 @@ export const mockTlsData: TlsData = {
     {
       node: {
         _id: '61749734b3246f1584029deb4f5276c64da00ada',
-        alternativeNames: ['api.snapcraft.io'],
-        commonNames: ['api.snapcraft.io'],
+        subjects: ['api.snapcraft.io'],
         ja3: ['839868ad711dc55bde0d37a87f14740d'],
-        issuerNames: ['DigiCert SHA2 Secure Server CA'],
+        issuers: ['DigiCert SHA2 Secure Server CA'],
         notAfter: ['2019-05-22T12:00:00.000Z'],
       },
       cursor: {
@@ -38,10 +36,9 @@ export const mockTlsData: TlsData = {
     {
       node: {
         _id: '6560d3b7dd001c989b85962fa64beb778cdae47a',
-        alternativeNames: ['changelogs.ubuntu.com', 'manpages.ubuntu.com'],
-        commonNames: ['changelogs.ubuntu.com'],
+        subjects: ['changelogs.ubuntu.com'],
         ja3: ['da12c94da8021bbaf502907ad086e7bc'],
-        issuerNames: ["Let's Encrypt Authority X3"],
+        issuers: ["Let's Encrypt Authority X3"],
         notAfter: ['2019-06-27T01:09:59.000Z'],
       },
       cursor: {
diff --git a/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/translations.ts b/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/translations.ts
index 89d0f58684cbe..ff714204144ec 100644
--- a/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/components/page/network/tls_table/translations.ts
@@ -16,7 +16,7 @@ export const TRANSPORT_LAYER_SECURITY = i18n.translate(
 export const UNIT = (totalCount: number) =>
   i18n.translate('xpack.siem.network.ipDetails.tlsTable.unit', {
     values: { totalCount },
-    defaultMessage: `{totalCount, plural, =1 {issuer} other {issuers}}`,
+    defaultMessage: `{totalCount, plural, =1 {server certificate} other {server certificates}}`,
   });
 
 // Columns
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_cases/filters/index.tsx b/x-pack/legacy/plugins/siem/public/components/recent_cases/filters/index.tsx
new file mode 100644
index 0000000000000..edb0b99cbff8b
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/components/recent_cases/filters/index.tsx
@@ -0,0 +1,51 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiButtonGroup, EuiButtonGroupOption } from '@elastic/eui';
+import React, { useCallback, useMemo } from 'react';
+
+import { FilterMode } from '../types';
+
+import * as i18n from '../translations';
+
+const MY_RECENTLY_REPORTED_ID = 'myRecentlyReported';
+
+const toggleButtonIcons: EuiButtonGroupOption[] = [
+  {
+    id: 'recentlyCreated',
+    label: i18n.RECENTLY_CREATED_CASES,
+    iconType: 'folderExclamation',
+  },
+  {
+    id: MY_RECENTLY_REPORTED_ID,
+    label: i18n.MY_RECENTLY_REPORTED_CASES,
+    iconType: 'reporter',
+  },
+];
+
+export const Filters = React.memo<{
+  filterBy: FilterMode;
+  setFilterBy: (filterBy: FilterMode) => void;
+  showMyRecentlyReported: boolean;
+}>(({ filterBy, setFilterBy, showMyRecentlyReported }) => {
+  const options = useMemo(
+    () =>
+      showMyRecentlyReported
+        ? toggleButtonIcons
+        : toggleButtonIcons.filter(x => x.id !== MY_RECENTLY_REPORTED_ID),
+    [showMyRecentlyReported]
+  );
+  const onChange = useCallback(
+    (filterMode: string) => {
+      setFilterBy(filterMode as FilterMode);
+    },
+    [setFilterBy]
+  );
+
+  return <EuiButtonGroup options={options} idSelected={filterBy} onChange={onChange} isIconOnly />;
+});
+
+Filters.displayName = 'Filters';
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_cases/index.tsx b/x-pack/legacy/plugins/siem/public/components/recent_cases/index.tsx
new file mode 100644
index 0000000000000..07246c6c6ec88
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/components/recent_cases/index.tsx
@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiHorizontalRule, EuiLink, EuiText } from '@elastic/eui';
+import React, { useEffect, useMemo, useRef } from 'react';
+
+import { FilterOptions, QueryParams } from '../../containers/case/types';
+import { DEFAULT_QUERY_PARAMS, useGetCases } from '../../containers/case/use_get_cases';
+import { getCaseUrl } from '../link_to/redirect_to_case';
+import { useGetUrlSearch } from '../navigation/use_get_url_search';
+import { LoadingPlaceholders } from '../page/overview/loading_placeholders';
+import { navTabs } from '../../pages/home/home_navigations';
+
+import { NoCases } from './no_cases';
+import { RecentCases } from './recent_cases';
+import * as i18n from './translations';
+
+const usePrevious = (value: FilterOptions) => {
+  const ref = useRef();
+  useEffect(() => {
+    (ref.current as unknown) = value;
+  });
+  return ref.current;
+};
+
+const MAX_CASES_TO_SHOW = 3;
+
+const queryParams: QueryParams = {
+  ...DEFAULT_QUERY_PARAMS,
+  perPage: MAX_CASES_TO_SHOW,
+};
+
+const StatefulRecentCasesComponent = React.memo(
+  ({ filterOptions }: { filterOptions: FilterOptions }) => {
+    const previousFilterOptions = usePrevious(filterOptions);
+    const { data, loading, setFilters } = useGetCases(queryParams);
+    const isLoadingCases = useMemo(
+      () => loading.indexOf('cases') > -1 || loading.indexOf('caseUpdate') > -1,
+      [loading]
+    );
+    const search = useGetUrlSearch(navTabs.case);
+    const allCasesLink = useMemo(
+      () => <EuiLink href={getCaseUrl(search)}>{i18n.VIEW_ALL_CASES}</EuiLink>,
+      [search]
+    );
+
+    useEffect(() => {
+      if (previousFilterOptions !== undefined && previousFilterOptions !== filterOptions) {
+        setFilters(filterOptions);
+      }
+    }, [previousFilterOptions, filterOptions, setFilters]);
+
+    const content = useMemo(
+      () =>
+        isLoadingCases ? (
+          <LoadingPlaceholders lines={2} placeholders={3} />
+        ) : !isLoadingCases && data.cases.length === 0 ? (
+          <NoCases />
+        ) : (
+          <RecentCases cases={data.cases} />
+        ),
+      [isLoadingCases, data]
+    );
+
+    return (
+      <EuiText color="subdued" size="s">
+        {content}
+        <EuiHorizontalRule margin="s" />
+        <EuiText size="xs">{allCasesLink}</EuiText>
+      </EuiText>
+    );
+  }
+);
+
+StatefulRecentCasesComponent.displayName = 'StatefulRecentCasesComponent';
+
+export const StatefulRecentCases = React.memo(StatefulRecentCasesComponent);
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_cases/no_cases/index.tsx b/x-pack/legacy/plugins/siem/public/components/recent_cases/no_cases/index.tsx
new file mode 100644
index 0000000000000..9f0361311b7b6
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/components/recent_cases/no_cases/index.tsx
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiLink } from '@elastic/eui';
+import React, { useMemo } from 'react';
+
+import { getCreateCaseUrl } from '../../link_to/redirect_to_case';
+import { useGetUrlSearch } from '../../navigation/use_get_url_search';
+import { navTabs } from '../../../pages/home/home_navigations';
+
+import * as i18n from '../translations';
+
+const NoCasesComponent = () => {
+  const urlSearch = useGetUrlSearch(navTabs.case);
+  const newCaseLink = useMemo(
+    () => <EuiLink href={getCreateCaseUrl(urlSearch)}>{` ${i18n.START_A_NEW_CASE}`}</EuiLink>,
+    [urlSearch]
+  );
+
+  return (
+    <>
+      <span>{i18n.NO_CASES}</span>
+      {newCaseLink}
+      {'!'}
+    </>
+  );
+};
+
+NoCasesComponent.displayName = 'NoCasesComponent';
+
+export const NoCases = React.memo(NoCasesComponent);
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_cases/recent_cases.tsx b/x-pack/legacy/plugins/siem/public/components/recent_cases/recent_cases.tsx
new file mode 100644
index 0000000000000..eb17c75f4111b
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/components/recent_cases/recent_cases.tsx
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiLink, EuiSpacer, EuiText } from '@elastic/eui';
+import React from 'react';
+import styled from 'styled-components';
+
+import { Case } from '../../containers/case/types';
+import { getCaseDetailsUrl } from '../link_to/redirect_to_case';
+import { Markdown } from '../markdown';
+import { useGetUrlSearch } from '../navigation/use_get_url_search';
+import { navTabs } from '../../pages/home/home_navigations';
+import { IconWithCount } from '../recent_timelines/counts';
+
+import * as i18n from './translations';
+
+const MarkdownContainer = styled.div`
+  max-height: 150px;
+  overflow-y: auto;
+  width: 300px;
+`;
+
+const RecentCasesComponent = ({ cases }: { cases: Case[] }) => {
+  const search = useGetUrlSearch(navTabs.case);
+
+  return (
+    <>
+      {cases.map((c, i) => (
+        <EuiFlexGroup key={c.id} gutterSize="none" justifyContent="spaceBetween">
+          <EuiFlexItem grow={false}>
+            <EuiText size="s">
+              <EuiLink href={getCaseDetailsUrl({ id: c.id, search })}>{c.title}</EuiLink>
+            </EuiText>
+
+            <IconWithCount count={c.totalComment} icon={'editorComment'} tooltip={i18n.COMMENTS} />
+            {c.description && c.description.length && (
+              <MarkdownContainer>
+                <EuiText color="subdued" size="xs">
+                  <Markdown disableLinks={true} raw={c.description} />
+                </EuiText>
+              </MarkdownContainer>
+            )}
+            {i !== cases.length - 1 && <EuiSpacer size="l" />}
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      ))}
+    </>
+  );
+};
+
+RecentCasesComponent.displayName = 'RecentCasesComponent';
+
+export const RecentCases = React.memo(RecentCasesComponent);
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_cases/translations.ts b/x-pack/legacy/plugins/siem/public/components/recent_cases/translations.ts
new file mode 100644
index 0000000000000..d2318e5db88c3
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/components/recent_cases/translations.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const COMMENTS = i18n.translate('xpack.siem.recentCases.commentsTooltip', {
+  defaultMessage: 'Comments',
+});
+
+export const MY_RECENTLY_REPORTED_CASES = i18n.translate(
+  'xpack.siem.overview.myRecentlyReportedCasesButtonLabel',
+  {
+    defaultMessage: 'My recently reported cases',
+  }
+);
+
+export const NO_CASES = i18n.translate('xpack.siem.recentCases.noCasesMessage', {
+  defaultMessage: 'No cases have been created yet. Put your detective hat on and',
+});
+
+export const RECENTLY_CREATED_CASES = i18n.translate(
+  'xpack.siem.overview.recentlyCreatedCasesButtonLabel',
+  {
+    defaultMessage: 'Recently created cases',
+  }
+);
+
+export const START_A_NEW_CASE = i18n.translate('xpack.siem.recentCases.startNewCaseLink', {
+  defaultMessage: 'start a new case',
+});
+
+export const VIEW_ALL_CASES = i18n.translate('xpack.siem.recentCases.viewAllCasesLink', {
+  defaultMessage: 'View all cases',
+});
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_cases/types.ts b/x-pack/legacy/plugins/siem/public/components/recent_cases/types.ts
new file mode 100644
index 0000000000000..29c7072ce0be6
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/components/recent_cases/types.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export type FilterMode = 'recentlyCreated' | 'myRecentlyReported';
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_timelines/counts/index.tsx b/x-pack/legacy/plugins/siem/public/components/recent_timelines/counts/index.tsx
index e04b6319cfb24..c80530b245cf3 100644
--- a/x-pack/legacy/plugins/siem/public/components/recent_timelines/counts/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/recent_timelines/counts/index.tsx
@@ -21,7 +21,7 @@ const FlexGroup = styled(EuiFlexGroup)`
   margin-right: 16px;
 `;
 
-const IconWithCount = React.memo<{ count: number; icon: string; tooltip: string }>(
+export const IconWithCount = React.memo<{ count: number; icon: string; tooltip: string }>(
   ({ count, icon, tooltip }) => (
     <EuiToolTip content={tooltip}>
       <FlexGroup alignItems="center" gutterSize="none">
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_timelines/filters/index.tsx b/x-pack/legacy/plugins/siem/public/components/recent_timelines/filters/index.tsx
index de8a3de8094d0..d7271197b9cea 100644
--- a/x-pack/legacy/plugins/siem/public/components/recent_timelines/filters/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/recent_timelines/filters/index.tsx
@@ -9,15 +9,17 @@ import React from 'react';
 
 import { FilterMode } from '../types';
 
+import * as i18n from '../translations';
+
 const toggleButtonIcons: EuiButtonGroupOption[] = [
   {
     id: 'favorites',
-    label: 'Favorites',
+    label: i18n.FAVORITES,
     iconType: 'starFilled',
   },
   {
     id: `recently-updated`,
-    label: 'Last updated',
+    label: i18n.LAST_UPDATED,
     iconType: 'documentEdit',
   },
 ];
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_timelines/index.tsx b/x-pack/legacy/plugins/siem/public/components/recent_timelines/index.tsx
index 007665b47dedb..5b851701b973c 100644
--- a/x-pack/legacy/plugins/siem/public/components/recent_timelines/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/recent_timelines/index.tsx
@@ -31,6 +31,8 @@ interface OwnProps {
 
 export type Props = OwnProps & PropsFromRedux;
 
+const PAGE_SIZE = 3;
+
 const StatefulRecentTimelinesComponent = React.memo<Props>(
   ({ apolloClient, filterBy, updateIsLoading, updateTimeline }) => {
     const onOpenTimeline: OnOpenTimeline = useCallback(
@@ -53,12 +55,18 @@ const StatefulRecentTimelinesComponent = React.memo<Props>(
       () => <EuiLink href={getTimelinesUrl(urlSearch)}>{i18n.VIEW_ALL_TIMELINES}</EuiLink>,
       [urlSearch]
     );
+    const loadingPlaceholders = useMemo(
+      () => (
+        <LoadingPlaceholders lines={2} placeholders={filterBy === 'favorites' ? 1 : PAGE_SIZE} />
+      ),
+      [filterBy]
+    );
 
     return (
       <AllTimelinesQuery
         pageInfo={{
           pageIndex: 1,
-          pageSize: 5,
+          pageSize: PAGE_SIZE,
         }}
         search={''}
         sort={{
@@ -70,7 +78,7 @@ const StatefulRecentTimelinesComponent = React.memo<Props>(
         {({ timelines, loading }) => (
           <>
             {loading ? (
-              <LoadingPlaceholders lines={2} placeholders={filterBy === 'favorites' ? 1 : 5} />
+              loadingPlaceholders
             ) : (
               <RecentTimelines
                 noTimelinesMessage={noTimelinesMessage}
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_timelines/recent_timelines.tsx b/x-pack/legacy/plugins/siem/public/components/recent_timelines/recent_timelines.tsx
index fdd206a33ff7e..dbcd3fe721ea3 100644
--- a/x-pack/legacy/plugins/siem/public/components/recent_timelines/recent_timelines.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/recent_timelines/recent_timelines.tsx
@@ -47,12 +47,9 @@ export const RecentTimelines = React.memo<{
                   <RecentTimelineHeader onOpenTimeline={onOpenTimeline} timeline={t} />
                   <RecentTimelineCounts timeline={t} />
                   {t.description && t.description.length && (
-                    <>
-                      <EuiSpacer size="s" />
-                      <EuiText color="subdued" size="xs">
-                        {t.description}
-                      </EuiText>
-                    </>
+                    <EuiText color="subdued" size="xs">
+                      {t.description}
+                    </EuiText>
                   )}
                 </EuiFlexItem>
 
diff --git a/x-pack/legacy/plugins/siem/public/components/recent_timelines/translations.ts b/x-pack/legacy/plugins/siem/public/components/recent_timelines/translations.ts
index e547272fde6e1..f5934aa317242 100644
--- a/x-pack/legacy/plugins/siem/public/components/recent_timelines/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/components/recent_timelines/translations.ts
@@ -13,6 +13,10 @@ export const ERROR_RETRIEVING_USER_DETAILS = i18n.translate(
   }
 );
 
+export const FAVORITES = i18n.translate('xpack.siem.recentTimelines.favoritesButtonLabel', {
+  defaultMessage: 'Favorites',
+});
+
 export const NO_FAVORITE_TIMELINES = i18n.translate(
   'xpack.siem.recentTimelines.noFavoriteTimelinesMessage',
   {
@@ -21,6 +25,10 @@ export const NO_FAVORITE_TIMELINES = i18n.translate(
   }
 );
 
+export const LAST_UPDATED = i18n.translate('xpack.siem.recentTimelines.lastUpdatedButtonLabel', {
+  defaultMessage: 'Last updated',
+});
+
 export const NO_TIMELINES = i18n.translate('xpack.siem.recentTimelines.noTimelinesMessage', {
   defaultMessage: "You haven't created any timelines yet. Get out there and start threat hunting!",
 });
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/insert_timeline_popover/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/insert_timeline_popover/index.test.tsx
new file mode 100644
index 0000000000000..adac26a8ac92b
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/insert_timeline_popover/index.test.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mount } from 'enzyme';
+/* eslint-disable @kbn/eslint/module_migration */
+import routeData from 'react-router';
+/* eslint-enable @kbn/eslint/module_migration */
+import { InsertTimelinePopoverComponent } from './';
+
+const mockDispatch = jest.fn();
+jest.mock('react-redux', () => ({
+  useDispatch: () => mockDispatch,
+}));
+const mockLocation = {
+  pathname: '/apath',
+  hash: '',
+  search: '',
+  state: '',
+};
+const mockLocationWithState = {
+  ...mockLocation,
+  state: {
+    insertTimeline: {
+      timelineId: 'timeline-id',
+      timelineTitle: 'Timeline title',
+    },
+  },
+};
+
+const onTimelineChange = jest.fn();
+const defaultProps = {
+  isDisabled: false,
+  onTimelineChange,
+};
+
+describe('Insert timeline popover ', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
+  it('should insert a timeline when passed in the router state', () => {
+    jest.spyOn(routeData, 'useLocation').mockReturnValue(mockLocationWithState);
+    mount(<InsertTimelinePopoverComponent {...defaultProps} />);
+    expect(mockDispatch).toBeCalledWith({
+      payload: { id: 'timeline-id', show: false },
+      type: 'x-pack/siem/local/timeline/SHOW_TIMELINE',
+    });
+    expect(onTimelineChange).toBeCalledWith('Timeline title', 'timeline-id');
+  });
+  it('should do nothing when router state', () => {
+    jest.spyOn(routeData, 'useLocation').mockReturnValue(mockLocation);
+    mount(<InsertTimelinePopoverComponent {...defaultProps} />);
+    expect(mockDispatch).toHaveBeenCalledTimes(0);
+    expect(onTimelineChange).toHaveBeenCalledTimes(0);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/insert_timeline_popover/index.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/insert_timeline_popover/index.tsx
index 84bd8c1f302c3..fa474c4d601ad 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/insert_timeline_popover/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/insert_timeline_popover/index.tsx
@@ -5,11 +5,14 @@
  */
 
 import { EuiButtonIcon, EuiPopover, EuiSelectableOption } from '@elastic/eui';
-import React, { memo, useCallback, useMemo, useState } from 'react';
+import React, { memo, useCallback, useEffect, useMemo, useState } from 'react';
+import { useLocation } from 'react-router-dom';
+import { useDispatch } from 'react-redux';
 
 import { OpenTimelineResult } from '../../open_timeline/types';
 import { SelectableTimeline } from '../selectable_timeline';
 import * as i18n from '../translations';
+import { timelineActions } from '../../../store/timeline';
 
 interface InsertTimelinePopoverProps {
   isDisabled: boolean;
@@ -17,12 +20,37 @@ interface InsertTimelinePopoverProps {
   onTimelineChange: (timelineTitle: string, timelineId: string | null) => void;
 }
 
-const InsertTimelinePopoverComponent: React.FC<InsertTimelinePopoverProps> = ({
+interface RouterState {
+  insertTimeline: {
+    timelineId: string;
+    timelineTitle: string;
+  };
+}
+
+type Props = InsertTimelinePopoverProps;
+
+export const InsertTimelinePopoverComponent: React.FC<Props> = ({
   isDisabled,
   hideUntitled = false,
   onTimelineChange,
 }) => {
+  const dispatch = useDispatch();
   const [isPopoverOpen, setIsPopoverOpen] = useState(false);
+  const { state } = useLocation();
+  const [routerState, setRouterState] = useState<RouterState | null>(state ?? null);
+
+  useEffect(() => {
+    if (routerState && routerState.insertTimeline) {
+      dispatch(
+        timelineActions.showTimeline({ id: routerState.insertTimeline.timelineId, show: false })
+      );
+      onTimelineChange(
+        routerState.insertTimeline.timelineTitle,
+        routerState.insertTimeline.timelineId
+      );
+      setRouterState(null);
+    }
+  }, [routerState]);
 
   const handleClosePopover = useCallback(() => {
     setIsPopoverOpen(false);
@@ -65,6 +93,7 @@ const InsertTimelinePopoverComponent: React.FC<InsertTimelinePopoverProps> = ({
 
   return (
     <EuiPopover
+      data-test-subj="insert-timeline-popover"
       id="searchTimelinePopover"
       button={insertTimelineButton}
       isOpen={isPopoverOpen}
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/properties/helpers.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/properties/helpers.tsx
index 4b1fd4b5851c0..0a2ab5c9d186a 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/properties/helpers.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/properties/helpers.tsx
@@ -20,6 +20,7 @@ import {
 import React, { useCallback } from 'react';
 import uuid from 'uuid';
 import styled from 'styled-components';
+import { useHistory } from 'react-router-dom';
 
 import { Note } from '../../../lib/note';
 import { Notes } from '../../notes';
@@ -27,6 +28,7 @@ import { AssociateNote, UpdateNote } from '../../notes/helpers';
 import { NOTES_PANEL_WIDTH } from './notes_size';
 import { ButtonContainer, DescriptionContainer, LabelText, NameField, StyledStar } from './styles';
 import * as i18n from './translations';
+import { SiemPageName } from '../../../pages/home/types';
 
 export const historyToolTip = 'The chronological history of actions related to this timeline';
 export const streamLiveToolTip = 'Update the Timeline as new data arrives';
@@ -111,6 +113,41 @@ export const Name = React.memo<NameProps>(({ timelineId, title, updateTitle }) =
 ));
 Name.displayName = 'Name';
 
+interface NewCaseProps {
+  onClosePopover: () => void;
+  timelineId: string;
+  timelineTitle: string;
+}
+
+export const NewCase = React.memo<NewCaseProps>(({ onClosePopover, timelineId, timelineTitle }) => {
+  const history = useHistory();
+  const handleClick = useCallback(() => {
+    onClosePopover();
+    history.push({
+      pathname: `/${SiemPageName.case}/create`,
+      state: {
+        insertTimeline: {
+          timelineId,
+          timelineTitle: timelineTitle.length > 0 ? timelineTitle : i18n.UNTITLED_TIMELINE,
+        },
+      },
+    });
+  }, [onClosePopover, history, timelineId, timelineTitle]);
+
+  return (
+    <EuiButtonEmpty
+      data-test-subj="attach-timeline-case"
+      color="text"
+      iconSide="left"
+      iconType="paperClip"
+      onClick={handleClick}
+    >
+      {i18n.ATTACH_TIMELINE_TO_NEW_CASE}
+    </EuiButtonEmpty>
+  );
+});
+NewCase.displayName = 'NewCase';
+
 interface NewTimelineProps {
   createTimeline: CreateTimeline;
   onClosePopover: () => void;
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/properties/index.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/properties/index.tsx
index 8549784b8ecd6..0080fcb1e6924 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/properties/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/properties/index.tsx
@@ -141,6 +141,7 @@ export const Properties = React.memo<Props>(
           showTimelineModal={showTimelineModal}
           showUsersView={title.length > 0}
           timelineId={timelineId}
+          title={title}
           updateDescription={updateDescription}
           updateNote={updateNote}
           usersViewing={usersViewing}
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/properties/properties_right.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/properties/properties_right.tsx
index b21ab5063441e..59d268487cca7 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/properties/properties_right.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/properties/properties_right.tsx
@@ -14,7 +14,7 @@ import {
   EuiToolTip,
   EuiAvatar,
 } from '@elastic/eui';
-import { NewTimeline, Description, NotesButton } from './helpers';
+import { NewTimeline, Description, NotesButton, NewCase } from './helpers';
 import { OpenTimelineModalButton } from '../../open_timeline/open_timeline_modal/open_timeline_modal_button';
 import { OpenTimelineModal } from '../../open_timeline/open_timeline_modal';
 import { InspectButton, InspectButtonContainer } from '../../inspect';
@@ -79,6 +79,7 @@ interface Props {
   onCloseTimelineModal: () => void;
   onOpenTimelineModal: () => void;
   showTimelineModal: boolean;
+  title: string;
   updateNote: UpdateNote;
 }
 
@@ -104,6 +105,7 @@ const PropertiesRightComponent: React.FC<Props> = ({
   showTimelineModal,
   onCloseTimelineModal,
   onOpenTimelineModal,
+  title,
 }) => (
   <PropertiesRightStyle alignItems="flexStart" data-test-subj="properties-right" gutterSize="s">
     <EuiFlexItem grow={false}>
@@ -135,6 +137,14 @@ const PropertiesRightComponent: React.FC<Props> = ({
               <OpenTimelineModalButton onClick={onOpenTimelineModal} />
             </EuiFlexItem>
 
+            <EuiFlexItem grow={false}>
+              <NewCase
+                onClosePopover={onClosePopover}
+                timelineId={timelineId}
+                timelineTitle={title}
+              />
+            </EuiFlexItem>
+
             <EuiFlexItem grow={false}>
               <InspectButton
                 queryId={timelineId}
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/properties/translations.ts b/x-pack/legacy/plugins/siem/public/components/timeline/properties/translations.ts
index b47aa071ec3e9..a0783a327ed17 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/properties/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/properties/translations.ts
@@ -42,7 +42,7 @@ export const INSPECT_TIMELINE_TITLE = i18n.translate(
 export const UNTITLED_TIMELINE = i18n.translate(
   'xpack.siem.timeline.properties.untitledTimelinePlaceholder',
   {
-    defaultMessage: 'Untitled Timeline',
+    defaultMessage: 'Untitled timeline',
   }
 );
 
@@ -87,7 +87,14 @@ export const STREAM_LIVE_TOOL_TIP = i18n.translate(
 export const NEW_TIMELINE = i18n.translate(
   'xpack.siem.timeline.properties.newTimelineButtonLabel',
   {
-    defaultMessage: 'Create New Timeline',
+    defaultMessage: 'Create new timeline',
+  }
+);
+
+export const ATTACH_TIMELINE_TO_NEW_CASE = i18n.translate(
+  'xpack.siem.timeline.properties.newCaseButtonLabel',
+  {
+    defaultMessage: 'Attach timeline to new case',
   }
 );
 
diff --git a/x-pack/legacy/plugins/siem/public/components/timeline/timeline.test.tsx b/x-pack/legacy/plugins/siem/public/components/timeline/timeline.test.tsx
index ea4406311d7cc..22f1c525a6c2a 100644
--- a/x-pack/legacy/plugins/siem/public/components/timeline/timeline.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/timeline/timeline.test.tsx
@@ -115,7 +115,7 @@ describe('Timeline', () => {
           .find('[data-test-subj="timeline-title"]')
           .first()
           .props().placeholder
-      ).toContain('Untitled Timeline');
+      ).toContain('Untitled timeline');
     });
 
     test('it renders the timeline table', () => {
diff --git a/x-pack/legacy/plugins/siem/public/components/url_state/index.test.tsx b/x-pack/legacy/plugins/siem/public/components/url_state/index.test.tsx
index 10aa388449d91..4d2a717153894 100644
--- a/x-pack/legacy/plugins/siem/public/components/url_state/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/components/url_state/index.test.tsx
@@ -157,9 +157,7 @@ describe('UrlStateContainer', () => {
             ).toEqual({
               hash: '',
               pathname: examplePath,
-              search: [CONSTANTS.timelinePage].includes(page)
-                ? '?timerange=(global:(linkTo:!(timeline),timerange:(from:1558048243696,fromStr:now-24h,kind:relative,to:1558134643697,toStr:now)),timeline:(linkTo:!(global),timerange:(from:1558048243696,fromStr:now-24h,kind:relative,to:1558134643697,toStr:now)))'
-                : `?query=(language:kuery,query:'host.name:%22siem-es%22')&timerange=(global:(linkTo:!(timeline),timerange:(from:1558048243696,fromStr:now-24h,kind:relative,to:1558134643697,toStr:now)),timeline:(linkTo:!(global),timerange:(from:1558048243696,fromStr:now-24h,kind:relative,to:1558134643697,toStr:now)))`,
+              search: `?query=(language:kuery,query:'host.name:%22siem-es%22')&timerange=(global:(linkTo:!(timeline),timerange:(from:1558048243696,fromStr:now-24h,kind:relative,to:1558134643697,toStr:now)),timeline:(linkTo:!(global),timerange:(from:1558048243696,fromStr:now-24h,kind:relative,to:1558134643697,toStr:now)))`,
               state: '',
             });
           }
diff --git a/x-pack/legacy/plugins/siem/public/components/url_state/types.ts b/x-pack/legacy/plugins/siem/public/components/url_state/types.ts
index 2cb1b0c96ad79..9d8a4a8e6a908 100644
--- a/x-pack/legacy/plugins/siem/public/components/url_state/types.ts
+++ b/x-pack/legacy/plugins/siem/public/components/url_state/types.ts
@@ -60,8 +60,20 @@ export const URL_STATE_KEYS: Record<UrlStateType, KeyUrlState[]> = {
     CONSTANTS.timerange,
     CONSTANTS.timeline,
   ],
-  timeline: [CONSTANTS.timeline, CONSTANTS.timerange],
-  case: [],
+  timeline: [
+    CONSTANTS.appQuery,
+    CONSTANTS.filters,
+    CONSTANTS.savedQuery,
+    CONSTANTS.timerange,
+    CONSTANTS.timeline,
+  ],
+  case: [
+    CONSTANTS.appQuery,
+    CONSTANTS.filters,
+    CONSTANTS.savedQuery,
+    CONSTANTS.timerange,
+    CONSTANTS.timeline,
+  ],
 };
 
 export type LocationTypes =
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/api.ts b/x-pack/legacy/plugins/siem/public/containers/case/api.ts
index 5ba1f010e0d52..16ee294224bb9 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/api.ts
+++ b/x-pack/legacy/plugins/siem/public/containers/case/api.ts
@@ -13,9 +13,15 @@ import {
   CommentRequest,
   CommentResponse,
   User,
+  CaseUserActionsResponse,
+  CaseExternalServiceRequest,
+  ServiceConnectorCaseParams,
+  ServiceConnectorCaseResponse,
+  ActionTypeExecutorResult,
 } from '../../../../../../plugins/case/common/api';
 import { KibanaServices } from '../../lib/kibana';
 import {
+  ActionLicense,
   AllCases,
   BulkUpdateStatus,
   Case,
@@ -23,16 +29,20 @@ import {
   Comment,
   FetchCasesProps,
   SortFieldCase,
+  CaseUserActions,
 } from './types';
 import { CASES_URL } from './constants';
 import {
   convertToCamelCase,
   convertAllCasesToCamel,
+  convertArrayToCamelCase,
   decodeCaseResponse,
   decodeCasesResponse,
   decodeCasesFindResponse,
   decodeCasesStatusResponse,
   decodeCommentResponse,
+  decodeCaseUserActionsResponse,
+  decodeServiceConnectorCaseResponse,
 } from './utils';
 
 export const getCase = async (caseId: string, includeComments: boolean = true): Promise<Case> => {
@@ -71,6 +81,20 @@ export const getReporters = async (signal: AbortSignal): Promise<User[]> => {
   return response ?? [];
 };
 
+export const getCaseUserActions = async (
+  caseId: string,
+  signal: AbortSignal
+): Promise<CaseUserActions[]> => {
+  const response = await KibanaServices.get().http.fetch<CaseUserActionsResponse>(
+    `${CASES_URL}/${caseId}/user_actions`,
+    {
+      method: 'GET',
+      signal,
+    }
+  );
+  return convertArrayToCamelCase(decodeCaseUserActionsResponse(response)) as CaseUserActions[];
+};
+
 export const getCases = async ({
   filterOptions = {
     search: '',
@@ -161,3 +185,43 @@ export const deleteCases = async (caseIds: string[]): Promise<boolean> => {
   });
   return response === 'true' ? true : false;
 };
+
+export const pushCase = async (
+  caseId: string,
+  push: CaseExternalServiceRequest,
+  signal: AbortSignal
+): Promise<Case> => {
+  const response = await KibanaServices.get().http.fetch<CaseResponse>(
+    `${CASES_URL}/${caseId}/_push`,
+    {
+      method: 'POST',
+      body: JSON.stringify(push),
+      signal,
+    }
+  );
+  return convertToCamelCase<CaseResponse, Case>(decodeCaseResponse(response));
+};
+
+export const pushToService = async (
+  connectorId: string,
+  casePushParams: ServiceConnectorCaseParams,
+  signal: AbortSignal
+): Promise<ServiceConnectorCaseResponse> => {
+  const response = await KibanaServices.get().http.fetch<ActionTypeExecutorResult>(
+    `/api/action/${connectorId}/_execute`,
+    {
+      method: 'POST',
+      body: JSON.stringify({ params: casePushParams }),
+      signal,
+    }
+  );
+  return decodeServiceConnectorCaseResponse(response.data);
+};
+
+export const getActionLicense = async (signal: AbortSignal): Promise<ActionLicense[]> => {
+  const response = await KibanaServices.get().http.fetch<ActionLicense[]>(`/api/action/types`, {
+    method: 'GET',
+    signal,
+  });
+  return response;
+};
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/configure/types.ts b/x-pack/legacy/plugins/siem/public/containers/case/configure/types.ts
index fc7aaa3643d77..d69c23fe02ec9 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/configure/types.ts
+++ b/x-pack/legacy/plugins/siem/public/containers/case/configure/types.ts
@@ -26,6 +26,7 @@ export interface CaseConfigure {
   createdAt: string;
   createdBy: ElasticUser;
   connectorId: string;
+  connectorName: string;
   closureType: ClosureType;
   updatedAt: string;
   updatedBy: ElasticUser;
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/configure/use_configure.tsx b/x-pack/legacy/plugins/siem/public/containers/case/configure/use_configure.tsx
index 22ac54093d1dc..a24f8303824c5 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/configure/use_configure.tsx
+++ b/x-pack/legacy/plugins/siem/public/containers/case/configure/use_configure.tsx
@@ -13,6 +13,7 @@ import { ClosureType } from './types';
 
 interface PersistCaseConfigure {
   connectorId: string;
+  connectorName: string;
   closureType: ClosureType;
 }
 
@@ -24,12 +25,12 @@ export interface ReturnUseCaseConfigure {
 }
 
 interface UseCaseConfigure {
-  setConnectorId: (newConnectorId: string) => void;
-  setClosureType: (newClosureType: ClosureType) => void;
+  setConnector: (newConnectorId: string, newConnectorName?: string) => void;
+  setClosureType?: (newClosureType: ClosureType) => void;
 }
 
 export const useCaseConfigure = ({
-  setConnectorId,
+  setConnector,
   setClosureType,
 }: UseCaseConfigure): ReturnUseCaseConfigure => {
   const [, dispatchToaster] = useStateToaster();
@@ -48,8 +49,10 @@ export const useCaseConfigure = ({
         if (!didCancel) {
           setLoading(false);
           if (res != null) {
-            setConnectorId(res.connectorId);
-            setClosureType(res.closureType);
+            setConnector(res.connectorId, res.connectorName);
+            if (setClosureType != null) {
+              setClosureType(res.closureType);
+            }
             setVersion(res.version);
           }
         }
@@ -74,7 +77,7 @@ export const useCaseConfigure = ({
   }, []);
 
   const persistCaseConfigure = useCallback(
-    async ({ connectorId, closureType }: PersistCaseConfigure) => {
+    async ({ connectorId, connectorName, closureType }: PersistCaseConfigure) => {
       let didCancel = false;
       const abortCtrl = new AbortController();
       const saveCaseConfiguration = async () => {
@@ -83,7 +86,11 @@ export const useCaseConfigure = ({
           const res =
             version.length === 0
               ? await postCaseConfigure(
-                  { connector_id: connectorId, closure_type: closureType },
+                  {
+                    connector_id: connectorId,
+                    connector_name: connectorName,
+                    closure_type: closureType,
+                  },
                   abortCtrl.signal
                 )
               : await patchCaseConfigure(
@@ -92,8 +99,10 @@ export const useCaseConfigure = ({
                 );
           if (!didCancel) {
             setPersistLoading(false);
-            setConnectorId(res.connectorId);
-            setClosureType(res.closureType);
+            setConnector(res.connectorId);
+            if (setClosureType) {
+              setClosureType(res.closureType);
+            }
             setVersion(res.version);
           }
         } catch (error) {
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/translations.ts b/x-pack/legacy/plugins/siem/public/containers/case/translations.ts
index 0c8b896e2b426..601db373f041e 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/containers/case/translations.ts
@@ -16,3 +16,10 @@ export const TAG_FETCH_FAILURE = i18n.translate(
     defaultMessage: 'Failed to fetch Tags',
   }
 );
+
+export const SUCCESS_SEND_TO_EXTERNAL_SERVICE = i18n.translate(
+  'xpack.siem.containers.case.pushToExterService',
+  {
+    defaultMessage: 'Successfully sent to ServiceNow',
+  }
+);
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/types.ts b/x-pack/legacy/plugins/siem/public/containers/case/types.ts
index 44519031e91cb..bbbb13788d53a 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/types.ts
+++ b/x-pack/legacy/plugins/siem/public/containers/case/types.ts
@@ -4,30 +4,53 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { User } from '../../../../../../plugins/case/common/api';
+import { User, UserActionField, UserAction } from '../../../../../../plugins/case/common/api';
 
 export interface Comment {
   id: string;
   createdAt: string;
   createdBy: ElasticUser;
   comment: string;
+  pushedAt: string | null;
+  pushedBy: string | null;
   updatedAt: string | null;
   updatedBy: ElasticUser | null;
   version: string;
 }
+export interface CaseUserActions {
+  actionId: string;
+  actionField: UserActionField;
+  action: UserAction;
+  actionAt: string;
+  actionBy: ElasticUser;
+  caseId: string;
+  commentId: string | null;
+  newValue: string | null;
+  oldValue: string | null;
+}
 
+export interface CaseExternalService {
+  pushedAt: string;
+  pushedBy: string;
+  connectorId: string;
+  connectorName: string;
+  externalId: string;
+  externalTitle: string;
+  externalUrl: string;
+}
 export interface Case {
   id: string;
   closedAt: string | null;
   closedBy: ElasticUser | null;
   comments: Comment[];
-  commentIds: string[];
   createdAt: string;
   createdBy: ElasticUser;
   description: string;
+  externalService: CaseExternalService | null;
   status: string;
   tags: string[];
   title: string;
+  totalComment: number;
   updatedAt: string | null;
   updatedBy: ElasticUser | null;
   version: string;
@@ -84,3 +107,10 @@ export interface BulkUpdateStatus {
   id: string;
   version: string;
 }
+export interface ActionLicense {
+  id: string;
+  name: string;
+  enabled: boolean;
+  enabledInConfig: boolean;
+  enabledInLicense: boolean;
+}
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/use_get_action_license.tsx b/x-pack/legacy/plugins/siem/public/containers/case/use_get_action_license.tsx
new file mode 100644
index 0000000000000..12f92b2db039b
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/containers/case/use_get_action_license.tsx
@@ -0,0 +1,74 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useCallback, useEffect, useState } from 'react';
+
+import { errorToToaster, useStateToaster } from '../../components/toasters';
+import { getActionLicense } from './api';
+import * as i18n from './translations';
+import { ActionLicense } from './types';
+
+interface ActionLicenseState {
+  actionLicense: ActionLicense | null;
+  isLoading: boolean;
+  isError: boolean;
+}
+
+const initialData: ActionLicenseState = {
+  actionLicense: null,
+  isLoading: true,
+  isError: false,
+};
+
+export const useGetActionLicense = (): ActionLicenseState => {
+  const [actionLicenseState, setActionLicensesState] = useState<ActionLicenseState>(initialData);
+
+  const [, dispatchToaster] = useStateToaster();
+
+  const fetchActionLicense = useCallback(() => {
+    let didCancel = false;
+    const abortCtrl = new AbortController();
+    const fetchData = async () => {
+      setActionLicensesState({
+        ...actionLicenseState,
+        isLoading: true,
+      });
+      try {
+        const response = await getActionLicense(abortCtrl.signal);
+        if (!didCancel) {
+          setActionLicensesState({
+            actionLicense: response.find(l => l.id === '.servicenow') ?? null,
+            isLoading: false,
+            isError: false,
+          });
+        }
+      } catch (error) {
+        if (!didCancel) {
+          errorToToaster({
+            title: i18n.ERROR_TITLE,
+            error: error.body && error.body.message ? new Error(error.body.message) : error,
+            dispatchToaster,
+          });
+          setActionLicensesState({
+            actionLicense: null,
+            isLoading: false,
+            isError: true,
+          });
+        }
+      }
+    };
+    fetchData();
+    return () => {
+      didCancel = true;
+      abortCtrl.abort();
+    };
+  }, [actionLicenseState]);
+
+  useEffect(() => {
+    fetchActionLicense();
+  }, []);
+  return { ...actionLicenseState };
+};
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/use_get_case.tsx b/x-pack/legacy/plugins/siem/public/containers/case/use_get_case.tsx
index b70195e2c126f..02b41c9fc720f 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/use_get_case.tsx
+++ b/x-pack/legacy/plugins/siem/public/containers/case/use_get_case.tsx
@@ -53,14 +53,15 @@ const initialData: Case = {
   closedBy: null,
   createdAt: '',
   comments: [],
-  commentIds: [],
   createdBy: {
     username: '',
   },
   description: '',
+  externalService: null,
   status: '',
   tags: [],
   title: '',
+  totalComment: 0,
   updatedAt: null,
   updatedBy: null,
   version: '',
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/use_get_case_user_actions.tsx b/x-pack/legacy/plugins/siem/public/containers/case/use_get_case_user_actions.tsx
new file mode 100644
index 0000000000000..4c278bc038134
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/containers/case/use_get_case_user_actions.tsx
@@ -0,0 +1,126 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { isEmpty, uniqBy } from 'lodash/fp';
+import { useCallback, useEffect, useState } from 'react';
+
+import { errorToToaster, useStateToaster } from '../../components/toasters';
+import { getCaseUserActions } from './api';
+import * as i18n from './translations';
+import { CaseUserActions, ElasticUser } from './types';
+
+interface CaseUserActionsState {
+  caseUserActions: CaseUserActions[];
+  firstIndexPushToService: number;
+  hasDataToPush: boolean;
+  participants: ElasticUser[];
+  isLoading: boolean;
+  isError: boolean;
+  lastIndexPushToService: number;
+}
+
+const initialData: CaseUserActionsState = {
+  caseUserActions: [],
+  firstIndexPushToService: -1,
+  lastIndexPushToService: -1,
+  hasDataToPush: false,
+  isLoading: true,
+  isError: false,
+  participants: [],
+};
+
+interface UseGetCaseUserActions extends CaseUserActionsState {
+  fetchCaseUserActions: (caseId: string) => void;
+}
+
+const getPushedInfo = (
+  caseUserActions: CaseUserActions[]
+): { firstIndexPushToService: number; lastIndexPushToService: number; hasDataToPush: boolean } => {
+  const firstIndexPushToService = caseUserActions.findIndex(
+    cua => cua.action === 'push-to-service'
+  );
+  const lastIndexPushToService = caseUserActions
+    .map(cua => cua.action)
+    .lastIndexOf('push-to-service');
+
+  const hasDataToPush =
+    lastIndexPushToService === -1 || lastIndexPushToService < caseUserActions.length - 1;
+  return {
+    firstIndexPushToService,
+    lastIndexPushToService,
+    hasDataToPush,
+  };
+};
+
+export const useGetCaseUserActions = (caseId: string): UseGetCaseUserActions => {
+  const [caseUserActionsState, setCaseUserActionsState] = useState<CaseUserActionsState>(
+    initialData
+  );
+
+  const [, dispatchToaster] = useStateToaster();
+
+  const fetchCaseUserActions = useCallback(
+    (thisCaseId: string) => {
+      let didCancel = false;
+      const abortCtrl = new AbortController();
+      const fetchData = async () => {
+        setCaseUserActionsState({
+          ...caseUserActionsState,
+          isLoading: true,
+        });
+        try {
+          const response = await getCaseUserActions(thisCaseId, abortCtrl.signal);
+          if (!didCancel) {
+            // Attention Future developer
+            // We are removing the first item because it will always be the creation of the case
+            // and we do not want it to simplify our life
+            const participants = !isEmpty(response)
+              ? uniqBy('actionBy.username', response).map(cau => cau.actionBy)
+              : [];
+            const caseUserActions = !isEmpty(response) ? response.slice(1) : [];
+            setCaseUserActionsState({
+              caseUserActions,
+              ...getPushedInfo(caseUserActions),
+              isLoading: false,
+              isError: false,
+              participants,
+            });
+          }
+        } catch (error) {
+          if (!didCancel) {
+            errorToToaster({
+              title: i18n.ERROR_TITLE,
+              error: error.body && error.body.message ? new Error(error.body.message) : error,
+              dispatchToaster,
+            });
+            setCaseUserActionsState({
+              caseUserActions: [],
+              firstIndexPushToService: -1,
+              lastIndexPushToService: -1,
+              hasDataToPush: false,
+              isLoading: false,
+              isError: true,
+              participants: [],
+            });
+          }
+        }
+      };
+      fetchData();
+      return () => {
+        didCancel = true;
+        abortCtrl.abort();
+      };
+    },
+    [caseUserActionsState]
+  );
+
+  useEffect(() => {
+    if (!isEmpty(caseId)) {
+      fetchCaseUserActions(caseId);
+    }
+  }, [caseId]);
+  return { ...caseUserActionsState, fetchCaseUserActions };
+};
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/use_get_cases.tsx b/x-pack/legacy/plugins/siem/public/containers/case/use_get_cases.tsx
index 6c4a6ac4fe58a..ae7b8f3c043fa 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/use_get_cases.tsx
+++ b/x-pack/legacy/plugins/siem/public/containers/case/use_get_cases.tsx
@@ -88,6 +88,20 @@ const dataFetchReducer = (state: UseGetCasesState, action: Action): UseGetCasesS
   }
 };
 
+export const DEFAULT_FILTER_OPTIONS: FilterOptions = {
+  search: '',
+  reporters: [],
+  status: 'open',
+  tags: [],
+};
+
+export const DEFAULT_QUERY_PARAMS: QueryParams = {
+  page: DEFAULT_TABLE_ACTIVE_PAGE,
+  perPage: DEFAULT_TABLE_LIMIT,
+  sortField: SortFieldCase.createdAt,
+  sortOrder: 'desc',
+};
+
 const initialData: AllCases = {
   cases: [],
   countClosedCases: null,
@@ -109,23 +123,14 @@ interface UseGetCases extends UseGetCasesState {
   setQueryParams: (queryParams: QueryParams) => void;
   setSelectedCases: (mySelectedCases: Case[]) => void;
 }
-export const useGetCases = (): UseGetCases => {
+
+export const useGetCases = (initialQueryParams?: QueryParams): UseGetCases => {
   const [state, dispatch] = useReducer(dataFetchReducer, {
     data: initialData,
-    filterOptions: {
-      search: '',
-      reporters: [],
-      status: 'open',
-      tags: [],
-    },
+    filterOptions: DEFAULT_FILTER_OPTIONS,
     isError: false,
     loading: [],
-    queryParams: {
-      page: DEFAULT_TABLE_ACTIVE_PAGE,
-      perPage: DEFAULT_TABLE_LIMIT,
-      sortField: SortFieldCase.createdAt,
-      sortOrder: 'desc',
-    },
+    queryParams: initialQueryParams ?? DEFAULT_QUERY_PARAMS,
     selectedCases: [],
   });
   const [, dispatchToaster] = useStateToaster();
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/use_post_push_to_service.tsx b/x-pack/legacy/plugins/siem/public/containers/case/use_post_push_to_service.tsx
new file mode 100644
index 0000000000000..b6fb15f4fa083
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/containers/case/use_post_push_to_service.tsx
@@ -0,0 +1,183 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useReducer, useCallback } from 'react';
+
+import {
+  ServiceConnectorCaseResponse,
+  ServiceConnectorCaseParams,
+} from '../../../../../../plugins/case/common/api';
+import { errorToToaster, useStateToaster, displaySuccessToast } from '../../components/toasters';
+
+import { getCase, pushToService, pushCase } from './api';
+import * as i18n from './translations';
+import { Case } from './types';
+
+interface PushToServiceState {
+  serviceData: ServiceConnectorCaseResponse | null;
+  pushedCaseData: Case | null;
+  isLoading: boolean;
+  isError: boolean;
+}
+type Action =
+  | { type: 'FETCH_INIT' }
+  | { type: 'FETCH_SUCCESS_PUSH_SERVICE'; payload: ServiceConnectorCaseResponse | null }
+  | { type: 'FETCH_SUCCESS_PUSH_CASE'; payload: Case | null }
+  | { type: 'FETCH_FAILURE' };
+
+const dataFetchReducer = (state: PushToServiceState, action: Action): PushToServiceState => {
+  switch (action.type) {
+    case 'FETCH_INIT':
+      return {
+        ...state,
+        isLoading: true,
+        isError: false,
+      };
+    case 'FETCH_SUCCESS_PUSH_SERVICE':
+      return {
+        ...state,
+        isLoading: false,
+        isError: false,
+        serviceData: action.payload ?? null,
+      };
+    case 'FETCH_SUCCESS_PUSH_CASE':
+      return {
+        ...state,
+        isLoading: false,
+        isError: false,
+        pushedCaseData: action.payload ?? null,
+      };
+    case 'FETCH_FAILURE':
+      return {
+        ...state,
+        isLoading: false,
+        isError: true,
+      };
+    default:
+      return state;
+  }
+};
+
+interface PushToServiceRequest {
+  caseId: string;
+  connectorId: string;
+  connectorName: string;
+  updateCase: (newCase: Case) => void;
+}
+
+interface UsePostPushToService extends PushToServiceState {
+  postPushToService: ({ caseId, connectorId, updateCase }: PushToServiceRequest) => void;
+}
+
+export const usePostPushToService = (): UsePostPushToService => {
+  const [state, dispatch] = useReducer(dataFetchReducer, {
+    serviceData: null,
+    pushedCaseData: null,
+    isLoading: false,
+    isError: false,
+  });
+  const [, dispatchToaster] = useStateToaster();
+
+  const postPushToService = useCallback(
+    async ({ caseId, connectorId, connectorName, updateCase }: PushToServiceRequest) => {
+      let cancel = false;
+      const abortCtrl = new AbortController();
+      try {
+        dispatch({ type: 'FETCH_INIT' });
+        const casePushData = await getCase(caseId);
+        const responseService = await pushToService(
+          connectorId,
+          formatServiceRequestData(casePushData),
+          abortCtrl.signal
+        );
+        const responseCase = await pushCase(
+          caseId,
+          {
+            connector_id: connectorId,
+            connector_name: connectorName,
+            external_id: responseService.incidentId,
+            external_title: responseService.number,
+            external_url: responseService.url,
+          },
+          abortCtrl.signal
+        );
+        if (!cancel) {
+          dispatch({ type: 'FETCH_SUCCESS_PUSH_SERVICE', payload: responseService });
+          dispatch({ type: 'FETCH_SUCCESS_PUSH_CASE', payload: responseCase });
+          updateCase(responseCase);
+          displaySuccessToast(i18n.SUCCESS_SEND_TO_EXTERNAL_SERVICE, dispatchToaster);
+        }
+      } catch (error) {
+        if (!cancel) {
+          errorToToaster({
+            title: i18n.ERROR_TITLE,
+            error: error.body && error.body.message ? new Error(error.body.message) : error,
+            dispatchToaster,
+          });
+          dispatch({ type: 'FETCH_FAILURE' });
+        }
+      }
+      return () => {
+        cancel = true;
+        abortCtrl.abort();
+      };
+    },
+    []
+  );
+
+  return { ...state, postPushToService };
+};
+
+const formatServiceRequestData = (myCase: Case): ServiceConnectorCaseParams => {
+  const {
+    id: caseId,
+    createdAt,
+    createdBy,
+    comments,
+    description,
+    externalService,
+    title,
+    updatedAt,
+    updatedBy,
+  } = myCase;
+
+  return {
+    caseId,
+    createdAt,
+    createdBy: {
+      fullName: createdBy.fullName ?? null,
+      username: createdBy?.username,
+    },
+    comments: comments.map(c => ({
+      commentId: c.id,
+      comment: c.comment,
+      createdAt: c.createdAt,
+      createdBy: {
+        fullName: c.createdBy.fullName ?? null,
+        username: c.createdBy.username,
+      },
+      updatedAt: c.updatedAt,
+      updatedBy:
+        c.updatedBy != null
+          ? {
+              fullName: c.updatedBy.fullName ?? null,
+              username: c.updatedBy.username,
+            }
+          : null,
+    })),
+    description,
+    incidentId: externalService?.externalId ?? null,
+    title,
+    updatedAt,
+    updatedBy:
+      updatedBy != null
+        ? {
+            fullName: updatedBy.fullName ?? null,
+            username: updatedBy.username,
+          }
+        : null,
+  };
+};
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/use_update_case.tsx b/x-pack/legacy/plugins/siem/public/containers/case/use_update_case.tsx
index 987620469901b..f8af088f7e03b 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/use_update_case.tsx
+++ b/x-pack/legacy/plugins/siem/public/containers/case/use_update_case.tsx
@@ -25,6 +25,7 @@ interface NewCaseState {
 export interface UpdateByKey {
   updateKey: UpdateKey;
   updateValue: CaseRequest[UpdateKey];
+  fetchCaseUserActions?: (caseId: string) => void;
 }
 
 type Action =
@@ -64,6 +65,7 @@ const dataFetchReducer = (state: NewCaseState, action: Action): NewCaseState =>
 
 interface UseUpdateCase extends NewCaseState {
   updateCaseProperty: (updates: UpdateByKey) => void;
+  updateCase: (newCase: Case) => void;
 }
 export const useUpdateCase = (caseId: string, initialData: Case): UseUpdateCase => {
   const [state, dispatch] = useReducer(dataFetchReducer, {
@@ -74,8 +76,12 @@ export const useUpdateCase = (caseId: string, initialData: Case): UseUpdateCase
   });
   const [, dispatchToaster] = useStateToaster();
 
+  const updateCase = useCallback((newCase: Case) => {
+    dispatch({ type: 'FETCH_SUCCESS', payload: newCase });
+  }, []);
+
   const dispatchUpdateCaseProperty = useCallback(
-    async ({ updateKey, updateValue }: UpdateByKey) => {
+    async ({ fetchCaseUserActions, updateKey, updateValue }: UpdateByKey) => {
       let cancel = false;
       try {
         dispatch({ type: 'FETCH_INIT', payload: updateKey });
@@ -85,6 +91,9 @@ export const useUpdateCase = (caseId: string, initialData: Case): UseUpdateCase
           state.caseData.version
         );
         if (!cancel) {
+          if (fetchCaseUserActions != null) {
+            fetchCaseUserActions(caseId);
+          }
           dispatch({ type: 'FETCH_SUCCESS', payload: response[0] });
         }
       } catch (error) {
@@ -104,5 +113,5 @@ export const useUpdateCase = (caseId: string, initialData: Case): UseUpdateCase
     [state]
   );
 
-  return { ...state, updateCaseProperty: dispatchUpdateCaseProperty };
+  return { ...state, updateCase, updateCaseProperty: dispatchUpdateCaseProperty };
 };
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/use_update_comment.tsx b/x-pack/legacy/plugins/siem/public/containers/case/use_update_comment.tsx
index a40a1100ca735..c1b2bfde30126 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/use_update_comment.tsx
+++ b/x-pack/legacy/plugins/siem/public/containers/case/use_update_comment.tsx
@@ -70,8 +70,15 @@ const dataFetchReducer = (state: CommentUpdateState, action: Action): CommentUpd
   }
 };
 
+interface UpdateComment {
+  caseId: string;
+  commentId: string;
+  commentUpdate: string;
+  fetchUserActions: () => void;
+}
+
 interface UseUpdateComment extends CommentUpdateState {
-  updateComment: (caseId: string, commentId: string, commentUpdate: string) => void;
+  updateComment: ({ caseId, commentId, commentUpdate, fetchUserActions }: UpdateComment) => void;
   addPostedComment: Dispatch<Comment>;
 }
 
@@ -84,7 +91,7 @@ export const useUpdateComment = (comments: Comment[]): UseUpdateComment => {
   const [, dispatchToaster] = useStateToaster();
 
   const dispatchUpdateComment = useCallback(
-    async (caseId: string, commentId: string, commentUpdate: string) => {
+    async ({ caseId, commentId, commentUpdate, fetchUserActions }: UpdateComment) => {
       let cancel = false;
       try {
         dispatch({ type: 'FETCH_INIT', payload: commentId });
@@ -98,6 +105,7 @@ export const useUpdateComment = (comments: Comment[]): UseUpdateComment => {
           currentComment.version
         );
         if (!cancel) {
+          fetchUserActions();
           dispatch({ type: 'FETCH_SUCCESS', payload: { update: response, commentId } });
         }
       } catch (error) {
diff --git a/x-pack/legacy/plugins/siem/public/containers/case/utils.ts b/x-pack/legacy/plugins/siem/public/containers/case/utils.ts
index 8f24d5a435240..ce23ac6c440b6 100644
--- a/x-pack/legacy/plugins/siem/public/containers/case/utils.ts
+++ b/x-pack/legacy/plugins/siem/public/containers/case/utils.ts
@@ -23,6 +23,10 @@ import {
   CommentResponseRt,
   CasesConfigureResponse,
   CaseConfigureResponseRt,
+  CaseUserActionsResponse,
+  CaseUserActionsResponseRt,
+  ServiceConnectorCaseResponseRt,
+  ServiceConnectorCaseResponse,
 } from '../../../../../../plugins/case/common/api';
 import { ToasterError } from '../../components/toasters';
 import { AllCases, Case } from './types';
@@ -86,3 +90,15 @@ export const decodeCaseConfigureResponse = (respCase?: CasesConfigureResponse) =
     CaseConfigureResponseRt.decode(respCase),
     fold(throwErrors(createToasterPlainError), identity)
   );
+
+export const decodeCaseUserActionsResponse = (respUserActions?: CaseUserActionsResponse) =>
+  pipe(
+    CaseUserActionsResponseRt.decode(respUserActions),
+    fold(throwErrors(createToasterPlainError), identity)
+  );
+
+export const decodeServiceConnectorCaseResponse = (respPushCase?: ServiceConnectorCaseResponse) =>
+  pipe(
+    ServiceConnectorCaseResponseRt.decode(respPushCase),
+    fold(throwErrors(createToasterPlainError), identity)
+  );
diff --git a/x-pack/legacy/plugins/siem/public/containers/tls/index.gql_query.ts b/x-pack/legacy/plugins/siem/public/containers/tls/index.gql_query.ts
index bbb92282bee83..f513a94d69667 100644
--- a/x-pack/legacy/plugins/siem/public/containers/tls/index.gql_query.ts
+++ b/x-pack/legacy/plugins/siem/public/containers/tls/index.gql_query.ts
@@ -33,10 +33,9 @@ export const tlsQuery = gql`
         edges {
           node {
             _id
-            alternativeNames
-            commonNames
+            subjects
             ja3
-            issuerNames
+            issuers
             notAfter
           }
           cursor {
diff --git a/x-pack/legacy/plugins/siem/public/graphql/introspection.json b/x-pack/legacy/plugins/siem/public/graphql/introspection.json
index 9802a5f5bd3bf..5d43024625d0d 100644
--- a/x-pack/legacy/plugins/siem/public/graphql/introspection.json
+++ b/x-pack/legacy/plugins/siem/public/graphql/introspection.json
@@ -9213,22 +9213,6 @@
             "isDeprecated": false,
             "deprecationReason": null
           },
-          {
-            "name": "alternativeNames",
-            "description": "",
-            "args": [],
-            "type": {
-              "kind": "LIST",
-              "name": null,
-              "ofType": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": { "kind": "SCALAR", "name": "String", "ofType": null }
-              }
-            },
-            "isDeprecated": false,
-            "deprecationReason": null
-          },
           {
             "name": "notAfter",
             "description": "",
@@ -9246,7 +9230,7 @@
             "deprecationReason": null
           },
           {
-            "name": "commonNames",
+            "name": "subjects",
             "description": "",
             "args": [],
             "type": {
@@ -9278,7 +9262,7 @@
             "deprecationReason": null
           },
           {
-            "name": "issuerNames",
+            "name": "issuers",
             "description": "",
             "args": [],
             "type": {
diff --git a/x-pack/legacy/plugins/siem/public/graphql/types.ts b/x-pack/legacy/plugins/siem/public/graphql/types.ts
index 3528ee6e13a38..a5d1e3fbcba27 100644
--- a/x-pack/legacy/plugins/siem/public/graphql/types.ts
+++ b/x-pack/legacy/plugins/siem/public/graphql/types.ts
@@ -1859,15 +1859,13 @@ export interface TlsNode {
 
   timestamp?: Maybe<string>;
 
-  alternativeNames?: Maybe<string[]>;
-
   notAfter?: Maybe<string[]>;
 
-  commonNames?: Maybe<string[]>;
+  subjects?: Maybe<string[]>;
 
   ja3?: Maybe<string[]>;
 
-  issuerNames?: Maybe<string[]>;
+  issuers?: Maybe<string[]>;
 }
 
 export interface UncommonProcessesData {
@@ -5679,13 +5677,11 @@ export namespace GetTlsQuery {
 
     _id: Maybe<string>;
 
-    alternativeNames: Maybe<string[]>;
-
-    commonNames: Maybe<string[]>;
+    subjects: Maybe<string[]>;
 
     ja3: Maybe<string[]>;
 
-    issuerNames: Maybe<string[]>;
+    issuers: Maybe<string[]>;
 
     notAfter: Maybe<string[]>;
   };
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/add_comment/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/add_comment/index.tsx
index 0b3b0daaf4bbc..836595c7c45d9 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/add_comment/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/add_comment/index.tsx
@@ -30,72 +30,79 @@ const initialCommentValue: CommentRequest = {
 
 interface AddCommentProps {
   caseId: string;
+  onCommentSaving?: () => void;
   onCommentPosted: (commentResponse: Comment) => void;
+  showLoading?: boolean;
 }
 
-export const AddComment = React.memo<AddCommentProps>(({ caseId, onCommentPosted }) => {
-  const { commentData, isLoading, postComment, resetCommentData } = usePostComment(caseId);
-  const { form } = useForm<CommentRequest>({
-    defaultValue: initialCommentValue,
-    options: { stripEmptyFields: false },
-    schema,
-  });
-  const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline<CommentRequest>(
-    form,
-    'comment'
-  );
+export const AddComment = React.memo<AddCommentProps>(
+  ({ caseId, showLoading = true, onCommentPosted, onCommentSaving }) => {
+    const { commentData, isLoading, postComment, resetCommentData } = usePostComment(caseId);
+    const { form } = useForm<CommentRequest>({
+      defaultValue: initialCommentValue,
+      options: { stripEmptyFields: false },
+      schema,
+    });
+    const { handleCursorChange, handleOnTimelineChange } = useInsertTimeline<CommentRequest>(
+      form,
+      'comment'
+    );
 
-  useEffect(() => {
-    if (commentData !== null) {
-      onCommentPosted(commentData);
-      form.reset();
-      resetCommentData();
-    }
-  }, [commentData]);
+    useEffect(() => {
+      if (commentData !== null) {
+        onCommentPosted(commentData);
+        form.reset();
+        resetCommentData();
+      }
+    }, [commentData]);
 
-  const onSubmit = useCallback(async () => {
-    const { isValid, data } = await form.submit();
-    if (isValid) {
-      await postComment(data);
-    }
-  }, [form]);
+    const onSubmit = useCallback(async () => {
+      const { isValid, data } = await form.submit();
+      if (isValid) {
+        if (onCommentSaving != null) {
+          onCommentSaving();
+        }
+        await postComment(data);
+      }
+    }, [form]);
 
-  return (
-    <>
-      {isLoading && <MySpinner size="xl" />}
-      <Form form={form}>
-        <UseField
-          path="comment"
-          component={MarkdownEditorForm}
-          componentProps={{
-            idAria: 'caseComment',
-            isDisabled: isLoading,
-            dataTestSubj: 'caseComment',
-            placeholder: i18n.ADD_COMMENT_HELP_TEXT,
-            onCursorPositionUpdate: handleCursorChange,
-            bottomRightContent: (
-              <EuiButton
-                iconType="plusInCircle"
-                isDisabled={isLoading}
-                isLoading={isLoading}
-                onClick={onSubmit}
-                size="s"
-              >
-                {i18n.ADD_COMMENT}
-              </EuiButton>
-            ),
-            topRightContent: (
-              <InsertTimelinePopover
-                hideUntitled={true}
-                isDisabled={isLoading}
-                onTimelineChange={handleOnTimelineChange}
-              />
-            ),
-          }}
-        />
-      </Form>
-    </>
-  );
-});
+    return (
+      <>
+        {isLoading && showLoading && <MySpinner size="xl" />}
+        <Form form={form}>
+          <UseField
+            path="comment"
+            component={MarkdownEditorForm}
+            componentProps={{
+              idAria: 'caseComment',
+              isDisabled: isLoading,
+              dataTestSubj: 'caseComment',
+              placeholder: i18n.ADD_COMMENT_HELP_TEXT,
+              onCursorPositionUpdate: handleCursorChange,
+              bottomRightContent: (
+                <EuiButton
+                  iconType="plusInCircle"
+                  isDisabled={isLoading}
+                  isLoading={isLoading}
+                  onClick={onSubmit}
+                  size="s"
+                >
+                  {i18n.ADD_COMMENT}
+                </EuiButton>
+              ),
+              topRightContent: (
+                <InsertTimelinePopover
+                  hideUntitled={true}
+                  isDisabled={isLoading}
+                  onTimelineChange={handleOnTimelineChange}
+                />
+              ),
+            }}
+          />
+        </Form>
+      </>
+    );
+  }
+);
 
 AddComment.displayName = 'AddComment';
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/__mock__/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/__mock__/index.tsx
index 48fbb4e74c407..d4ec32dfd070b 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/__mock__/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/__mock__/index.tsx
@@ -18,12 +18,13 @@ export const useGetCasesMockState: UseGetCasesState = {
         id: '3c4ddcc0-4e99-11ea-9290-35d05cb55c15',
         createdAt: '2020-02-13T19:44:23.627Z',
         createdBy: { username: 'elastic' },
-        commentIds: [],
         comments: [],
         description: 'Security banana Issue',
+        externalService: null,
         status: 'open',
         tags: ['defacement'],
         title: 'Another horrible breach',
+        totalComment: 0,
         updatedAt: null,
         updatedBy: null,
         version: 'WzQ3LDFd',
@@ -34,12 +35,13 @@ export const useGetCasesMockState: UseGetCasesState = {
         id: '362a5c10-4e99-11ea-9290-35d05cb55c15',
         createdAt: '2020-02-13T19:44:13.328Z',
         createdBy: { username: 'elastic' },
-        commentIds: [],
         comments: [],
         description: 'Security banana Issue',
+        externalService: null,
         status: 'open',
         tags: ['phishing'],
         title: 'Bad email',
+        totalComment: 0,
         updatedAt: null,
         updatedBy: null,
         version: 'WzQ3LDFd',
@@ -50,12 +52,13 @@ export const useGetCasesMockState: UseGetCasesState = {
         id: '34f8b9e0-4e99-11ea-9290-35d05cb55c15',
         createdAt: '2020-02-13T19:44:11.328Z',
         createdBy: { username: 'elastic' },
-        commentIds: [],
         comments: [],
         description: 'Security banana Issue',
+        externalService: null,
         status: 'open',
         tags: ['phishing'],
         title: 'Bad email',
+        totalComment: 0,
         updatedAt: null,
         updatedBy: null,
         version: 'WzQ3LDFd',
@@ -66,14 +69,15 @@ export const useGetCasesMockState: UseGetCasesState = {
         id: '31890e90-4e99-11ea-9290-35d05cb55c15',
         createdAt: '2020-02-13T19:44:05.563Z',
         createdBy: { username: 'elastic' },
-        commentIds: [],
         comments: [],
         description: 'Security banana Issue',
+        externalService: null,
         status: 'closed',
         tags: ['phishing'],
         title: 'Uh oh',
-        updatedAt: '2020-02-13T19:44:13.328Z',
-        updatedBy: { username: 'elastic' },
+        totalComment: 0,
+        updatedAt: null,
+        updatedBy: null,
         version: 'WzQ3LDFd',
       },
       {
@@ -82,12 +86,13 @@ export const useGetCasesMockState: UseGetCasesState = {
         id: '2f5b3210-4e99-11ea-9290-35d05cb55c15',
         createdAt: '2020-02-13T19:44:01.901Z',
         createdBy: { username: 'elastic' },
-        commentIds: [],
         comments: [],
         description: 'Security banana Issue',
+        externalService: null,
         status: 'open',
         tags: ['phishing'],
         title: 'Uh oh',
+        totalComment: 0,
         updatedAt: null,
         updatedBy: null,
         version: 'WzQ3LDFd',
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/actions.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/actions.tsx
index 6253d431f8401..93536077f3a4c 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/actions.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/actions.tsx
@@ -32,7 +32,7 @@ export const getActions = ({
   caseStatus === 'open'
     ? {
         description: i18n.CLOSE_CASE,
-        icon: 'magnet',
+        icon: 'folderCheck',
         name: i18n.CLOSE_CASE,
         onClick: (theCase: Case) =>
           dispatchUpdate({
@@ -46,7 +46,7 @@ export const getActions = ({
       }
     : {
         description: i18n.REOPEN_CASE,
-        icon: 'magnet',
+        icon: 'folderExclamation',
         name: i18n.REOPEN_CASE,
         onClick: (theCase: Case) =>
           dispatchUpdate({
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/columns.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/columns.tsx
index b9e1113c486ad..32a29483e9c75 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/columns.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/columns.tsx
@@ -35,6 +35,7 @@ const Spacer = styled.span`
 
 const renderStringField = (field: string, dataTestSubj: string) =>
   field != null ? <span data-test-subj={dataTestSubj}>{field}</span> : getEmptyTagValue();
+
 export const getCasesColumns = (
   actions: Array<DefaultItemIconButtonAction<Case>>,
   filterStatus: string
@@ -108,11 +109,11 @@ export const getCasesColumns = (
   },
   {
     align: 'right',
-    field: 'commentIds',
+    field: 'totalComment',
     name: i18n.COMMENTS,
     sortable: true,
-    render: (comments: Case['commentIds']) =>
-      renderStringField(`${comments.length}`, `case-table-column-commentCount`),
+    render: (totalComment: Case['totalComment']) =>
+      renderStringField(`${totalComment}`, `case-table-column-commentCount`),
   },
   filterStatus === 'open'
     ? {
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/index.test.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/index.test.tsx
index 13869c79c45fd..bdcb87b483851 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/index.test.tsx
@@ -95,7 +95,9 @@ describe('AllCases', () => {
         .find(`a[data-test-subj="case-details-link"]`)
         .first()
         .prop('href')
-    ).toEqual(`#/link-to/case/${useGetCasesMockState.data.cases[0].id}`);
+    ).toEqual(
+      `#/link-to/case/${useGetCasesMockState.data.cases[0].id}?timerange=(global:(linkTo:!(timeline),timerange:(from:0,fromStr:now-24h,kind:relative,to:1,toStr:now)),timeline:(linkTo:!(global),timerange:(from:0,fromStr:now-24h,kind:relative,to:1,toStr:now)))`
+    );
     expect(
       wrapper
         .find(`a[data-test-subj="case-details-link"]`)
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/index.tsx
index e7e1e624ccba2..cbb9ddae22d04 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/all_cases/index.tsx
@@ -26,6 +26,7 @@ import { useGetCases, UpdateCase } from '../../../../containers/case/use_get_cas
 import { useGetCasesStatus } from '../../../../containers/case/use_get_cases_status';
 import { useDeleteCases } from '../../../../containers/case/use_delete_cases';
 import { EuiBasicTableOnChange } from '../../../detection_engine/rules/types';
+import { useGetUrlSearch } from '../../../../components/navigation/use_get_url_search';
 import { Panel } from '../../../../components/panel';
 import {
   UtilityBar,
@@ -35,19 +36,16 @@ import {
   UtilityBarText,
 } from '../../../../components/utility_bar';
 import { getConfigureCasesUrl, getCreateCaseUrl } from '../../../../components/link_to';
-
 import { getBulkItems } from '../bulk_actions';
 import { CaseHeaderPage } from '../case_header_page';
 import { ConfirmDeleteCaseModal } from '../confirm_delete_case';
 import { OpenClosedStats } from '../open_closed_stats';
+import { navTabs } from '../../../home/home_navigations';
 
 import { getActions } from './actions';
 import { CasesTableFilters } from './table_filters';
 import { useUpdateCases } from '../../../../containers/case/use_bulk_update_case';
 
-const CONFIGURE_CASES_URL = getConfigureCasesUrl();
-const CREATE_CASE_URL = getCreateCaseUrl();
-
 const Div = styled.div`
   margin-top: ${({ theme }) => theme.eui.paddingSizes.m};
 `;
@@ -78,6 +76,8 @@ const getSortField = (field: string): SortFieldCase => {
   return SortFieldCase.createdAt;
 };
 export const AllCases = React.memo(() => {
+  const urlSearch = useGetUrlSearch(navTabs.case);
+
   const {
     countClosedCases,
     countOpenCases,
@@ -276,12 +276,12 @@ export const AllCases = React.memo(() => {
             />
           </FlexItemDivider>
           <EuiFlexItem grow={false}>
-            <EuiButton href={CONFIGURE_CASES_URL} iconType="controlsHorizontal">
+            <EuiButton href={getConfigureCasesUrl(urlSearch)} iconType="controlsHorizontal">
               {i18n.CONFIGURE_CASES_BUTTON}
             </EuiButton>
           </EuiFlexItem>
           <EuiFlexItem grow={false}>
-            <EuiButton fill href={CREATE_CASE_URL} iconType="plusInCircle">
+            <EuiButton fill href={getCreateCaseUrl(urlSearch)} iconType="plusInCircle">
               {i18n.CREATE_TITLE}
             </EuiButton>
           </EuiFlexItem>
@@ -342,7 +342,12 @@ export const AllCases = React.memo(() => {
                   titleSize="xs"
                   body={i18n.NO_CASES_BODY}
                   actions={
-                    <EuiButton fill size="s" href={CREATE_CASE_URL} iconType="plusInCircle">
+                    <EuiButton
+                      fill
+                      size="s"
+                      href={getCreateCaseUrl(urlSearch)}
+                      iconType="plusInCircle"
+                    >
                       {i18n.ADD_NEW_CASE}
                     </EuiButton>
                   }
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/bulk_actions/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/bulk_actions/index.tsx
index b9da834b929ea..74a255bf5ad49 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/bulk_actions/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/bulk_actions/index.tsx
@@ -27,8 +27,9 @@ export const getBulkItems = ({
     caseStatus === 'open' ? (
       <EuiContextMenuItem
         data-test-subj="cases-bulk-close-button"
+        disabled={selectedCaseIds.length === 0}
         key={i18n.BULK_ACTION_CLOSE_SELECTED}
-        icon="magnet"
+        icon="folderCheck"
         onClick={() => {
           closePopover();
           updateCaseStatus('closed');
@@ -39,8 +40,9 @@ export const getBulkItems = ({
     ) : (
       <EuiContextMenuItem
         data-test-subj="cases-bulk-open-button"
+        disabled={selectedCaseIds.length === 0}
         key={i18n.BULK_ACTION_OPEN_SELECTED}
-        icon="magnet"
+        icon="folderExclamation"
         onClick={() => {
           closePopover();
           updateCaseStatus('open');
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/case_status/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/case_status/index.tsx
index 9dbd71ea3e34c..0420a71fea907 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/case_status/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/case_status/index.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useCallback } from 'react';
+import React from 'react';
 import styled, { css } from 'styled-components';
 import {
   EuiBadge,
@@ -39,7 +39,7 @@ interface CaseStatusProps {
   isSelected: boolean;
   status: string;
   title: string;
-  toggleStatusCase: (status: string) => void;
+  toggleStatusCase: (evt: unknown) => void;
   value: string | null;
 }
 const CaseStatusComp: React.FC<CaseStatusProps> = ({
@@ -55,51 +55,46 @@ const CaseStatusComp: React.FC<CaseStatusProps> = ({
   title,
   toggleStatusCase,
   value,
-}) => {
-  const onChange = useCallback(e => toggleStatusCase(e.target.checked ? 'closed' : 'open'), [
-    toggleStatusCase,
-  ]);
-  return (
-    <EuiFlexGroup gutterSize="l" justifyContent="flexEnd">
-      <EuiFlexItem grow={false}>
-        <MyDescriptionList compressed>
-          <EuiFlexGroup>
-            <EuiFlexItem grow={false}>
-              <EuiDescriptionListTitle>{i18n.STATUS}</EuiDescriptionListTitle>
-              <EuiDescriptionListDescription>
-                <EuiBadge color={badgeColor} data-test-subj="case-view-status">
-                  {status}
-                </EuiBadge>
-              </EuiDescriptionListDescription>
-            </EuiFlexItem>
-            <EuiFlexItem>
-              <EuiDescriptionListTitle>{title}</EuiDescriptionListTitle>
-              <EuiDescriptionListDescription>
-                <FormattedRelativePreferenceDate data-test-subj={dataTestSubj} value={value} />
-              </EuiDescriptionListDescription>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </MyDescriptionList>
-      </EuiFlexItem>
-      <EuiFlexItem grow={false}>
-        <EuiFlexGroup gutterSize="l" alignItems="center">
-          <EuiFlexItem>
-            <EuiButtonToggle
-              data-test-subj="toggle-case-status"
-              iconType={icon}
-              isLoading={isLoading}
-              isSelected={isSelected}
-              label={buttonLabel}
-              onChange={onChange}
-            />
-          </EuiFlexItem>
+}) => (
+  <EuiFlexGroup gutterSize="l" justifyContent="flexEnd">
+    <EuiFlexItem grow={false}>
+      <MyDescriptionList compressed>
+        <EuiFlexGroup>
           <EuiFlexItem grow={false}>
-            <CaseViewActions caseId={caseId} caseTitle={caseTitle} />
+            <EuiDescriptionListTitle>{i18n.STATUS}</EuiDescriptionListTitle>
+            <EuiDescriptionListDescription>
+              <EuiBadge color={badgeColor} data-test-subj="case-view-status">
+                {status}
+              </EuiBadge>
+            </EuiDescriptionListDescription>
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <EuiDescriptionListTitle>{title}</EuiDescriptionListTitle>
+            <EuiDescriptionListDescription>
+              <FormattedRelativePreferenceDate data-test-subj={dataTestSubj} value={value} />
+            </EuiDescriptionListDescription>
           </EuiFlexItem>
         </EuiFlexGroup>
-      </EuiFlexItem>
-    </EuiFlexGroup>
-  );
-};
+      </MyDescriptionList>
+    </EuiFlexItem>
+    <EuiFlexItem grow={false}>
+      <EuiFlexGroup gutterSize="l" alignItems="center">
+        <EuiFlexItem>
+          <EuiButtonToggle
+            data-test-subj="toggle-case-status"
+            iconType={icon}
+            isLoading={isLoading}
+            isSelected={isSelected}
+            label={buttonLabel}
+            onChange={toggleStatusCase}
+          />
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <CaseViewActions caseId={caseId} caseTitle={caseTitle} />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiFlexItem>
+  </EuiFlexGroup>
+);
 
 export const CaseStatus = React.memo(CaseStatusComp);
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/__mock__/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/__mock__/index.tsx
index e11441eac3a9d..7aadea1a453a7 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/__mock__/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/__mock__/index.tsx
@@ -13,7 +13,6 @@ export const caseProps: CaseProps = {
     closedAt: null,
     closedBy: null,
     id: '3c4ddcc0-4e99-11ea-9290-35d05cb55c15',
-    commentIds: ['a357c6a0-5435-11ea-b427-fb51a1fcb7b8'],
     comments: [
       {
         comment: 'Solve this fast!',
@@ -24,6 +23,8 @@ export const caseProps: CaseProps = {
           username: 'smilovic',
           email: 'notmyrealemailfool@elastic.co',
         },
+        pushedAt: null,
+        pushedBy: null,
         updatedAt: '2020-02-20T23:06:33.798Z',
         updatedBy: {
           username: 'elastic',
@@ -34,9 +35,11 @@ export const caseProps: CaseProps = {
     createdAt: '2020-02-13T19:44:23.627Z',
     createdBy: { fullName: null, email: 'testemail@elastic.co', username: 'elastic' },
     description: 'Security banana Issue',
+    externalService: null,
     status: 'open',
     tags: ['defacement'],
     title: 'Another horrible breach!!',
+    totalComment: 1,
     updatedAt: '2020-02-19T15:02:57.995Z',
     updatedBy: {
       username: 'elastic',
@@ -44,6 +47,7 @@ export const caseProps: CaseProps = {
     version: 'WzQ3LDFd',
   },
 };
+
 export const caseClosedProps: CaseProps = {
   ...caseProps,
   initialData: {
@@ -63,3 +67,21 @@ export const data: Case = {
 export const dataClosed: Case = {
   ...caseClosedProps.initialData,
 };
+
+export const caseUserActions = [
+  {
+    actionField: ['comment'],
+    action: 'create',
+    actionAt: '2020-03-20T17:10:09.814Z',
+    actionBy: {
+      fullName: 'Steph Milovic',
+      username: 'smilovic',
+      email: 'notmyrealemailfool@elastic.co',
+    },
+    newValue: 'Solve this fast!',
+    oldValue: null,
+    actionId: '3c4ddcc0-4e99-11ea-9290-35d05cb55c15',
+    caseId: '9b833a50-6acd-11ea-8fad-af86b1071bd9',
+    commentId: 'a357c6a0-5435-11ea-b427-fb51a1fcb7b8',
+  },
+];
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/index.test.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/index.test.tsx
index 41100ec6d50f1..18cc33d8a6d4d 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/index.test.tsx
@@ -7,12 +7,22 @@
 import React from 'react';
 import { Router } from 'react-router-dom';
 import { mount } from 'enzyme';
+/* eslint-disable @kbn/eslint/module_migration */
+import routeData from 'react-router';
+/* eslint-enable @kbn/eslint/module_migration */
 import { CaseComponent } from './';
-import { caseProps, caseClosedProps, data, dataClosed } from './__mock__';
+import { caseProps, caseClosedProps, data, dataClosed, caseUserActions } from './__mock__';
 import { TestProviders } from '../../../../mock';
 import { useUpdateCase } from '../../../../containers/case/use_update_case';
+import { useGetCaseUserActions } from '../../../../containers/case/use_get_case_user_actions';
+import { wait } from '../../../../lib/helpers';
+import { usePushToService } from './push_to_service';
 jest.mock('../../../../containers/case/use_update_case');
+jest.mock('../../../../containers/case/use_get_case_user_actions');
+jest.mock('./push_to_service');
 const useUpdateCaseMock = useUpdateCase as jest.Mock;
+const useGetCaseUserActionsMock = useGetCaseUserActions as jest.Mock;
+const usePushToServiceMock = usePushToService as jest.Mock;
 type Action = 'PUSH' | 'POP' | 'REPLACE';
 const pop: Action = 'POP';
 const location = {
@@ -35,8 +45,16 @@ const mockHistory = {
   listen: jest.fn(),
 };
 
+const mockLocation = {
+  pathname: '/welcome',
+  hash: '',
+  search: '',
+  state: '',
+};
+
 describe('CaseView ', () => {
   const updateCaseProperty = jest.fn();
+  const fetchCaseUserActions = jest.fn();
   /* eslint-disable no-console */
   // Silence until enzyme fixed to use ReactTestUtils.act()
   const originalError = console.error;
@@ -56,12 +74,31 @@ describe('CaseView ', () => {
     updateCaseProperty,
   };
 
+  const defaultUseGetCaseUserActions = {
+    caseUserActions,
+    fetchCaseUserActions,
+    firstIndexPushToService: -1,
+    hasDataToPush: false,
+    isLoading: false,
+    isError: false,
+    lastIndexPushToService: -1,
+    participants: [data.createdBy],
+  };
+
+  const defaultUsePushToServiceMock = {
+    pushButton: <>{'Hello Button'}</>,
+    pushCallouts: null,
+  };
+
   beforeEach(() => {
     jest.resetAllMocks();
     useUpdateCaseMock.mockImplementation(() => defaultUpdateCaseState);
+    jest.spyOn(routeData, 'useLocation').mockReturnValue(mockLocation);
+    useGetCaseUserActionsMock.mockImplementation(() => defaultUseGetCaseUserActions);
+    usePushToServiceMock.mockImplementation(() => defaultUsePushToServiceMock);
   });
 
-  it('should render CaseComponent', () => {
+  it('should render CaseComponent', async () => {
     const wrapper = mount(
       <TestProviders>
         <Router history={mockHistory}>
@@ -69,6 +106,7 @@ describe('CaseView ', () => {
         </Router>
       </TestProviders>
     );
+    await wait();
     expect(
       wrapper
         .find(`[data-test-subj="case-view-title"]`)
@@ -108,7 +146,7 @@ describe('CaseView ', () => {
     ).toEqual(data.description);
   });
 
-  it('should show closed indicators in header when case is closed', () => {
+  it('should show closed indicators in header when case is closed', async () => {
     useUpdateCaseMock.mockImplementation(() => ({
       ...defaultUpdateCaseState,
       caseData: dataClosed,
@@ -120,6 +158,7 @@ describe('CaseView ', () => {
         </Router>
       </TestProviders>
     );
+    await wait();
     expect(wrapper.contains(`[data-test-subj="case-view-createdAt"]`)).toBe(false);
     expect(
       wrapper
@@ -135,7 +174,7 @@ describe('CaseView ', () => {
     ).toEqual(dataClosed.status);
   });
 
-  it('should dispatch update state when button is toggled', () => {
+  it('should dispatch update state when button is toggled', async () => {
     const wrapper = mount(
       <TestProviders>
         <Router history={mockHistory}>
@@ -143,18 +182,19 @@ describe('CaseView ', () => {
         </Router>
       </TestProviders>
     );
-
+    await wait();
     wrapper
       .find('input[data-test-subj="toggle-case-status"]')
       .simulate('change', { target: { checked: true } });
 
     expect(updateCaseProperty).toBeCalledWith({
+      fetchCaseUserActions,
       updateKey: 'status',
       updateValue: 'closed',
     });
   });
 
-  it('should render comments', () => {
+  it('should render comments', async () => {
     const wrapper = mount(
       <TestProviders>
         <Router history={mockHistory}>
@@ -162,6 +202,7 @@ describe('CaseView ', () => {
         </Router>
       </TestProviders>
     );
+    await wait();
     expect(
       wrapper
         .find(
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/index.tsx
index 08af603cb0dbf..5c20b53f5fcb9 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/index.tsx
@@ -4,10 +4,17 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useCallback, useMemo } from 'react';
-import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui';
-
+import {
+  EuiButtonToggle,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiLoadingContent,
+  EuiLoadingSpinner,
+  EuiHorizontalRule,
+} from '@elastic/eui';
+import React, { useCallback, useEffect, useMemo, useState } from 'react';
 import styled from 'styled-components';
+
 import * as i18n from './translations';
 import { Case } from '../../../../containers/case/types';
 import { getCaseUrl } from '../../../../components/link_to';
@@ -18,12 +25,16 @@ import { useGetCase } from '../../../../containers/case/use_get_case';
 import { UserActionTree } from '../user_action_tree';
 import { UserList } from '../user_list';
 import { useUpdateCase } from '../../../../containers/case/use_update_case';
+import { useGetUrlSearch } from '../../../../components/navigation/use_get_url_search';
 import { WrapperPage } from '../../../../components/wrapper_page';
 import { getTypedPayload } from '../../../../containers/case/utils';
 import { WhitePageWrapper } from '../wrappers';
 import { useBasePath } from '../../../../lib/kibana';
 import { CaseStatus } from '../case_status';
+import { navTabs } from '../../../home/home_navigations';
 import { SpyRoute } from '../../../../utils/route/spy_routes';
+import { useGetCaseUserActions } from '../../../../containers/case/use_get_case_user_actions';
+import { usePushToService } from './push_to_service';
 
 interface Props {
   caseId: string;
@@ -37,6 +48,13 @@ const MyEuiFlexGroup = styled(EuiFlexGroup)`
   height: 100%;
 `;
 
+const MyEuiHorizontalRule = styled(EuiHorizontalRule)`
+  margin-left: 48px;
+  &.euiHorizontalRule--full {
+    width: calc(100% - 48px);
+  }
+`;
+
 export interface CaseProps {
   caseId: string;
   initialData: Case;
@@ -45,7 +63,22 @@ export interface CaseProps {
 export const CaseComponent = React.memo<CaseProps>(({ caseId, initialData }) => {
   const basePath = window.location.origin + useBasePath();
   const caseLink = `${basePath}/app/siem#/case/${caseId}`;
-  const { caseData, isLoading, updateKey, updateCaseProperty } = useUpdateCase(caseId, initialData);
+  const search = useGetUrlSearch(navTabs.case);
+
+  const [initLoadingData, setInitLoadingData] = useState(true);
+  const {
+    caseUserActions,
+    fetchCaseUserActions,
+    firstIndexPushToService,
+    hasDataToPush,
+    isLoading: isLoadingUserActions,
+    lastIndexPushToService,
+    participants,
+  } = useGetCaseUserActions(caseId);
+  const { caseData, isLoading, updateKey, updateCase, updateCaseProperty } = useUpdateCase(
+    caseId,
+    initialData
+  );
 
   // Update Fields
   const onUpdateField = useCallback(
@@ -55,6 +88,7 @@ export const CaseComponent = React.memo<CaseProps>(({ caseId, initialData }) =>
           const titleUpdate = getTypedPayload<string>(updateValue);
           if (titleUpdate.length > 0) {
             updateCaseProperty({
+              fetchCaseUserActions,
               updateKey: 'title',
               updateValue: titleUpdate,
             });
@@ -64,6 +98,7 @@ export const CaseComponent = React.memo<CaseProps>(({ caseId, initialData }) =>
           const descriptionUpdate = getTypedPayload<string>(updateValue);
           if (descriptionUpdate.length > 0) {
             updateCaseProperty({
+              fetchCaseUserActions,
               updateKey: 'description',
               updateValue: descriptionUpdate,
             });
@@ -72,6 +107,7 @@ export const CaseComponent = React.memo<CaseProps>(({ caseId, initialData }) =>
         case 'tags':
           const tagsUpdate = getTypedPayload<string[]>(updateValue);
           updateCaseProperty({
+            fetchCaseUserActions,
             updateKey: 'tags',
             updateValue: tagsUpdate,
           });
@@ -80,6 +116,7 @@ export const CaseComponent = React.memo<CaseProps>(({ caseId, initialData }) =>
           const statusUpdate = getTypedPayload<string>(updateValue);
           if (caseData.status !== updateValue) {
             updateCaseProperty({
+              fetchCaseUserActions,
               updateKey: 'status',
               updateValue: statusUpdate,
             });
@@ -88,12 +125,29 @@ export const CaseComponent = React.memo<CaseProps>(({ caseId, initialData }) =>
           return null;
       }
     },
-    [caseData.status]
+    [fetchCaseUserActions, updateCaseProperty, caseData.status]
   );
+  const handleUpdateCase = useCallback(
+    (newCase: Case) => {
+      updateCase(newCase);
+      fetchCaseUserActions(newCase.id);
+    },
+    [updateCase, fetchCaseUserActions]
+  );
+
+  const { pushButton, pushCallouts } = usePushToService({
+    caseId: caseData.id,
+    caseStatus: caseData.status,
+    isNew: caseUserActions.filter(cua => cua.action === 'push-to-service').length === 0,
+    updateCase: handleUpdateCase,
+  });
+
   const onSubmitTags = useCallback(newTags => onUpdateField('tags', newTags), [onUpdateField]);
   const onSubmitTitle = useCallback(newTitle => onUpdateField('title', newTitle), [onUpdateField]);
-  const toggleStatusCase = useCallback(status => onUpdateField('status', status), [onUpdateField]);
-
+  const toggleStatusCase = useCallback(
+    e => onUpdateField('status', e.target.checked ? 'closed' : 'open'),
+    [onUpdateField]
+  );
   const spyState = useMemo(() => ({ caseTitle: caseData.title }), [caseData.title]);
 
   const caseStatusData = useMemo(
@@ -105,17 +159,17 @@ export const CaseComponent = React.memo<CaseProps>(({ caseId, initialData }) =>
             title: i18n.CASE_OPENED,
             buttonLabel: i18n.CLOSE_CASE,
             status: caseData.status,
-            icon: 'checkInCircleFilled',
+            icon: 'folderCheck',
             badgeColor: 'secondary',
             isSelected: false,
           }
         : {
             'data-test-subj': 'case-view-closedAt',
-            value: caseData.closedAt,
+            value: caseData.closedAt ?? '',
             title: i18n.CASE_CLOSED,
             buttonLabel: i18n.REOPEN_CASE,
             status: caseData.status,
-            icon: 'magnet',
+            icon: 'folderExclamation',
             badgeColor: 'danger',
             isSelected: true,
           },
@@ -126,14 +180,21 @@ export const CaseComponent = React.memo<CaseProps>(({ caseId, initialData }) =>
       subject: i18n.EMAIL_SUBJECT(caseData.title),
       body: i18n.EMAIL_BODY(caseLink),
     }),
-    [caseData.title]
+    [caseLink, caseData.title]
   );
+
+  useEffect(() => {
+    if (initLoadingData && !isLoadingUserActions) {
+      setInitLoadingData(false);
+    }
+  }, [initLoadingData, isLoadingUserActions]);
+
   return (
     <>
       <MyWrapper>
         <HeaderPage
           backOptions={{
-            href: getCaseUrl(),
+            href: getCaseUrl(search),
             text: i18n.BACK_TO_ALL,
           }}
           data-test-subj="case-view-title"
@@ -157,21 +218,52 @@ export const CaseComponent = React.memo<CaseProps>(({ caseId, initialData }) =>
       </MyWrapper>
       <WhitePageWrapper>
         <MyWrapper>
+          {pushCallouts != null && pushCallouts}
           <EuiFlexGroup>
             <EuiFlexItem grow={6}>
-              <UserActionTree
-                data={caseData}
-                isLoadingDescription={isLoading && updateKey === 'description'}
-                onUpdateField={onUpdateField}
-              />
+              {initLoadingData && <EuiLoadingContent lines={8} />}
+              {!initLoadingData && (
+                <>
+                  <UserActionTree
+                    caseUserActions={caseUserActions}
+                    data={caseData}
+                    fetchUserActions={fetchCaseUserActions.bind(null, caseData.id)}
+                    firstIndexPushToService={firstIndexPushToService}
+                    isLoadingDescription={isLoading && updateKey === 'description'}
+                    isLoadingUserActions={isLoadingUserActions}
+                    lastIndexPushToService={lastIndexPushToService}
+                    onUpdateField={onUpdateField}
+                  />
+                  <MyEuiHorizontalRule margin="s" />
+                  <EuiFlexGroup alignItems="center" gutterSize="s" justifyContent="flexEnd">
+                    <EuiFlexItem grow={false}>
+                      <EuiButtonToggle
+                        data-test-subj={caseStatusData['data-test-subj']}
+                        iconType={caseStatusData.icon}
+                        isSelected={caseStatusData.isSelected}
+                        isLoading={isLoading && updateKey === 'status'}
+                        label={caseStatusData.buttonLabel}
+                        onChange={toggleStatusCase}
+                      />
+                    </EuiFlexItem>
+                    {hasDataToPush && <EuiFlexItem grow={false}>{pushButton}</EuiFlexItem>}
+                  </EuiFlexGroup>
+                </>
+              )}
             </EuiFlexItem>
             <EuiFlexItem grow={2}>
               <UserList
-                data-test-subj="case-view-user-list"
+                data-test-subj="case-view-user-list-reporter"
                 email={emailContent}
                 headline={i18n.REPORTER}
                 users={[caseData.createdBy]}
               />
+              <UserList
+                data-test-subj="case-view-user-list-participants"
+                email={emailContent}
+                headline={i18n.PARTICIPANTS}
+                users={participants}
+              />
               <TagList
                 data-test-subj="case-view-tag-list"
                 tags={caseData.tags}
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/push_to_service.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/push_to_service.tsx
new file mode 100644
index 0000000000000..944302c1940ee
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/push_to_service.tsx
@@ -0,0 +1,185 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiButton, EuiLink, EuiToolTip } from '@elastic/eui';
+import React, { useCallback, useState, useMemo } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+import { useCaseConfigure } from '../../../../containers/case/configure/use_configure';
+import { Case } from '../../../../containers/case/types';
+import { useGetActionLicense } from '../../../../containers/case/use_get_action_license';
+import { usePostPushToService } from '../../../../containers/case/use_post_push_to_service';
+import { getConfigureCasesUrl } from '../../../../components/link_to';
+import { useGetUrlSearch } from '../../../../components/navigation/use_get_url_search';
+import { navTabs } from '../../../home/home_navigations';
+import { ErrorsPushServiceCallOut } from '../errors_push_service_callout';
+import * as i18n from './translations';
+
+interface UsePushToService {
+  caseId: string;
+  caseStatus: string;
+  isNew: boolean;
+  updateCase: (newCase: Case) => void;
+}
+
+interface Connector {
+  connectorId: string;
+  connectorName: string;
+}
+
+interface ReturnUsePushToService {
+  pushButton: JSX.Element;
+  pushCallouts: JSX.Element | null;
+}
+
+export const usePushToService = ({
+  caseId,
+  caseStatus,
+  updateCase,
+  isNew,
+}: UsePushToService): ReturnUsePushToService => {
+  const urlSearch = useGetUrlSearch(navTabs.case);
+  const [connector, setConnector] = useState<Connector | null>(null);
+
+  const { isLoading, postPushToService } = usePostPushToService();
+
+  const handleSetConnector = useCallback((connectorId: string, connectorName?: string) => {
+    setConnector({ connectorId, connectorName: connectorName ?? '' });
+  }, []);
+
+  const { loading: loadingCaseConfigure } = useCaseConfigure({
+    setConnector: handleSetConnector,
+  });
+
+  const { isLoading: loadingLicense, actionLicense } = useGetActionLicense();
+
+  const handlePushToService = useCallback(() => {
+    if (connector != null) {
+      postPushToService({
+        caseId,
+        ...connector,
+        updateCase,
+      });
+    }
+  }, [caseId, connector, postPushToService, updateCase]);
+
+  const errorsMsg = useMemo(() => {
+    let errors: Array<{ title: string; description: JSX.Element }> = [];
+    if (actionLicense != null && !actionLicense.enabledInLicense) {
+      errors = [
+        ...errors,
+        {
+          title: i18n.PUSH_DISABLE_BY_LICENSE_TITLE,
+          description: (
+            <FormattedMessage
+              defaultMessage="To open cases in external systems, you must update your license to Platinum, start a free 30-day trial, or spin up a {link} on AWS, GCP, or Azure."
+              id="xpack.siem.case.caseView.pushToServiceDisableByLicenseDescription"
+              values={{
+                link: (
+                  <EuiLink href="https://www.elastic.co/cloud/" target="_blank">
+                    {i18n.LINK_CLOUD_DEPLOYMENT}
+                  </EuiLink>
+                ),
+              }}
+            />
+          ),
+        },
+      ];
+    }
+    if (connector == null && !loadingCaseConfigure && !loadingLicense) {
+      errors = [
+        ...errors,
+        {
+          title: i18n.PUSH_DISABLE_BY_NO_CASE_CONFIG_TITLE,
+          description: (
+            <FormattedMessage
+              defaultMessage="To open and update cases in external systems, you must configure a {link}."
+              id="xpack.siem.case.caseView.pushToServiceDisableByNoCaseConfigDescription"
+              values={{
+                link: (
+                  <EuiLink href={getConfigureCasesUrl(urlSearch)} target="_blank">
+                    {i18n.LINK_CONNECTOR_CONFIGURE}
+                  </EuiLink>
+                ),
+              }}
+            />
+          ),
+        },
+      ];
+    }
+    if (caseStatus === 'closed') {
+      errors = [
+        ...errors,
+        {
+          title: i18n.PUSH_DISABLE_BECAUSE_CASE_CLOSED_TITLE,
+          description: (
+            <FormattedMessage
+              defaultMessage="Closed cases cannot be sent to external systems. Reopen the case if you want to open or update it in an external system."
+              id="xpack.siem.case.caseView.pushToServiceDisableBecauseCaseClosedDescription"
+            />
+          ),
+        },
+      ];
+    }
+    if (actionLicense != null && !actionLicense.enabledInConfig) {
+      errors = [
+        ...errors,
+        {
+          title: i18n.PUSH_DISABLE_BY_KIBANA_CONFIG_TITLE,
+          description: (
+            <FormattedMessage
+              defaultMessage="The kibana.yml file is configured to only allow specific connectors. To enable opening a case in external systems, add .servicenow to the xpack.actions.enabledActiontypes setting. For more information, see {link}."
+              id="xpack.siem.case.caseView.pushToServiceDisableByConfigDescription"
+              values={{
+                link: (
+                  <EuiLink href="#" target="_blank">
+                    {'coming soon...'}
+                  </EuiLink>
+                ),
+              }}
+            />
+          ),
+        },
+      ];
+    }
+    return errors;
+  }, [actionLicense, caseStatus, connector, loadingCaseConfigure, loadingLicense, urlSearch]);
+
+  const pushToServiceButton = useMemo(
+    () => (
+      <EuiButton
+        fill
+        iconType="importAction"
+        onClick={handlePushToService}
+        disabled={isLoading || loadingLicense || loadingCaseConfigure || errorsMsg.length > 0}
+        isLoading={isLoading}
+      >
+        {isNew ? i18n.PUSH_SERVICENOW : i18n.UPDATE_PUSH_SERVICENOW}
+      </EuiButton>
+    ),
+    [isNew, handlePushToService, isLoading, loadingLicense, loadingCaseConfigure, errorsMsg]
+  );
+
+  const objToReturn = useMemo(
+    () => ({
+      pushButton:
+        errorsMsg.length > 0 ? (
+          <EuiToolTip
+            position="top"
+            title={errorsMsg[0].title}
+            content={<p>{errorsMsg[0].description}</p>}
+          >
+            {pushToServiceButton}
+          </EuiToolTip>
+        ) : (
+          <>{pushToServiceButton}</>
+        ),
+      pushCallouts: errorsMsg.length > 0 ? <ErrorsPushServiceCallOut errors={errorsMsg} /> : null,
+    }),
+    [errorsMsg, pushToServiceButton]
+  );
+  return objToReturn;
+};
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/translations.ts b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/translations.ts
index e5fa3bff51f85..beba80ccd934c 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/case_view/translations.ts
@@ -18,17 +18,40 @@ export const SHOWING_CASES = (actionDate: string, actionName: string, userName:
     defaultMessage: '{userName} {actionName} on {actionDate}',
   });
 
-export const ADDED_DESCRIPTION = i18n.translate(
-  'xpack.siem.case.caseView.actionLabel.addDescription',
+export const ADDED_FIELD = i18n.translate('xpack.siem.case.caseView.actionLabel.addedField', {
+  defaultMessage: 'added',
+});
+
+export const CHANGED_FIELD = i18n.translate('xpack.siem.case.caseView.actionLabel.changededField', {
+  defaultMessage: 'changed',
+});
+
+export const EDITED_FIELD = i18n.translate('xpack.siem.case.caseView.actionLabel.editedField', {
+  defaultMessage: 'edited',
+});
+
+export const REMOVED_FIELD = i18n.translate('xpack.siem.case.caseView.actionLabel.removedField', {
+  defaultMessage: 'removed',
+});
+
+export const PUSHED_NEW_INCIDENT = i18n.translate(
+  'xpack.siem.case.caseView.actionLabel.pushedNewIncident',
   {
-    defaultMessage: 'added description',
+    defaultMessage: 'pushed as new incident',
+  }
+);
+
+export const UPDATE_INCIDENT = i18n.translate(
+  'xpack.siem.case.caseView.actionLabel.updateIncident',
+  {
+    defaultMessage: 'updated incident',
   }
 );
 
-export const EDITED_DESCRIPTION = i18n.translate(
-  'xpack.siem.case.caseView.actionLabel.editDescription',
+export const ADDED_DESCRIPTION = i18n.translate(
+  'xpack.siem.case.caseView.actionLabel.addDescription',
   {
-    defaultMessage: 'edited description',
+    defaultMessage: 'added description',
   }
 );
 
@@ -52,6 +75,14 @@ export const STATUS = i18n.translate('xpack.siem.case.caseView.statusLabel', {
   defaultMessage: 'Status',
 });
 
+export const CASE = i18n.translate('xpack.siem.case.caseView.case', {
+  defaultMessage: 'case',
+});
+
+export const COMMENT = i18n.translate('xpack.siem.case.caseView.comment', {
+  defaultMessage: 'comment',
+});
+
 export const CASE_OPENED = i18n.translate('xpack.siem.case.caseView.caseOpened', {
   defaultMessage: 'Case opened',
 });
@@ -71,3 +102,56 @@ export const EMAIL_BODY = (caseUrl: string) =>
     values: { caseUrl },
     defaultMessage: 'Case reference: {caseUrl}',
   });
+
+export const PUSH_SERVICENOW = i18n.translate('xpack.siem.case.caseView.pushAsServicenowIncident', {
+  defaultMessage: 'Push as ServiceNow incident',
+});
+
+export const UPDATE_PUSH_SERVICENOW = i18n.translate(
+  'xpack.siem.case.caseView.updatePushAsServicenowIncident',
+  {
+    defaultMessage: 'Update ServiceNow incident',
+  }
+);
+
+export const PUSH_DISABLE_BY_NO_CASE_CONFIG_TITLE = i18n.translate(
+  'xpack.siem.case.caseView.pushToServiceDisableByNoCaseConfigTitle',
+  {
+    defaultMessage: 'Configure external connector',
+  }
+);
+
+export const PUSH_DISABLE_BECAUSE_CASE_CLOSED_TITLE = i18n.translate(
+  'xpack.siem.case.caseView.pushToServiceDisableBecauseCaseClosedTitle',
+  {
+    defaultMessage: 'Reopen the case',
+  }
+);
+
+export const PUSH_DISABLE_BY_KIBANA_CONFIG_TITLE = i18n.translate(
+  'xpack.siem.case.caseView.pushToServiceDisableByConfigTitle',
+  {
+    defaultMessage: 'Enable ServiceNow in Kibana configuration file',
+  }
+);
+
+export const PUSH_DISABLE_BY_LICENSE_TITLE = i18n.translate(
+  'xpack.siem.case.caseView.pushToServiceDisableByLicenseTitle',
+  {
+    defaultMessage: 'Upgrade to Elastic Platinum',
+  }
+);
+
+export const LINK_CLOUD_DEPLOYMENT = i18n.translate(
+  'xpack.siem.case.caseView.cloudDeploymentLink',
+  {
+    defaultMessage: 'cloud deployment',
+  }
+);
+
+export const LINK_CONNECTOR_CONFIGURE = i18n.translate(
+  'xpack.siem.case.caseView.connectorConfigureLink',
+  {
+    defaultMessage: 'connector',
+  }
+);
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/configure_cases/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/configure_cases/index.tsx
index c8ef6e32595d0..5f99ec362cd5e 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/configure_cases/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/configure_cases/index.tsx
@@ -28,7 +28,8 @@ import {
 
 // eslint-disable-next-line @kbn/eslint/no-restricted-paths
 import { ActionConnectorTableItem } from '../../../../../../../../plugins/triggers_actions_ui/public/types';
-
+import { getCaseUrl } from '../../../../components/link_to';
+import { useGetUrlSearch } from '../../../../components/navigation/use_get_url_search';
 import {
   ClosureType,
   CasesConfigurationMapping,
@@ -38,11 +39,9 @@ import { Connectors } from '../configure_cases/connectors';
 import { ClosureOptions } from '../configure_cases/closure_options';
 import { Mapping } from '../configure_cases/mapping';
 import { SectionWrapper } from '../wrappers';
+import { navTabs } from '../../../../pages/home/home_navigations';
 import { configureCasesReducer, State } from './reducer';
 import * as i18n from './translations';
-import { getCaseUrl } from '../../../../components/link_to';
-
-const CASE_URL = getCaseUrl();
 
 const FormWrapper = styled.div`
   ${({ theme }) => css`
@@ -73,6 +72,7 @@ const actionTypes: ActionType[] = [
 ];
 
 const ConfigureCasesComponent: React.FC = () => {
+  const search = useGetUrlSearch(navTabs.case);
   const { http, triggers_actions_ui, notifications, application } = useKibana().services;
 
   const [connectorIsValid, setConnectorIsValid] = useState(true);
@@ -113,7 +113,7 @@ const ConfigureCasesComponent: React.FC = () => {
   }, []);
 
   const { loading: loadingCaseConfigure, persistLoading, persistCaseConfigure } = useCaseConfigure({
-    setConnectorId,
+    setConnector: setConnectorId,
     setClosureType,
   });
   const { loading: isLoadingConnectors, connectors, refetchConnectors } = useConnectors();
@@ -128,9 +128,13 @@ const ConfigureCasesComponent: React.FC = () => {
     // TO DO give a warning/error to user when field are not mapped so they have chance to do it
     () => {
       setActionBarVisible(false);
-      persistCaseConfigure({ connectorId, closureType });
+      persistCaseConfigure({
+        connectorId,
+        connectorName: connectors.find(c => c.id === connectorId)?.name ?? '',
+        closureType,
+      });
     },
-    [connectorId, closureType, mapping]
+    [connectorId, connectors, closureType, mapping]
   );
 
   const onChangeConnector = useCallback((newConnectorId: string) => {
@@ -231,7 +235,7 @@ const ConfigureCasesComponent: React.FC = () => {
                     isDisabled={isLoadingAny}
                     isLoading={persistLoading}
                     aria-label="Cancel"
-                    href={CASE_URL}
+                    href={getCaseUrl(search)}
                   >
                     {i18n.CANCEL}
                   </EuiButtonEmpty>
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/errors_push_service_callout/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/errors_push_service_callout/index.tsx
new file mode 100644
index 0000000000000..15b50e4b4cd8d
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/errors_push_service_callout/index.tsx
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiCallOut, EuiButton, EuiDescriptionList, EuiSpacer } from '@elastic/eui';
+import React, { memo, useCallback, useState } from 'react';
+
+import * as i18n from './translations';
+
+interface ErrorsPushServiceCallOut {
+  errors: Array<{ title: string; description: JSX.Element }>;
+}
+
+const ErrorsPushServiceCallOutComponent = ({ errors }: ErrorsPushServiceCallOut) => {
+  const [showCallOut, setShowCallOut] = useState(true);
+  const handleCallOut = useCallback(() => setShowCallOut(false), [setShowCallOut]);
+
+  return showCallOut ? (
+    <>
+      <EuiCallOut title={i18n.ERROR_PUSH_SERVICE_CALLOUT_TITLE} color="primary" iconType="gear">
+        <EuiDescriptionList listItems={errors} />
+        <EuiButton color="primary" onClick={handleCallOut}>
+          {i18n.DISMISS_CALLOUT}
+        </EuiButton>
+      </EuiCallOut>
+      <EuiSpacer />
+    </>
+  ) : null;
+};
+
+export const ErrorsPushServiceCallOut = memo(ErrorsPushServiceCallOutComponent);
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/errors_push_service_callout/translations.ts b/x-pack/legacy/plugins/siem/public/pages/case/components/errors_push_service_callout/translations.ts
new file mode 100644
index 0000000000000..57712e720f6d0
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/errors_push_service_callout/translations.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const ERROR_PUSH_SERVICE_CALLOUT_TITLE = i18n.translate(
+  'xpack.siem.case.errorsPushServiceCallOutTitle',
+  {
+    defaultMessage: 'To send cases to external systems, you need to:',
+  }
+);
+
+export const DISMISS_CALLOUT = i18n.translate(
+  'xpack.siem.case.dismissErrorsPushServiceCallOutTitle',
+  {
+    defaultMessage: 'Dismiss',
+  }
+);
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/helpers.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/helpers.tsx
new file mode 100644
index 0000000000000..008f4d7048f56
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/helpers.tsx
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiFlexGroup, EuiFlexItem, EuiBadge, EuiLink } from '@elastic/eui';
+import React from 'react';
+
+import { CaseFullExternalService } from '../../../../../../../../plugins/case/common/api';
+import { CaseUserActions } from '../../../../containers/case/types';
+import * as i18n from '../case_view/translations';
+
+interface LabelTitle {
+  action: CaseUserActions;
+  field: string;
+  firstIndexPushToService: number;
+  index: number;
+}
+
+export const getLabelTitle = ({ action, field, firstIndexPushToService, index }: LabelTitle) => {
+  if (field === 'tags') {
+    return getTagsLabelTitle(action);
+  } else if (field === 'title' && action.action === 'update') {
+    return `${i18n.CHANGED_FIELD.toLowerCase()} ${i18n.CASE_NAME.toLowerCase()}  ${i18n.TO} "${
+      action.newValue
+    }"`;
+  } else if (field === 'description' && action.action === 'update') {
+    return `${i18n.EDITED_FIELD} ${i18n.DESCRIPTION.toLowerCase()}`;
+  } else if (field === 'status' && action.action === 'update') {
+    return `${
+      action.newValue === 'open' ? i18n.REOPENED_CASE.toLowerCase() : i18n.CLOSED_CASE.toLowerCase()
+    } ${i18n.CASE}`;
+  } else if (field === 'comment' && action.action === 'update') {
+    return `${i18n.EDITED_FIELD} ${i18n.COMMENT.toLowerCase()}`;
+  } else if (field === 'pushed' && action.action === 'push-to-service' && action.newValue != null) {
+    return getPushedServiceLabelTitle(action, firstIndexPushToService, index);
+  }
+  return '';
+};
+
+const getTagsLabelTitle = (action: CaseUserActions) => (
+  <EuiFlexGroup alignItems="baseline" gutterSize="xs" component="span">
+    <EuiFlexItem>
+      {action.action === 'add' && i18n.ADDED_FIELD}
+      {action.action === 'delete' && i18n.REMOVED_FIELD} {i18n.TAGS.toLowerCase()}
+    </EuiFlexItem>
+    {action.newValue != null &&
+      action.newValue.split(',').map(tag => (
+        <EuiFlexItem grow={false} key={tag}>
+          <EuiBadge color="default">{tag}</EuiBadge>
+        </EuiFlexItem>
+      ))}
+  </EuiFlexGroup>
+);
+
+const getPushedServiceLabelTitle = (
+  action: CaseUserActions,
+  firstIndexPushToService: number,
+  index: number
+) => {
+  const pushedVal = JSON.parse(action.newValue ?? '') as CaseFullExternalService;
+  return (
+    <EuiFlexGroup alignItems="baseline" gutterSize="xs">
+      <EuiFlexItem>
+        {firstIndexPushToService === index ? i18n.PUSHED_NEW_INCIDENT : i18n.UPDATE_INCIDENT}
+      </EuiFlexItem>
+      <EuiFlexItem grow={false}>
+        <EuiLink href={pushedVal?.external_url} target="_blank">
+          {pushedVal?.connector_name} {pushedVal?.external_title}
+        </EuiLink>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/index.tsx
index 04697e63b7451..8b77186f76f77 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/index.tsx
@@ -4,27 +4,54 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useCallback, useMemo, useState } from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner } from '@elastic/eui';
+import React, { useCallback, useMemo, useRef, useState, useEffect } from 'react';
+import { useParams } from 'react-router-dom';
+import styled from 'styled-components';
+
 import * as i18n from '../case_view/translations';
 
-import { Case } from '../../../../containers/case/types';
+import { Case, CaseUserActions, Comment } from '../../../../containers/case/types';
 import { useUpdateComment } from '../../../../containers/case/use_update_comment';
+import { useCurrentUser } from '../../../../lib/kibana';
+import { AddComment } from '../add_comment';
+import { getLabelTitle } from './helpers';
 import { UserActionItem } from './user_action_item';
 import { UserActionMarkdown } from './user_action_markdown';
-import { AddComment } from '../add_comment';
-import { useCurrentUser } from '../../../../lib/kibana';
 
 export interface UserActionTreeProps {
   data: Case;
+  caseUserActions: CaseUserActions[];
+  fetchUserActions: () => void;
+  firstIndexPushToService: number;
   isLoadingDescription: boolean;
+  isLoadingUserActions: boolean;
+  lastIndexPushToService: number;
   onUpdateField: (updateKey: keyof Case, updateValue: string | string[]) => void;
 }
 
-const DescriptionId = 'description';
-const NewId = 'newComment';
+const MyEuiFlexGroup = styled(EuiFlexGroup)`
+  margin-bottom: 8px;
+`;
+
+const DESCRIPTION_ID = 'description';
+const NEW_ID = 'newComment';
 
 export const UserActionTree = React.memo(
-  ({ data: caseData, onUpdateField, isLoadingDescription }: UserActionTreeProps) => {
+  ({
+    data: caseData,
+    caseUserActions,
+    fetchUserActions,
+    firstIndexPushToService,
+    isLoadingDescription,
+    isLoadingUserActions,
+    lastIndexPushToService,
+    onUpdateField,
+  }: UserActionTreeProps) => {
+    const { commentId } = useParams();
+    const handlerTimeoutId = useRef(0);
+    const [initLoading, setInitLoading] = useState(true);
+    const [selectedOutlineCommentId, setSelectedOutlineCommentId] = useState('');
     const { comments, isLoadingIds, updateComment, addPostedComment } = useUpdateComment(
       caseData.comments
     );
@@ -45,20 +72,54 @@ export const UserActionTree = React.memo(
     const handleSaveComment = useCallback(
       (id: string, content: string) => {
         handleManageMarkdownEditId(id);
-        updateComment(caseData.id, id, content);
+        updateComment({
+          caseId: caseData.id,
+          commentId: id,
+          commentUpdate: content,
+          fetchUserActions,
+        });
       },
       [handleManageMarkdownEditId, updateComment]
     );
 
+    const handleOutlineComment = useCallback(
+      (id: string) => {
+        const moveToTarget = document.getElementById(`${id}-permLink`);
+        if (moveToTarget != null) {
+          const yOffset = -60;
+          const y = moveToTarget.getBoundingClientRect().top + window.pageYOffset + yOffset;
+          window.scrollTo({
+            top: y,
+            behavior: 'smooth',
+          });
+        }
+        window.clearTimeout(handlerTimeoutId.current);
+        setSelectedOutlineCommentId(id);
+        handlerTimeoutId.current = window.setTimeout(() => {
+          setSelectedOutlineCommentId('');
+          window.clearTimeout(handlerTimeoutId.current);
+        }, 2400);
+      },
+      [handlerTimeoutId.current]
+    );
+
+    const handleUpdate = useCallback(
+      (comment: Comment) => {
+        addPostedComment(comment);
+        fetchUserActions();
+      },
+      [addPostedComment, fetchUserActions]
+    );
+
     const MarkdownDescription = useMemo(
       () => (
         <UserActionMarkdown
-          id={DescriptionId}
+          id={DESCRIPTION_ID}
           content={caseData.description}
-          isEditable={manageMarkdownEditIds.includes(DescriptionId)}
+          isEditable={manageMarkdownEditIds.includes(DESCRIPTION_ID)}
           onSaveContent={(content: string) => {
-            handleManageMarkdownEditId(DescriptionId);
-            onUpdateField(DescriptionId, content);
+            handleManageMarkdownEditId(DESCRIPTION_ID);
+            onUpdateField(DESCRIPTION_ID, content);
           }}
           onChangeEditable={handleManageMarkdownEditId}
         />
@@ -67,55 +128,123 @@ export const UserActionTree = React.memo(
     );
 
     const MarkdownNewComment = useMemo(
-      () => <AddComment caseId={caseData.id} onCommentPosted={addPostedComment} />,
-      [caseData.id]
+      () => (
+        <AddComment
+          caseId={caseData.id}
+          onCommentPosted={handleUpdate}
+          onCommentSaving={handleManageMarkdownEditId.bind(null, NEW_ID)}
+          showLoading={false}
+        />
+      ),
+      [caseData.id, handleUpdate]
     );
 
+    useEffect(() => {
+      if (initLoading && !isLoadingUserActions && isLoadingIds.length === 0) {
+        setInitLoading(false);
+        if (commentId != null) {
+          handleOutlineComment(commentId);
+        }
+      }
+    }, [commentId, initLoading, isLoadingUserActions, isLoadingIds]);
+
     return (
       <>
         <UserActionItem
           createdAt={caseData.createdAt}
-          id={DescriptionId}
-          isEditable={manageMarkdownEditIds.includes(DescriptionId)}
+          id={DESCRIPTION_ID}
+          isEditable={manageMarkdownEditIds.includes(DESCRIPTION_ID)}
           isLoading={isLoadingDescription}
-          labelAction={i18n.EDIT_DESCRIPTION}
-          labelTitle={i18n.ADDED_DESCRIPTION}
+          labelEditAction={i18n.EDIT_DESCRIPTION}
+          labelTitle={<>{i18n.ADDED_DESCRIPTION}</>}
           fullName={caseData.createdBy.fullName ?? caseData.createdBy.username}
           markdown={MarkdownDescription}
-          onEdit={handleManageMarkdownEditId.bind(null, DescriptionId)}
+          onEdit={handleManageMarkdownEditId.bind(null, DESCRIPTION_ID)}
           userName={caseData.createdBy.username}
         />
-        {comments.map(comment => (
-          <UserActionItem
-            key={comment.id}
-            createdAt={comment.createdAt}
-            id={comment.id}
-            isEditable={manageMarkdownEditIds.includes(comment.id)}
-            isLoading={isLoadingIds.includes(comment.id)}
-            labelAction={i18n.EDIT_COMMENT}
-            labelTitle={i18n.ADDED_COMMENT}
-            fullName={comment.createdBy.fullName ?? comment.createdBy.username}
-            markdown={
-              <UserActionMarkdown
-                id={comment.id}
-                content={comment.comment}
-                isEditable={manageMarkdownEditIds.includes(comment.id)}
-                onChangeEditable={handleManageMarkdownEditId}
-                onSaveContent={handleSaveComment.bind(null, comment.id)}
-              />
+
+        {caseUserActions.map((action, index) => {
+          if (action.commentId != null && action.action === 'create') {
+            const comment = comments.find(c => c.id === action.commentId);
+            if (comment != null) {
+              return (
+                <UserActionItem
+                  key={action.actionId}
+                  createdAt={comment.createdAt}
+                  id={comment.id}
+                  idToOutline={selectedOutlineCommentId}
+                  isEditable={manageMarkdownEditIds.includes(comment.id)}
+                  isLoading={isLoadingIds.includes(comment.id)}
+                  labelEditAction={i18n.EDIT_COMMENT}
+                  labelTitle={<>{i18n.ADDED_COMMENT}</>}
+                  fullName={comment.createdBy.fullName ?? comment.createdBy.username}
+                  markdown={
+                    <UserActionMarkdown
+                      id={comment.id}
+                      content={comment.comment}
+                      isEditable={manageMarkdownEditIds.includes(comment.id)}
+                      onChangeEditable={handleManageMarkdownEditId}
+                      onSaveContent={handleSaveComment.bind(null, comment.id)}
+                    />
+                  }
+                  onEdit={handleManageMarkdownEditId.bind(null, comment.id)}
+                  outlineComment={handleOutlineComment}
+                  userName={comment.createdBy.username}
+                  updatedAt={comment.updatedAt}
+                />
+              );
             }
-            onEdit={handleManageMarkdownEditId.bind(null, comment.id)}
-            userName={comment.createdBy.username}
-          />
-        ))}
+          }
+          if (action.actionField.length === 1) {
+            const myField = action.actionField[0];
+            const labelTitle: string | JSX.Element = getLabelTitle({
+              action,
+              field: myField,
+              firstIndexPushToService,
+              index,
+            });
+
+            return (
+              <UserActionItem
+                key={action.actionId}
+                createdAt={action.actionAt}
+                id={action.actionId}
+                isEditable={false}
+                isLoading={false}
+                labelTitle={<>{labelTitle}</>}
+                linkId={
+                  action.action === 'update' && action.commentId != null ? action.commentId : null
+                }
+                fullName={action.actionBy.fullName ?? action.actionBy.username}
+                outlineComment={handleOutlineComment}
+                showTopFooter={
+                  action.action === 'push-to-service' && index === lastIndexPushToService
+                }
+                showBottomFooter={
+                  action.action === 'push-to-service' &&
+                  index === lastIndexPushToService &&
+                  index < caseUserActions.length - 1
+                }
+                userName={action.actionBy.username}
+              />
+            );
+          }
+          return null;
+        })}
+        {(isLoadingUserActions || isLoadingIds.includes(NEW_ID)) && (
+          <MyEuiFlexGroup justifyContent="center" alignItems="center">
+            <EuiFlexItem grow={false}>
+              <EuiLoadingSpinner size="l" />
+            </EuiFlexItem>
+          </MyEuiFlexGroup>
+        )}
         <UserActionItem
           createdAt={new Date().toISOString()}
-          id={NewId}
+          id={NEW_ID}
           isEditable={true}
-          isLoading={isLoadingIds.includes(NewId)}
+          isLoading={isLoadingIds.includes(NEW_ID)}
           fullName={currentUser != null ? currentUser.fullName : ''}
           markdown={MarkdownNewComment}
-          onEdit={handleManageMarkdownEditId.bind(null, NewId)}
           userName={currentUser != null ? currentUser.username : ''}
         />
       </>
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/translations.ts b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/translations.ts
new file mode 100644
index 0000000000000..0ca6bcff513fc
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/translations.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export * from '../case_view/translations';
+
+export const ALREADY_PUSHED_TO_SERVICE = i18n.translate(
+  'xpack.siem.case.caseView.alreadyPushedToService',
+  {
+    defaultMessage: 'Already pushed to Service Now incident',
+  }
+);
+
+export const REQUIRED_UPDATE_TO_SERVICE = i18n.translate(
+  'xpack.siem.case.caseView.requiredUpdateToService',
+  {
+    defaultMessage: 'Requires update to ServiceNow incident',
+  }
+);
+
+export const COPY_LINK_COMMENT = i18n.translate('xpack.siem.case.caseView.copyCommentLinkAria', {
+  defaultMessage: 'click to copy comment link',
+});
+
+export const MOVE_TO_ORIGINAL_COMMENT = i18n.translate(
+  'xpack.siem.case.caseView.moveToCommentAria',
+  {
+    defaultMessage: 'click to highlight the reference comment',
+  }
+);
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/user_action_item.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/user_action_item.tsx
index 7b99f2ef76ab3..10a7c56e2eb2d 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/user_action_item.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/user_action_item.tsx
@@ -4,27 +4,41 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiFlexGroup, EuiFlexItem, EuiLoadingSpinner, EuiPanel } from '@elastic/eui';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiLoadingSpinner,
+  EuiPanel,
+  EuiHorizontalRule,
+  EuiText,
+} from '@elastic/eui';
 import React from 'react';
-
 import styled, { css } from 'styled-components';
+
 import { UserActionAvatar } from './user_action_avatar';
 import { UserActionTitle } from './user_action_title';
+import * as i18n from './translations';
 
 interface UserActionItemProps {
   createdAt: string;
   id: string;
   isEditable: boolean;
   isLoading: boolean;
-  labelAction?: string;
-  labelTitle?: string;
+  labelEditAction?: string;
+  labelTitle?: JSX.Element;
+  linkId?: string | null;
   fullName: string;
-  markdown: React.ReactNode;
-  onEdit: (id: string) => void;
+  markdown?: React.ReactNode;
+  onEdit?: (id: string) => void;
   userName: string;
+  updatedAt?: string | null;
+  outlineComment?: (id: string) => void;
+  showBottomFooter?: boolean;
+  showTopFooter?: boolean;
+  idToOutline?: string | null;
 }
 
-const UserActionItemContainer = styled(EuiFlexGroup)`
+export const UserActionItemContainer = styled(EuiFlexGroup)`
   ${({ theme }) => css`
     & {
       background-image: linear-gradient(
@@ -66,42 +80,102 @@ const UserActionItemContainer = styled(EuiFlexGroup)`
   `}
 `;
 
+const MyEuiPanel = styled(EuiPanel)<{ showoutline: string }>`
+  ${({ theme, showoutline }) =>
+    showoutline === 'true'
+      ? `
+      outline: solid 5px ${theme.eui.euiColorVis1_behindText};
+      margin: 0.5em;
+      transition: 0.8s;
+    `
+      : ''}
+`;
+
+const PushedContainer = styled(EuiFlexItem)`
+  ${({ theme }) => `
+    margin-top: ${theme.eui.euiSizeS};
+    margin-bottom: ${theme.eui.euiSizeXL};
+    hr {
+      margin: 5px;
+      height: ${theme.eui.euiBorderWidthThick};
+    }
+  `}
+`;
+
+const PushedInfoContainer = styled.div`
+  margin-left: 48px;
+`;
+
 export const UserActionItem = ({
   createdAt,
   id,
+  idToOutline,
   isEditable,
   isLoading,
-  labelAction,
+  labelEditAction,
   labelTitle,
+  linkId,
   fullName,
   markdown,
   onEdit,
+  outlineComment,
+  showBottomFooter,
+  showTopFooter,
   userName,
+  updatedAt,
 }: UserActionItemProps) => (
-  <UserActionItemContainer gutterSize={'none'}>
-    <EuiFlexItem data-test-subj={`user-action-${id}-avatar`} grow={false}>
-      {fullName.length > 0 || userName.length > 0 ? (
-        <UserActionAvatar name={fullName ?? userName} />
-      ) : (
-        <EuiLoadingSpinner className="userAction_loadingAvatar" />
-      )}
-    </EuiFlexItem>
-    <EuiFlexItem data-test-subj={`user-action-${id}`}>
-      {isEditable && markdown}
-      {!isEditable && (
-        <EuiPanel className="userAction__panel" paddingSize="none">
-          <UserActionTitle
-            createdAt={createdAt}
-            id={id}
-            isLoading={isLoading}
-            labelAction={labelAction ?? ''}
-            labelTitle={labelTitle ?? ''}
-            userName={userName}
-            onEdit={onEdit}
-          />
-          {markdown}
-        </EuiPanel>
-      )}
+  <UserActionItemContainer gutterSize={'none'} direction="column">
+    <EuiFlexItem>
+      <EuiFlexGroup gutterSize={'none'}>
+        <EuiFlexItem data-test-subj={`user-action-${id}-avatar`} grow={false}>
+          {fullName.length > 0 || userName.length > 0 ? (
+            <UserActionAvatar name={fullName ?? userName} />
+          ) : (
+            <EuiLoadingSpinner className="userAction_loadingAvatar" />
+          )}
+        </EuiFlexItem>
+        <EuiFlexItem data-test-subj={`user-action-${id}`}>
+          {isEditable && markdown}
+          {!isEditable && (
+            <MyEuiPanel
+              className="userAction__panel"
+              paddingSize="none"
+              showoutline={id === idToOutline ? 'true' : 'false'}
+            >
+              <UserActionTitle
+                createdAt={createdAt}
+                id={id}
+                isLoading={isLoading}
+                labelEditAction={labelEditAction}
+                labelTitle={labelTitle ?? <></>}
+                linkId={linkId}
+                userName={userName}
+                updatedAt={updatedAt}
+                onEdit={onEdit}
+                outlineComment={outlineComment}
+              />
+              {markdown}
+            </MyEuiPanel>
+          )}
+        </EuiFlexItem>
+      </EuiFlexGroup>
     </EuiFlexItem>
+    {showTopFooter && (
+      <PushedContainer>
+        <PushedInfoContainer>
+          <EuiText size="xs" color="subdued">
+            {i18n.ALREADY_PUSHED_TO_SERVICE}
+          </EuiText>
+        </PushedInfoContainer>
+        <EuiHorizontalRule />
+        {showBottomFooter && (
+          <PushedInfoContainer>
+            <EuiText size="xs" color="subdued">
+              {i18n.REQUIRED_UPDATE_TO_SERVICE}
+            </EuiText>
+          </PushedInfoContainer>
+        )}
+      </PushedContainer>
+    )}
   </UserActionItemContainer>
 );
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/user_action_title.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/user_action_title.tsx
index 6ad60fb9f963e..6ca81667d9712 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/user_action_title.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/user_action_tree/user_action_title.tsx
@@ -4,16 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiLoadingSpinner, EuiFlexGroup, EuiFlexItem, EuiText } from '@elastic/eui';
-import React, { useMemo } from 'react';
+import { EuiLoadingSpinner, EuiFlexGroup, EuiFlexItem, EuiText, EuiButtonIcon } from '@elastic/eui';
+import { FormattedRelative } from '@kbn/i18n/react';
+import copy from 'copy-to-clipboard';
+import { isEmpty } from 'lodash/fp';
+import React, { useMemo, useCallback } from 'react';
 import styled from 'styled-components';
+import { useParams } from 'react-router-dom';
 
-import {
-  FormattedRelativePreferenceDate,
-  FormattedRelativePreferenceLabel,
-} from '../../../../components/formatted_date';
-import * as i18n from '../case_view/translations';
+import { LocalizedDateTooltip } from '../../../../components/localized_date_tooltip';
+import { useGetUrlSearch } from '../../../../components/navigation/use_get_url_search';
+import { navTabs } from '../../../home/home_navigations';
 import { PropertyActions } from '../property_actions';
+import { SiemPageName } from '../../../home/types';
+import * as i18n from './translations';
 
 const MySpinner = styled(EuiLoadingSpinner)`
   .euiLoadingSpinner {
@@ -25,44 +29,122 @@ interface UserActionTitleProps {
   createdAt: string;
   id: string;
   isLoading: boolean;
-  labelAction: string;
-  labelTitle: string;
+  labelEditAction?: string;
+  labelTitle: JSX.Element;
+  linkId?: string | null;
+  updatedAt?: string | null;
   userName: string;
-  onEdit: (id: string) => void;
+  onEdit?: (id: string) => void;
+  outlineComment?: (id: string) => void;
 }
 
 export const UserActionTitle = ({
   createdAt,
   id,
   isLoading,
-  labelAction,
+  labelEditAction,
   labelTitle,
+  linkId,
   userName,
+  updatedAt,
   onEdit,
+  outlineComment,
 }: UserActionTitleProps) => {
+  const { detailName: caseId } = useParams();
+  const urlSearch = useGetUrlSearch(navTabs.case);
   const propertyActions = useMemo(() => {
-    return [
+    if (labelEditAction != null && onEdit != null) {
+      return [
+        {
+          iconType: 'pencil',
+          label: labelEditAction,
+          onClick: () => onEdit(id),
+        },
+      ];
+    }
+    return [];
+  }, [id, labelEditAction, onEdit]);
+
+  const handleAnchorLink = useCallback(() => {
+    copy(
+      `${window.location.origin}${window.location.pathname}#${SiemPageName.case}/${caseId}/${id}${urlSearch}`,
       {
-        iconType: 'documentEdit',
-        label: labelAction,
-        onClick: () => onEdit(id),
-      },
-    ];
-  }, [id, onEdit]);
+        debug: true,
+      }
+    );
+  }, [caseId, id, urlSearch]);
+
+  const handleMoveToLink = useCallback(() => {
+    if (outlineComment != null && linkId != null) {
+      outlineComment(linkId);
+    }
+  }, [linkId, outlineComment]);
+
   return (
     <EuiText size="s" className="userAction__title" data-test-subj={`user-action-title`}>
-      <EuiFlexGroup alignItems="baseline" gutterSize="none" justifyContent="spaceBetween">
+      <EuiFlexGroup
+        alignItems="baseline"
+        gutterSize="none"
+        justifyContent="spaceBetween"
+        component="span"
+      >
         <EuiFlexItem grow={false}>
-          <p>
-            <strong>{userName}</strong>
-            {` ${labelTitle} `}
-            <FormattedRelativePreferenceLabel value={createdAt} preferenceLabel={`${i18n.ON} `} />
-            <FormattedRelativePreferenceDate value={createdAt} />
-          </p>
+          <EuiFlexGroup alignItems="baseline" gutterSize="xs" component="span">
+            <EuiFlexItem grow={false}>
+              <strong>{userName}</strong>
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>{labelTitle}</EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <LocalizedDateTooltip date={new Date(createdAt)}>
+                <FormattedRelative
+                  data-test-subj="user-action-title-creation-relative-time"
+                  value={createdAt}
+                />
+              </LocalizedDateTooltip>
+            </EuiFlexItem>
+            {updatedAt != null && (
+              <EuiFlexItem>
+                <EuiText size="s" color="subdued">
+                  {'('}
+                  {i18n.EDITED_FIELD}{' '}
+                  <LocalizedDateTooltip date={new Date(updatedAt)}>
+                    <FormattedRelative
+                      data-test-subj="user-action-title-edited-relative-time"
+                      value={updatedAt}
+                    />
+                  </LocalizedDateTooltip>
+                  {')'}
+                </EuiText>
+              </EuiFlexItem>
+            )}
+          </EuiFlexGroup>
         </EuiFlexItem>
         <EuiFlexItem grow={false}>
-          {isLoading && <MySpinner />}
-          {!isLoading && <PropertyActions propertyActions={propertyActions} />}
+          <EuiFlexGroup alignItems="baseline" gutterSize="none">
+            {!isEmpty(linkId) && (
+              <EuiFlexItem grow={false}>
+                <EuiButtonIcon
+                  aria-label={i18n.MOVE_TO_ORIGINAL_COMMENT}
+                  onClick={handleMoveToLink}
+                  iconType="arrowUp"
+                />
+              </EuiFlexItem>
+            )}
+            <EuiFlexItem grow={false}>
+              <EuiButtonIcon
+                aria-label={i18n.COPY_LINK_COMMENT}
+                onClick={handleAnchorLink}
+                iconType="link"
+                id={`${id}-permLink`}
+              />
+            </EuiFlexItem>
+            {propertyActions.length > 0 && (
+              <EuiFlexItem grow={false}>
+                {isLoading && <MySpinner />}
+                {!isLoading && <PropertyActions propertyActions={propertyActions} />}
+              </EuiFlexItem>
+            )}
+          </EuiFlexGroup>
         </EuiFlexItem>
       </EuiFlexGroup>
     </EuiText>
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/components/user_list/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/components/user_list/index.tsx
index 74a1b98c29eef..9ace36eea1e9e 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/components/user_list/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/components/user_list/index.tsx
@@ -58,7 +58,7 @@ const renderUsers = (
       <EuiFlexItem grow={false}>
         <EuiButtonIcon
           data-test-subj="user-list-email-button"
-          onClick={handleSendEmail.bind(null, email)} // TO DO
+          onClick={handleSendEmail.bind(null, email)}
           iconType="email"
           aria-label="email"
         />
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/configure_cases.tsx b/x-pack/legacy/plugins/siem/public/pages/case/configure_cases.tsx
index b546a88744439..b7e7ced308331 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/configure_cases.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/configure_cases.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
+import React, { useMemo } from 'react';
 
 import { WrapperPage } from '../../components/wrapper_page';
 import { CaseHeaderPage } from './components/case_header_page';
@@ -13,11 +13,8 @@ import { getCaseUrl } from '../../components/link_to';
 import { WhitePageWrapper, SectionWrapper } from './components/wrappers';
 import * as i18n from './translations';
 import { ConfigureCases } from './components/configure_cases';
-
-const backOptions = {
-  href: getCaseUrl(),
-  text: i18n.BACK_TO_ALL,
-};
+import { useGetUrlSearch } from '../../components/navigation/use_get_url_search';
+import { navTabs } from '../home/home_navigations';
 
 const wrapperPageStyle: Record<string, string> = {
   paddingLeft: '0',
@@ -25,18 +22,30 @@ const wrapperPageStyle: Record<string, string> = {
   paddingBottom: '0',
 };
 
-const ConfigureCasesPageComponent: React.FC = () => (
-  <>
-    <WrapperPage style={wrapperPageStyle}>
-      <SectionWrapper>
-        <CaseHeaderPage title={i18n.CONFIGURE_CASES_PAGE_TITLE} backOptions={backOptions} />
-      </SectionWrapper>
-      <WhitePageWrapper>
-        <ConfigureCases />
-      </WhitePageWrapper>
-    </WrapperPage>
-    <SpyRoute />
-  </>
-);
+const ConfigureCasesPageComponent: React.FC = () => {
+  const search = useGetUrlSearch(navTabs.case);
+
+  const backOptions = useMemo(
+    () => ({
+      href: getCaseUrl(search),
+      text: i18n.BACK_TO_ALL,
+    }),
+    [search]
+  );
+
+  return (
+    <>
+      <WrapperPage style={wrapperPageStyle}>
+        <SectionWrapper>
+          <CaseHeaderPage title={i18n.CONFIGURE_CASES_PAGE_TITLE} backOptions={backOptions} />
+        </SectionWrapper>
+        <WhitePageWrapper>
+          <ConfigureCases />
+        </WhitePageWrapper>
+      </WrapperPage>
+      <SpyRoute />
+    </>
+  );
+};
 
 export const ConfigureCasesPage = React.memo(ConfigureCasesPageComponent);
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/create_case.tsx b/x-pack/legacy/plugins/siem/public/pages/case/create_case.tsx
index 2c7525264f71b..bd1f6da0ca28b 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/create_case.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/create_case.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
+import React, { useMemo } from 'react';
 
 import { WrapperPage } from '../../components/wrapper_page';
 import { Create } from './components/create';
@@ -12,20 +12,29 @@ import { SpyRoute } from '../../utils/route/spy_routes';
 import { CaseHeaderPage } from './components/case_header_page';
 import * as i18n from './translations';
 import { getCaseUrl } from '../../components/link_to';
+import { useGetUrlSearch } from '../../components/navigation/use_get_url_search';
+import { navTabs } from '../home/home_navigations';
 
-const backOptions = {
-  href: getCaseUrl(),
-  text: i18n.BACK_TO_ALL,
-};
+export const CreateCasePage = React.memo(() => {
+  const search = useGetUrlSearch(navTabs.case);
 
-export const CreateCasePage = React.memo(() => (
-  <>
-    <WrapperPage>
-      <CaseHeaderPage backOptions={backOptions} title={i18n.CREATE_TITLE} />
-      <Create />
-    </WrapperPage>
-    <SpyRoute />
-  </>
-));
+  const backOptions = useMemo(
+    () => ({
+      href: getCaseUrl(search),
+      text: i18n.BACK_TO_ALL,
+    }),
+    [search]
+  );
+
+  return (
+    <>
+      <WrapperPage>
+        <CaseHeaderPage backOptions={backOptions} title={i18n.CREATE_TITLE} />
+        <Create />
+      </WrapperPage>
+      <SpyRoute />
+    </>
+  );
+});
 
 CreateCasePage.displayName = 'CreateCasePage';
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/index.tsx b/x-pack/legacy/plugins/siem/public/pages/case/index.tsx
index 1bde9de1535b5..124cefa726a8b 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/case/index.tsx
@@ -15,6 +15,7 @@ import { ConfigureCasesPage } from './configure_cases';
 
 const casesPagePath = `/:pageName(${SiemPageName.case})`;
 const caseDetailsPagePath = `${casesPagePath}/:detailName`;
+const caseDetailsPagePathWithCommentId = `${casesPagePath}/:detailName/:commentId`;
 const createCasePagePath = `${casesPagePath}/create`;
 const configureCasesPagePath = `${casesPagePath}/configure`;
 
@@ -29,6 +30,9 @@ const CaseContainerComponent: React.FC = () => (
     <Route strict exact path={configureCasesPagePath}>
       <ConfigureCasesPage />
     </Route>
+    <Route strict path={caseDetailsPagePathWithCommentId}>
+      <CaseDetailsPage />
+    </Route>
     <Route strict path={caseDetailsPagePath}>
       <CaseDetailsPage />
     </Route>
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/translations.ts b/x-pack/legacy/plugins/siem/public/pages/case/translations.ts
index 341a34240fe49..8f9d2087699f8 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/case/translations.ts
@@ -33,17 +33,15 @@ export const OPENED_ON = i18n.translate('xpack.siem.case.caseView.openedOn', {
 export const CLOSED_ON = i18n.translate('xpack.siem.case.caseView.closedOn', {
   defaultMessage: 'Closed on',
 });
-export const REOPEN_CASE = i18n.translate('xpack.siem.case.caseTable.reopenCase', {
-  defaultMessage: 'Reopen case',
-});
-export const CLOSE_CASE = i18n.translate('xpack.siem.case.caseTable.closeCase', {
-  defaultMessage: 'Close case',
-});
 
-export const REPORTER = i18n.translate('xpack.siem.case.caseView.createdBy', {
+export const REPORTER = i18n.translate('xpack.siem.case.caseView.reporterLabel', {
   defaultMessage: 'Reporter',
 });
 
+export const PARTICIPANTS = i18n.translate('xpack.siem.case.caseView.particpantsLabel', {
+  defaultMessage: 'Participants',
+});
+
 export const CREATE_BC_TITLE = i18n.translate('xpack.siem.case.caseView.breadcrumb', {
   defaultMessage: 'Create',
 });
@@ -90,6 +88,30 @@ export const CREATE_CASE = i18n.translate('xpack.siem.case.caseView.createCase',
   defaultMessage: 'Create case',
 });
 
+export const CLOSED_CASE = i18n.translate('xpack.siem.case.caseView.closedCase', {
+  defaultMessage: 'Closed case',
+});
+
+export const CLOSE_CASE = i18n.translate('xpack.siem.case.caseView.closeCase', {
+  defaultMessage: 'Close case',
+});
+
+export const REOPEN_CASE = i18n.translate('xpack.siem.case.caseView.reopenCase', {
+  defaultMessage: 'Reopen case',
+});
+
+export const REOPENED_CASE = i18n.translate('xpack.siem.case.caseView.reopenedCase', {
+  defaultMessage: 'Reopened case',
+});
+
+export const CASE_NAME = i18n.translate('xpack.siem.case.caseView.caseName', {
+  defaultMessage: 'Case name',
+});
+
+export const TO = i18n.translate('xpack.siem.case.caseView.to', {
+  defaultMessage: 'to',
+});
+
 export const TAGS = i18n.translate('xpack.siem.case.caseView.tags', {
   defaultMessage: 'Tags',
 });
@@ -130,7 +152,7 @@ export const CONFIGURE_CASES_PAGE_TITLE = i18n.translate(
 );
 
 export const CONFIGURE_CASES_BUTTON = i18n.translate('xpack.siem.case.configureCasesButton', {
-  defaultMessage: 'Edit third-party connection',
+  defaultMessage: 'Edit external connection',
 });
 
 export const ADD_COMMENT = i18n.translate('xpack.siem.case.caseView.comment.addComment', {
diff --git a/x-pack/legacy/plugins/siem/public/pages/case/utils.ts b/x-pack/legacy/plugins/siem/public/pages/case/utils.ts
index ccb3b71a476ec..df9f0d08e728c 100644
--- a/x-pack/legacy/plugins/siem/public/pages/case/utils.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/case/utils.ts
@@ -4,16 +4,20 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { isEmpty } from 'lodash/fp';
 import { Breadcrumb } from 'ui/chrome';
+
 import { getCaseDetailsUrl, getCaseUrl, getCreateCaseUrl } from '../../components/link_to';
 import { RouteSpyState } from '../../utils/route/types';
 import * as i18n from './translations';
 
-export const getBreadcrumbs = (params: RouteSpyState): Breadcrumb[] => {
+export const getBreadcrumbs = (params: RouteSpyState, search: string[]): Breadcrumb[] => {
+  const queryParameters = !isEmpty(search[0]) ? search[0] : null;
+
   let breadcrumb = [
     {
       text: i18n.PAGE_TITLE,
-      href: getCaseUrl(),
+      href: getCaseUrl(queryParameters),
     },
   ];
   if (params.detailName === 'create') {
@@ -21,7 +25,7 @@ export const getBreadcrumbs = (params: RouteSpyState): Breadcrumb[] => {
       ...breadcrumb,
       {
         text: i18n.CREATE_BC_TITLE,
-        href: getCreateCaseUrl(),
+        href: getCreateCaseUrl(queryParameters),
       },
     ];
   } else if (params.detailName != null) {
@@ -29,7 +33,7 @@ export const getBreadcrumbs = (params: RouteSpyState): Breadcrumb[] => {
       ...breadcrumb,
       {
         text: params.state?.caseTitle ?? '',
-        href: getCaseDetailsUrl(params.detailName),
+        href: getCaseDetailsUrl({ id: params.detailName, search: queryParameters }),
       },
     ];
   }
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/__mocks__/mock.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/__mocks__/mock.ts
index 011a2614c1af9..a6aefefedd5c3 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/__mocks__/mock.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/all/__mocks__/mock.ts
@@ -155,10 +155,6 @@ export const mockAboutStepRule = (isNew = false): AboutStepRule => ({
   references: ['www.test.co'],
   falsePositives: ['test'],
   tags: ['tag1', 'tag2'],
-  timeline: {
-    id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
-    title: 'Titled timeline',
-  },
   threat: [
     {
       framework: 'mockFramework',
@@ -186,6 +182,10 @@ export const mockDefineStepRule = (isNew = false): DefineStepRule => ({
   machineLearningJobId: '',
   index: ['filebeat-'],
   queryBar: mockQueryBar,
+  timeline: {
+    id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+    title: 'Titled timeline',
+  },
 });
 
 export const mockScheduleStepRule = (isNew = false, enabled = false): ScheduleStepRule => ({
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/anomaly_threshold_slider/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/anomaly_threshold_slider/index.tsx
index 18970ff935b8d..1e18023e0c326 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/anomaly_threshold_slider/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/anomaly_threshold_slider/index.tsx
@@ -10,12 +10,16 @@ import { EuiFlexGrid, EuiFlexItem, EuiRange, EuiFormRow } from '@elastic/eui';
 import { FieldHook } from '../../../../../shared_imports';
 
 interface AnomalyThresholdSliderProps {
+  describedByIds: string[];
   field: FieldHook;
 }
 type Event = React.ChangeEvent<HTMLInputElement>;
 type EventArg = Event | React.MouseEvent<HTMLButtonElement>;
 
-export const AnomalyThresholdSlider: React.FC<AnomalyThresholdSliderProps> = ({ field }) => {
+export const AnomalyThresholdSlider: React.FC<AnomalyThresholdSliderProps> = ({
+  describedByIds = [],
+  field,
+}) => {
   const threshold = field.value as number;
   const onThresholdChange = useCallback(
     (event: EventArg) => {
@@ -26,7 +30,12 @@ export const AnomalyThresholdSlider: React.FC<AnomalyThresholdSliderProps> = ({
   );
 
   return (
-    <EuiFormRow label={field.label} fullWidth>
+    <EuiFormRow
+      fullWidth
+      label={field.label}
+      data-test-subj="anomalyThresholdSlider"
+      describedByIds={describedByIds}
+    >
       <EuiFlexGrid columns={2}>
         <EuiFlexItem>
           <EuiRange
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/__snapshots__/index.test.tsx.snap b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/__snapshots__/index.test.tsx.snap
index 4d416e70a096c..9a534297e5e29 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/__snapshots__/index.test.tsx.snap
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/__snapshots__/index.test.tsx.snap
@@ -27,21 +27,6 @@ exports[`description_step StepRuleDescriptionComponent renders correctly against
             "description": 21,
             "title": "Risk score",
           },
-          Object {
-            "description": "Titled timeline",
-            "title": "Timeline template",
-          },
-        ]
-      }
-    />
-  </EuiFlexItem>
-  <EuiFlexItem
-    data-test-subj="listItemColumnStepRuleDescription"
-    key="description-step-rule-1"
-  >
-    <EuiDescriptionList
-      listItems={
-        Array [
           Object {
             "description": <EuiText
               size="s"
@@ -62,6 +47,17 @@ exports[`description_step StepRuleDescriptionComponent renders correctly against
             </EuiText>,
             "title": "Reference URLs",
           },
+        ]
+      }
+    />
+  </EuiFlexItem>
+  <EuiFlexItem
+    data-test-subj="listItemColumnStepRuleDescription"
+    key="description-step-rule-1"
+  >
+    <EuiDescriptionList
+      listItems={
+        Array [
           Object {
             "description": <EuiText
               size="s"
@@ -184,10 +180,6 @@ exports[`description_step StepRuleDescriptionComponent renders correctly against
             "description": 21,
             "title": "Risk score",
           },
-          Object {
-            "description": "Titled timeline",
-            "title": "Timeline template",
-          },
           Object {
             "description": <EuiText
               size="s"
@@ -331,10 +323,6 @@ exports[`description_step StepRuleDescriptionComponent renders correctly against
             "description": 21,
             "title": "Risk score",
           },
-          Object {
-            "description": "Titled timeline",
-            "title": "Timeline template",
-          },
           Object {
             "description": <EuiText
               size="s"
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/index.test.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/index.test.tsx
index 2c6f47fd27c44..557da8677f777 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/index.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/description_step/index.test.tsx
@@ -18,7 +18,7 @@ import {
   Filter,
   FilterManager,
 } from '../../../../../../../../../../src/plugins/data/public';
-import { mockAboutStepRule } from '../../all/__mocks__/mock';
+import { mockAboutStepRule, mockDefineStepRule } from '../../all/__mocks__/mock';
 import { coreMock } from '../../../../../../../../../../src/core/public/mocks';
 import { DEFAULT_TIMELINE_TITLE } from '../../../../../components/timeline/translations';
 import * as i18n from './translations';
@@ -263,7 +263,7 @@ describe('description_step', () => {
     test('returns expected ListItems array when given valid inputs', () => {
       const result: ListItems[] = buildListItems(mockAboutStep, schema, mockFilterManager);
 
-      expect(result.length).toEqual(10);
+      expect(result.length).toEqual(9);
     });
   });
 
@@ -431,10 +431,11 @@ describe('description_step', () => {
 
     describe('timeline', () => {
       test('returns timeline title if one exists', () => {
+        const mockDefineStep = mockDefineStepRule();
         const result: ListItems[] = getDescriptionItem(
           'timeline',
           'Timeline label',
-          mockAboutStep,
+          mockDefineStep,
           mockFilterManager
         );
 
@@ -444,7 +445,7 @@ describe('description_step', () => {
 
       test('returns default timeline title if none exists', () => {
         const mockStep = {
-          ...mockAboutStep,
+          ...mockDefineStepRule(),
           timeline: {
             id: '12345',
           },
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/ml_job_select/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/ml_job_select/index.tsx
index 627fa21cc2f61..bc32162c2660b 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/ml_job_select/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/ml_job_select/index.tsx
@@ -20,10 +20,11 @@ const JobDisplay = ({ title, description }: { title: string; description: string
 );
 
 interface MlJobSelectProps {
+  describedByIds: string[];
   field: FieldHook;
 }
 
-export const MlJobSelect: React.FC<MlJobSelectProps> = ({ field }) => {
+export const MlJobSelect: React.FC<MlJobSelectProps> = ({ describedByIds = [], field }) => {
   const jobId = field.value as string;
   const { isInvalid, errorMessage } = getFieldValidityAndErrorMessage(field);
   const [isLoading, siemJobs] = useSiemJobs(false);
@@ -41,7 +42,14 @@ export const MlJobSelect: React.FC<MlJobSelectProps> = ({ field }) => {
   }));
 
   return (
-    <EuiFormRow fullWidth label={field.label} isInvalid={isInvalid} error={errorMessage}>
+    <EuiFormRow
+      fullWidth
+      label={field.label}
+      isInvalid={isInvalid}
+      error={errorMessage}
+      data-test-subj="mlJobSelect"
+      describedByIds={describedByIds}
+    >
       <EuiFlexGroup>
         <EuiFlexItem>
           <EuiSuperSelect
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/select_rule_type/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/select_rule_type/index.tsx
index 229ccde54ecab..219b3d6dc4d58 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/select_rule_type/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/select_rule_type/index.tsx
@@ -5,19 +5,58 @@
  */
 
 import React, { useCallback } from 'react';
-import { EuiCard, EuiFlexGrid, EuiFlexItem, EuiIcon, EuiFormRow } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiCard,
+  EuiFlexGrid,
+  EuiFlexItem,
+  EuiFormRow,
+  EuiIcon,
+  EuiLink,
+  EuiText,
+} from '@elastic/eui';
 
 import { FieldHook } from '../../../../../shared_imports';
 import { RuleType } from '../../../../../containers/detection_engine/rules/types';
 import * as i18n from './translations';
 import { isMlRule } from '../../helpers';
 
+const MlCardDescription = ({ hasValidLicense = false }: { hasValidLicense?: boolean }) => (
+  <EuiText size="s">
+    {hasValidLicense ? (
+      i18n.ML_TYPE_DESCRIPTION
+    ) : (
+      <FormattedMessage
+        id="xpack.siem.detectionEngine.createRule.stepDefineRule.ruleTypeField.mlTypeDisabledDescription"
+        defaultMessage="Access to ML requires a {subscriptionsLink}."
+        values={{
+          subscriptionsLink: (
+            <EuiLink href="https://www.elastic.co/subscriptions" target="_blank">
+              <FormattedMessage
+                id="xpack.siem.components.stepDefineRule.ruleTypeField.subscriptionsLink"
+                defaultMessage="Platinum subscription"
+              />
+            </EuiLink>
+          ),
+        }}
+      />
+    )}
+  </EuiText>
+);
+
 interface SelectRuleTypeProps {
+  describedByIds?: string[];
   field: FieldHook;
-  isReadOnly: boolean;
+  hasValidLicense?: boolean;
+  isReadOnly?: boolean;
 }
 
-export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({ field, isReadOnly = false }) => {
+export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({
+  describedByIds = [],
+  field,
+  hasValidLicense = false,
+  isReadOnly = false,
+}) => {
   const ruleType = field.value as RuleType;
   const setType = useCallback(
     (type: RuleType) => {
@@ -27,10 +66,15 @@ export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({ field, isReadOnl
   );
   const setMl = useCallback(() => setType('machine_learning'), [setType]);
   const setQuery = useCallback(() => setType('query'), [setType]);
-  const license = true; // TODO
+  const mlCardDisabled = isReadOnly || !hasValidLicense;
 
   return (
-    <EuiFormRow label={field.label} fullWidth>
+    <EuiFormRow
+      fullWidth
+      data-test-subj="selectRuleType"
+      describedByIds={describedByIds}
+      label={field.label}
+    >
       <EuiFlexGrid columns={4}>
         <EuiFlexItem>
           <EuiCard
@@ -47,11 +91,11 @@ export const SelectRuleType: React.FC<SelectRuleTypeProps> = ({ field, isReadOnl
         <EuiFlexItem>
           <EuiCard
             title={i18n.ML_TYPE_TITLE}
-            description={license ? i18n.ML_TYPE_DESCRIPTION : i18n.ML_TYPE_DISABLED_DESCRIPTION}
-            isDisabled={!license}
+            description={<MlCardDescription hasValidLicense={hasValidLicense} />}
             icon={<EuiIcon size="l" type="machineLearningApp" />}
+            isDisabled={mlCardDisabled}
             selectable={{
-              isDisabled: isReadOnly,
+              isDisabled: mlCardDisabled,
               onClick: setMl,
               isSelected: isMlRule(ruleType),
             }}
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/select_rule_type/translations.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/select_rule_type/translations.ts
index 32b860e8f703e..4dc0a89af4a49 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/select_rule_type/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/select_rule_type/translations.ts
@@ -33,10 +33,3 @@ export const ML_TYPE_DESCRIPTION = i18n.translate(
     defaultMessage: 'Select ML job to detect anomalous activity.',
   }
 );
-
-export const ML_TYPE_DISABLED_DESCRIPTION = i18n.translate(
-  'xpack.siem.detectionEngine.createRule.stepDefineRule.ruleTypeField.mlTypeDisabledDescription',
-  {
-    defaultMessage: 'Access to ML requires a Platinum subscription.',
-  }
-);
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/default_value.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/default_value.ts
index 417133f230610..52b0038507b59 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/default_value.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/default_value.ts
@@ -5,7 +5,6 @@
  */
 
 import { AboutStepRule } from '../../types';
-import { DEFAULT_TIMELINE_TITLE } from '../../../../../components/timeline/translations';
 
 export const threatDefault = [
   {
@@ -24,10 +23,6 @@ export const stepAboutDefaultValue: AboutStepRule = {
   references: [''],
   falsePositives: [''],
   tags: [],
-  timeline: {
-    id: null,
-    title: DEFAULT_TIMELINE_TITLE,
-  },
   threat: threatDefault,
   note: '',
 };
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/index.tsx
index bfb123f3f3204..58b6ca54f5bbd 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/index.tsx
@@ -37,7 +37,6 @@ import { stepAboutDefaultValue } from './default_value';
 import { isUrlInvalid } from './helpers';
 import { schema } from './schema';
 import * as I18n from './translations';
-import { PickTimeline } from '../pick_timeline';
 import { StepContentWrapper } from '../step_content_wrapper';
 import { MarkdownEditorForm } from '../../../../../components/markdown_editor/form';
 
@@ -216,15 +215,6 @@ const StepAboutRuleComponent: FC<StepAboutRuleProps> = ({
             buttonContent={AdvancedSettingsAccordionButton}
           >
             <EuiSpacer size="m" />
-            <UseField
-              path="timeline"
-              component={PickTimeline}
-              componentProps={{
-                idAria: 'detectionEngineStepAboutRuleTimeline',
-                isDisabled: isLoading,
-                dataTestSubj: 'detectionEngineStepAboutRuleTimeline',
-              }}
-            />
             <UseField
               path="references"
               component={AddItem}
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/schema.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/schema.tsx
index 7c1ab09b7309c..8cb38b9dc7393 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/schema.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_about_rule/schema.tsx
@@ -91,21 +91,6 @@ export const schema: FormSchema = {
       }
     ),
   },
-  timeline: {
-    label: i18n.translate(
-      'xpack.siem.detectionEngine.createRule.stepAboutRule.fieldTimelineTemplateLabel',
-      {
-        defaultMessage: 'Timeline template',
-      }
-    ),
-    helpText: i18n.translate(
-      'xpack.siem.detectionEngine.createRule.stepAboutRule.fieldTimelineTemplateHelpText',
-      {
-        defaultMessage:
-          'Select an existing timeline to use as a template when investigating generated signals.',
-      }
-    ),
-  },
   references: {
     label: i18n.translate(
       'xpack.siem.detectionEngine.createRule.stepAboutRule.fieldReferenceUrlsLabel',
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/index.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/index.tsx
index d3ef185f3786b..4027c98a52ace 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/index.tsx
@@ -12,14 +12,15 @@ import {
   EuiFormRow,
   EuiButton,
 } from '@elastic/eui';
-import { isEmpty } from 'lodash/fp';
-import React, { FC, memo, useCallback, useState, useEffect } from 'react';
+import React, { FC, memo, useCallback, useState, useEffect, useContext } from 'react';
 import styled from 'styled-components';
 import deepEqual from 'fast-deep-equal';
 
 import { IIndexPattern } from '../../../../../../../../../../src/plugins/data/public';
 import { useFetchIndexPatterns } from '../../../../../containers/detection_engine/rules';
 import { DEFAULT_INDEX_KEY } from '../../../../../../common/constants';
+import { DEFAULT_TIMELINE_TITLE } from '../../../../../components/timeline/translations';
+import { MlCapabilitiesContext } from '../../../../../components/ml/permissions/ml_capabilities_provider';
 import { useUiSetting$ } from '../../../../../lib/kibana';
 import { setFieldValue, isMlRule } from '../../helpers';
 import * as RuleI18n from '../../translations';
@@ -29,6 +30,7 @@ import { QueryBarDefineRule } from '../query_bar';
 import { SelectRuleType } from '../select_rule_type';
 import { AnomalyThresholdSlider } from '../anomaly_threshold_slider';
 import { MlJobSelect } from '../ml_job_select';
+import { PickTimeline } from '../pick_timeline';
 import { StepContentWrapper } from '../step_content_wrapper';
 import {
   Field,
@@ -60,6 +62,10 @@ const stepDefineDefaultValue: DefineStepRule = {
     filters: [],
     saved_id: undefined,
   },
+  timeline: {
+    id: null,
+    title: DEFAULT_TIMELINE_TITLE,
+  },
 };
 
 const MyLabelButton = styled(EuiButtonEmpty)`
@@ -76,23 +82,6 @@ MyLabelButton.defaultProps = {
   flush: 'right',
 };
 
-const getStepDefaultValue = (
-  indicesConfig: string[],
-  defaultValues: DefineStepRule | null
-): DefineStepRule => {
-  if (defaultValues != null) {
-    return {
-      ...defaultValues,
-      isNew: false,
-    };
-  } else {
-    return {
-      ...stepDefineDefaultValue,
-      index: indicesConfig != null ? indicesConfig : [],
-    };
-  }
-};
-
 const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   addPadding = false,
   defaultValues,
@@ -103,19 +92,18 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   setForm,
   setStepData,
 }) => {
+  const mlCapabilities = useContext(MlCapabilitiesContext);
   const [openTimelineSearch, setOpenTimelineSearch] = useState(false);
-  const [localUseIndicesConfig, setLocalUseIndicesConfig] = useState(false);
+  const [indexModified, setIndexModified] = useState(false);
   const [localIsMlRule, setIsMlRule] = useState(false);
   const [indicesConfig] = useUiSetting$<string[]>(DEFAULT_INDEX_KEY);
-  const [mylocalIndicesConfig, setMyLocalIndicesConfig] = useState(
-    defaultValues != null ? defaultValues.index : indicesConfig ?? []
-  );
+  const [myStepData, setMyStepData] = useState<DefineStepRule>({
+    ...stepDefineDefaultValue,
+    index: indicesConfig ?? [],
+  });
   const [
     { browserFields, indexPatterns: indexPatternQueryBar, isLoading: indexPatternLoadingQueryBar },
-  ] = useFetchIndexPatterns(mylocalIndicesConfig);
-  const [myStepData, setMyStepData] = useState<DefineStepRule>(
-    getStepDefaultValue(indicesConfig, null)
-  );
+  ] = useFetchIndexPatterns(myStepData.index);
 
   const { form } = useForm({
     defaultValue: myStepData,
@@ -136,15 +124,13 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
   }, [form]);
 
   useEffect(() => {
-    if (indicesConfig != null && defaultValues != null) {
-      const myDefaultValues = getStepDefaultValue(indicesConfig, defaultValues);
-      if (!deepEqual(myDefaultValues, myStepData)) {
-        setMyStepData(myDefaultValues);
-        setLocalUseIndicesConfig(deepEqual(myDefaultValues.index, indicesConfig));
-        setFieldValue(form, schema, myDefaultValues);
-      }
+    const { isNew, ...values } = myStepData;
+    if (defaultValues != null && !deepEqual(values, defaultValues)) {
+      const newValues = { ...values, ...defaultValues, isNew: false };
+      setMyStepData(newValues);
+      setFieldValue(form, schema, newValues);
     }
-  }, [defaultValues, indicesConfig]);
+  }, [defaultValues, setMyStepData, setFieldValue]);
 
   useEffect(() => {
     if (setForm != null) {
@@ -182,6 +168,8 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
             path="ruleType"
             component={SelectRuleType}
             componentProps={{
+              describedByIds: ['detectionEngineStepDefineRuleType'],
+              hasValidLicense: mlCapabilities.isPlatinumOrTrialLicense,
               isReadOnly: isUpdateView,
             }}
           />
@@ -191,7 +179,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
                 path="index"
                 config={{
                   ...schema.index,
-                  labelAppend: !localUseIndicesConfig ? (
+                  labelAppend: indexModified ? (
                     <MyLabelButton onClick={handleResetIndices} iconType="refresh">
                       {i18n.RESET_DEFAULT_INDEX}
                     </MyLabelButton>
@@ -220,7 +208,6 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
                 component={QueryBarDefineRule}
                 componentProps={{
                   browserFields,
-                  loading: indexPatternLoadingQueryBar,
                   idAria: 'detectionEngineStepDefineRuleQueryBar',
                   indexPattern: indexPatternQueryBar,
                   isDisabled: isLoading,
@@ -234,21 +221,38 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
           </EuiFormRow>
           <EuiFormRow fullWidth style={{ display: localIsMlRule ? 'flex' : 'none' }}>
             <>
-              <UseField path="machineLearningJobId" component={MlJobSelect} />
-              <UseField path="anomalyThreshold" component={AnomalyThresholdSlider} />
+              <UseField
+                path="machineLearningJobId"
+                component={MlJobSelect}
+                componentProps={{
+                  describedByIds: ['detectionEngineStepDefineRulemachineLearningJobId'],
+                }}
+              />
+              <UseField
+                path="anomalyThreshold"
+                component={AnomalyThresholdSlider}
+                componentProps={{
+                  describedByIds: ['detectionEngineStepDefineRuleAnomalyThreshold'],
+                }}
+              />
             </>
           </EuiFormRow>
+          <UseField
+            path="timeline"
+            component={PickTimeline}
+            componentProps={{
+              idAria: 'detectionEngineStepDefineRuleTimeline',
+              isDisabled: isLoading,
+              dataTestSubj: 'detectionEngineStepDefineRuleTimeline',
+            }}
+          />
           <FormDataProvider pathsToWatch={['index', 'ruleType']}>
             {({ index, ruleType }) => {
               if (index != null) {
-                if (deepEqual(index, indicesConfig) && !localUseIndicesConfig) {
-                  setLocalUseIndicesConfig(true);
-                }
-                if (!deepEqual(index, indicesConfig) && localUseIndicesConfig) {
-                  setLocalUseIndicesConfig(false);
-                }
-                if (index != null && !isEmpty(index) && !deepEqual(index, mylocalIndicesConfig)) {
-                  setMyLocalIndicesConfig(index);
+                if (deepEqual(index, indicesConfig) && indexModified) {
+                  setIndexModified(false);
+                } else if (!deepEqual(index, indicesConfig) && !indexModified) {
+                  setIndexModified(true);
                 }
               }
 
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/schema.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/schema.tsx
index bcfcd4f4ee09d..271c8fabed3a5 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/schema.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/components/step_define_rule/schema.tsx
@@ -158,4 +158,19 @@ export const schema: FormSchema = {
       },
     ],
   },
+  timeline: {
+    label: i18n.translate(
+      'xpack.siem.detectionEngine.createRule.stepAboutRule.fieldTimelineTemplateLabel',
+      {
+        defaultMessage: 'Timeline template',
+      }
+    ),
+    helpText: i18n.translate(
+      'xpack.siem.detectionEngine.createRule.stepAboutRule.fieldTimelineTemplateHelpText',
+      {
+        defaultMessage:
+          'Select an existing timeline to use as a template when investigating generated signals.',
+      }
+    ),
+  },
 };
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.test.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.test.ts
index ea6b02924cb3e..dc0459c54adb0 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.test.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.test.ts
@@ -19,6 +19,7 @@ import {
   formatScheduleStepData,
   formatAboutStepData,
   formatRule,
+  filterRuleFieldsForType,
 } from './helpers';
 import {
   mockDefineStepRule,
@@ -88,6 +89,8 @@ describe('helpers', () => {
         saved_id: 'test123',
         index: ['filebeat-'],
         type: 'saved_query',
+        timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+        timeline_title: 'Titled timeline',
       };
 
       expect(result).toEqual(expected);
@@ -109,6 +112,119 @@ describe('helpers', () => {
         index: ['filebeat-'],
         saved_id: '',
         type: 'query',
+        timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+        timeline_title: 'Titled timeline',
+      };
+
+      expect(result).toEqual(expected);
+    });
+
+    test('returns formatted object without timeline_id and timeline_title if timeline.id is null', () => {
+      const mockStepData = {
+        ...mockData,
+      };
+      delete mockStepData.timeline.id;
+
+      const result: DefineStepRuleJson = formatDefineStepData(mockStepData);
+
+      const expected = {
+        language: 'kuery',
+        filters: mockQueryBar.filters,
+        query: 'test query',
+        index: ['filebeat-'],
+        saved_id: 'test123',
+        type: 'saved_query',
+      };
+
+      expect(result).toEqual(expected);
+    });
+
+    test('returns formatted object with timeline_id and timeline_title if timeline.id is "', () => {
+      const mockStepData = {
+        ...mockData,
+        timeline: {
+          ...mockData.timeline,
+          id: '',
+        },
+      };
+      const result: DefineStepRuleJson = formatDefineStepData(mockStepData);
+
+      const expected = {
+        language: 'kuery',
+        filters: mockQueryBar.filters,
+        query: 'test query',
+        index: ['filebeat-'],
+        saved_id: 'test123',
+        type: 'saved_query',
+        timeline_id: '',
+        timeline_title: 'Titled timeline',
+      };
+
+      expect(result).toEqual(expected);
+    });
+
+    test('returns formatted object without timeline_id and timeline_title if timeline.title is null', () => {
+      const mockStepData = {
+        ...mockData,
+        timeline: {
+          ...mockData.timeline,
+          id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+        },
+      };
+      delete mockStepData.timeline.title;
+      const result: DefineStepRuleJson = formatDefineStepData(mockStepData);
+
+      const expected = {
+        language: 'kuery',
+        filters: mockQueryBar.filters,
+        query: 'test query',
+        index: ['filebeat-'],
+        saved_id: 'test123',
+        type: 'saved_query',
+      };
+
+      expect(result).toEqual(expected);
+    });
+
+    test('returns formatted object with timeline_id and timeline_title if timeline.title is "', () => {
+      const mockStepData = {
+        ...mockData,
+        timeline: {
+          ...mockData.timeline,
+          title: '',
+        },
+      };
+      const result: DefineStepRuleJson = formatDefineStepData(mockStepData);
+
+      const expected = {
+        language: 'kuery',
+        filters: mockQueryBar.filters,
+        query: 'test query',
+        index: ['filebeat-'],
+        saved_id: 'test123',
+        type: 'saved_query',
+        timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+        timeline_title: '',
+      };
+
+      expect(result).toEqual(expected);
+    });
+
+    test('returns ML fields if type is machine_learning', () => {
+      const mockStepData: DefineStepRule = {
+        ...mockData,
+        ruleType: 'machine_learning',
+        anomalyThreshold: 44,
+        machineLearningJobId: 'some_jobert_id',
+      };
+      const result: DefineStepRuleJson = formatDefineStepData(mockStepData);
+
+      const expected = {
+        type: 'machine_learning',
+        anomaly_threshold: 44,
+        machine_learning_job_id: 'some_jobert_id',
+        timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+        timeline_title: 'Titled timeline',
       };
 
       expect(result).toEqual(expected);
@@ -249,8 +365,6 @@ describe('helpers', () => {
             ],
           },
         ],
-        timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
-        timeline_title: 'Titled timeline',
       };
 
       expect(result).toEqual(expected);
@@ -289,8 +403,6 @@ describe('helpers', () => {
             ],
           },
         ],
-        timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
-        timeline_title: 'Titled timeline',
       };
 
       expect(result).toEqual(expected);
@@ -327,160 +439,6 @@ describe('helpers', () => {
             ],
           },
         ],
-        timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
-        timeline_title: 'Titled timeline',
-      };
-
-      expect(result).toEqual(expected);
-    });
-
-    test('returns formatted object without timeline_id and timeline_title if timeline.id is null', () => {
-      const mockStepData = {
-        ...mockData,
-      };
-      delete mockStepData.timeline.id;
-      const result: AboutStepRuleJson = formatAboutStepData(mockStepData);
-      const expected = {
-        description: '24/7',
-        false_positives: ['test'],
-        name: 'Query with rule-id',
-        note: '# this is some markdown documentation',
-        references: ['www.test.co'],
-        risk_score: 21,
-        severity: 'low',
-        tags: ['tag1', 'tag2'],
-        threat: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: '1234',
-              name: 'tactic1',
-              reference: 'reference1',
-            },
-            technique: [
-              {
-                id: '456',
-                name: 'technique1',
-                reference: 'technique reference',
-              },
-            ],
-          },
-        ],
-      };
-
-      expect(result).toEqual(expected);
-    });
-
-    test('returns formatted object with timeline_id and timeline_title if timeline.id is "', () => {
-      const mockStepData = {
-        ...mockData,
-        timeline: {
-          ...mockData.timeline,
-          id: '',
-        },
-      };
-      const result: AboutStepRuleJson = formatAboutStepData(mockStepData);
-      const expected = {
-        description: '24/7',
-        false_positives: ['test'],
-        name: 'Query with rule-id',
-        note: '# this is some markdown documentation',
-        references: ['www.test.co'],
-        risk_score: 21,
-        severity: 'low',
-        tags: ['tag1', 'tag2'],
-        threat: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: '1234',
-              name: 'tactic1',
-              reference: 'reference1',
-            },
-            technique: [
-              {
-                id: '456',
-                name: 'technique1',
-                reference: 'technique reference',
-              },
-            ],
-          },
-        ],
-        timeline_id: '',
-        timeline_title: 'Titled timeline',
-      };
-
-      expect(result).toEqual(expected);
-    });
-
-    test('returns formatted object without timeline_id and timeline_title if timeline.title is null', () => {
-      const mockStepData = {
-        ...mockData,
-        timeline: {
-          ...mockData.timeline,
-          id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
-        },
-      };
-      delete mockStepData.timeline.title;
-      const result: AboutStepRuleJson = formatAboutStepData(mockStepData);
-      const expected = {
-        description: '24/7',
-        false_positives: ['test'],
-        name: 'Query with rule-id',
-        note: '# this is some markdown documentation',
-        references: ['www.test.co'],
-        risk_score: 21,
-        severity: 'low',
-        tags: ['tag1', 'tag2'],
-        threat: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: {
-              id: '1234',
-              name: 'tactic1',
-              reference: 'reference1',
-            },
-            technique: [
-              {
-                id: '456',
-                name: 'technique1',
-                reference: 'technique reference',
-              },
-            ],
-          },
-        ],
-      };
-
-      expect(result).toEqual(expected);
-    });
-
-    test('returns formatted object with timeline_id and timeline_title if timeline.title is "', () => {
-      const mockStepData = {
-        ...mockData,
-        timeline: {
-          id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
-          title: '',
-        },
-      };
-      const result: AboutStepRuleJson = formatAboutStepData(mockStepData);
-      const expected = {
-        description: '24/7',
-        false_positives: ['test'],
-        name: 'Query with rule-id',
-        note: '# this is some markdown documentation',
-        references: ['www.test.co'],
-        risk_score: 21,
-        severity: 'low',
-        tags: ['tag1', 'tag2'],
-        threat: [
-          {
-            framework: 'MITRE ATT&CK',
-            tactic: { id: '1234', name: 'tactic1', reference: 'reference1' },
-            technique: [{ id: '456', name: 'technique1', reference: 'technique reference' }],
-          },
-        ],
-        timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
-        timeline_title: '',
       };
 
       expect(result).toEqual(expected);
@@ -539,8 +497,6 @@ describe('helpers', () => {
             technique: [{ id: '456', name: 'technique1', reference: 'technique reference' }],
           },
         ],
-        timeline_id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
-        timeline_title: 'Titled timeline',
       };
 
       expect(result).toEqual(expected);
@@ -583,4 +539,48 @@ describe('helpers', () => {
       expect(result.id).toBeUndefined();
     });
   });
+
+  describe('filterRuleFieldsForType', () => {
+    let fields: DefineStepRule;
+
+    beforeEach(() => {
+      fields = mockDefineStepRule();
+    });
+
+    it('removes query fields if the type is machine learning', () => {
+      const result = filterRuleFieldsForType(fields, 'machine_learning');
+      expect(result).not.toHaveProperty('index');
+      expect(result).not.toHaveProperty('queryBar');
+    });
+
+    it('leaves ML fields if the type is machine learning', () => {
+      const result = filterRuleFieldsForType(fields, 'machine_learning');
+      expect(result).toHaveProperty('anomalyThreshold');
+      expect(result).toHaveProperty('machineLearningJobId');
+    });
+
+    it('leaves arbitrary fields if the type is machine learning', () => {
+      const result = filterRuleFieldsForType(fields, 'machine_learning');
+      expect(result).toHaveProperty('timeline');
+      expect(result).toHaveProperty('ruleType');
+    });
+
+    it('removes ML fields if the type is not machine learning', () => {
+      const result = filterRuleFieldsForType(fields, 'query');
+      expect(result).not.toHaveProperty('anomalyThreshold');
+      expect(result).not.toHaveProperty('machineLearningJobId');
+    });
+
+    it('leaves query fields if the type is query', () => {
+      const result = filterRuleFieldsForType(fields, 'query');
+      expect(result).toHaveProperty('index');
+      expect(result).toHaveProperty('queryBar');
+    });
+
+    it('leaves arbitrary fields if the type is query', () => {
+      const result = filterRuleFieldsForType(fields, 'query');
+      expect(result).toHaveProperty('timeline');
+      expect(result).toHaveProperty('ruleType');
+    });
+  });
 });
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.ts
index 1f3379bf681bb..f8900e6a1129e 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/create/helpers.ts
@@ -64,27 +64,35 @@ export const filterRuleFieldsForType = <T extends RuleFields>(fields: T, type: R
 
 export const formatDefineStepData = (defineStepData: DefineStepRule): DefineStepRuleJson => {
   const ruleFields = filterRuleFieldsForType(defineStepData, defineStepData.ruleType);
+  const { ruleType, timeline } = ruleFields;
+  const baseFields = {
+    type: ruleType,
+    ...(timeline.id != null &&
+      timeline.title != null && {
+        timeline_id: timeline.id,
+        timeline_title: timeline.title,
+      }),
+  };
 
-  if (isMlFields(ruleFields)) {
-    const { anomalyThreshold, machineLearningJobId, isNew, ruleType, ...rest } = ruleFields;
-    return {
-      ...rest,
-      type: ruleType,
-      anomaly_threshold: anomalyThreshold,
-      machine_learning_job_id: machineLearningJobId,
-    };
-  } else {
-    const { queryBar, isNew, ruleType, ...rest } = ruleFields;
-    return {
-      ...rest,
-      type: ruleType,
-      filters: queryBar?.filters,
-      language: queryBar?.query?.language,
-      query: queryBar?.query?.query as string,
-      saved_id: queryBar?.saved_id,
-      ...(ruleType === 'query' && queryBar?.saved_id ? { type: 'saved_query' as RuleType } : {}),
-    };
-  }
+  const typeFields = isMlFields(ruleFields)
+    ? {
+        anomaly_threshold: ruleFields.anomalyThreshold,
+        machine_learning_job_id: ruleFields.machineLearningJobId,
+      }
+    : {
+        index: ruleFields.index,
+        filters: ruleFields.queryBar?.filters,
+        language: ruleFields.queryBar?.query?.language,
+        query: ruleFields.queryBar?.query?.query as string,
+        saved_id: ruleFields.queryBar?.saved_id,
+        ...(ruleType === 'query' &&
+          ruleFields.queryBar?.saved_id && { type: 'saved_query' as RuleType }),
+      };
+
+  return {
+    ...baseFields,
+    ...typeFields,
+  };
 };
 
 export const formatScheduleStepData = (scheduleData: ScheduleStepRule): ScheduleStepRuleJson => {
@@ -108,26 +116,11 @@ export const formatScheduleStepData = (scheduleData: ScheduleStepRule): Schedule
 };
 
 export const formatAboutStepData = (aboutStepData: AboutStepRule): AboutStepRuleJson => {
-  const {
-    falsePositives,
-    references,
-    riskScore,
-    threat,
-    timeline,
-    isNew,
-    note,
-    ...rest
-  } = aboutStepData;
+  const { falsePositives, references, riskScore, threat, isNew, note, ...rest } = aboutStepData;
   return {
     false_positives: falsePositives.filter(item => !isEmpty(item)),
     references: references.filter(item => !isEmpty(item)),
     risk_score: riskScore,
-    ...(timeline.id != null && timeline.title != null
-      ? {
-          timeline_id: timeline.id,
-          timeline_title: timeline.title,
-        }
-      : {}),
     threat: threat
       .filter(singleThreat => singleThreat.tactic.name !== 'none')
       .map(singleThreat => ({
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.test.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.test.tsx
index ee43ae5f1d6e2..3224c605192e6 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.test.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.test.tsx
@@ -65,6 +65,10 @@ describe('rule helpers', () => {
           ],
           saved_id: 'test123',
         },
+        timeline: {
+          id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+          title: 'Titled timeline',
+        },
       };
       const aboutRuleStepData = {
         description: '24/7',
@@ -93,10 +97,6 @@ describe('rule helpers', () => {
             ],
           },
         ],
-        timeline: {
-          id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
-          title: 'Titled timeline',
-        },
       };
       const scheduleRuleStepData = { enabled: true, from: '0s', interval: '5m', isNew: false };
       const aboutRuleDataDetailsData = {
@@ -112,16 +112,6 @@ describe('rule helpers', () => {
   });
 
   describe('getAboutStepsData', () => {
-    test('returns timeline id and title of null if they do not exist on rule', () => {
-      const mockedRule = mockRuleWithEverything('test-id');
-      delete mockedRule.timeline_id;
-      delete mockedRule.timeline_title;
-      const result: AboutStepRule = getAboutStepsData(mockedRule, false);
-
-      expect(result.timeline.id).toBeNull();
-      expect(result.timeline.title).toBeNull();
-    });
-
     test('returns name, description, and note as empty string if detailsView is true', () => {
       const result: AboutStepRule = getAboutStepsData(mockRuleWithEverything('test-id'), true);
 
@@ -195,6 +185,10 @@ describe('rule helpers', () => {
           filters: [],
           saved_id: "Garrett's IP",
         },
+        timeline: {
+          id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+          title: 'Untitled timeline',
+        },
       };
 
       expect(result).toEqual(expected);
@@ -220,10 +214,24 @@ describe('rule helpers', () => {
           filters: [],
           saved_id: undefined,
         },
+        timeline: {
+          id: '86aa74d0-2136-11ea-9864-ebc8cc1cb8c2',
+          title: 'Untitled timeline',
+        },
       };
 
       expect(result).toEqual(expected);
     });
+
+    test('returns timeline id and title of null if they do not exist on rule', () => {
+      const mockedRule = mockRuleWithEverything('test-id');
+      delete mockedRule.timeline_id;
+      delete mockedRule.timeline_title;
+      const result: DefineStepRule = getDefineStepsData(mockedRule);
+
+      expect(result.timeline.id).toBeNull();
+      expect(result.timeline.title).toBeNull();
+    });
   });
 
   describe('getHumanizedDuration', () => {
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.tsx b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.tsx
index e59ca5e7e14e5..2ace154482a27 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/helpers.tsx
@@ -42,20 +42,22 @@ export const getStepsData = ({
   return { aboutRuleData, modifiedAboutRuleDetailsData, defineRuleData, scheduleRuleData };
 };
 
-export const getDefineStepsData = (rule: Rule): DefineStepRule => {
-  return {
-    isNew: false,
-    ruleType: rule.type,
-    anomalyThreshold: rule.anomaly_threshold ?? 50,
-    machineLearningJobId: rule.machine_learning_job_id ?? '',
-    index: rule.index ?? [],
-    queryBar: {
-      query: { query: rule.query ?? '', language: rule.language ?? '' },
-      filters: (rule.filters ?? []) as Filter[],
-      saved_id: rule.saved_id,
-    },
-  };
-};
+export const getDefineStepsData = (rule: Rule): DefineStepRule => ({
+  isNew: false,
+  ruleType: rule.type,
+  anomalyThreshold: rule.anomaly_threshold ?? 50,
+  machineLearningJobId: rule.machine_learning_job_id ?? '',
+  index: rule.index ?? [],
+  queryBar: {
+    query: { query: rule.query ?? '', language: rule.language ?? '' },
+    filters: (rule.filters ?? []) as Filter[],
+    saved_id: rule.saved_id,
+  },
+  timeline: {
+    id: rule.timeline_id ?? null,
+    title: rule.timeline_title ?? null,
+  },
+});
 
 export const getScheduleStepsData = (rule: Rule): ScheduleStepRule => {
   const { enabled, interval, from } = rule;
@@ -94,8 +96,6 @@ export const getAboutStepsData = (rule: Rule, detailsView: boolean): AboutStepRu
     risk_score: riskScore,
     tags,
     threat,
-    timeline_id: timelineId,
-    timeline_title: timelineTitle,
   } = rule;
 
   return {
@@ -109,10 +109,6 @@ export const getAboutStepsData = (rule: Rule, detailsView: boolean): AboutStepRu
     riskScore,
     falsePositives,
     threat: threat as IMitreEnterpriseAttack[],
-    timeline: {
-      id: timelineId ?? null,
-      title: timelineTitle ?? null,
-    },
   };
 };
 
diff --git a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/types.ts b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/types.ts
index 447b5dc6325ee..d4caa4639f338 100644
--- a/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/types.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/detection_engine/rules/types.ts
@@ -57,7 +57,6 @@ export interface AboutStepRule extends StepRuleData {
   references: string[];
   falsePositives: string[];
   tags: string[];
-  timeline: FieldValueTimeline;
   threat: IMitreEnterpriseAttack[];
   note: string;
 }
@@ -73,6 +72,7 @@ export interface DefineStepRule extends StepRuleData {
   machineLearningJobId: string;
   queryBar: FieldValueQueryBar;
   ruleType: RuleType;
+  timeline: FieldValueTimeline;
 }
 
 export interface ScheduleStepRule extends StepRuleData {
@@ -90,6 +90,8 @@ export interface DefineStepRuleJson {
   saved_id?: string;
   query?: string;
   language?: string;
+  timeline_id?: string;
+  timeline_title?: string;
   type: RuleType;
 }
 
@@ -101,8 +103,6 @@ export interface AboutStepRuleJson {
   references: string[];
   false_positives: string[];
   tags: string[];
-  timeline_id?: string;
-  timeline_title?: string;
   threat: IMitreEnterpriseAttack[];
   note?: string;
 }
diff --git a/x-pack/legacy/plugins/siem/public/pages/home/home_navigations.tsx b/x-pack/legacy/plugins/siem/public/pages/home/home_navigations.tsx
index a087dca38de00..543469e2fddb7 100644
--- a/x-pack/legacy/plugins/siem/public/pages/home/home_navigations.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/home/home_navigations.tsx
@@ -54,7 +54,7 @@ export const navTabs: SiemNavTab = {
   [SiemPageName.case]: {
     id: SiemPageName.case,
     name: i18n.CASE,
-    href: getCaseUrl(),
+    href: getCaseUrl(null),
     disabled: false,
     urlKey: 'case',
   },
diff --git a/x-pack/legacy/plugins/siem/public/pages/hosts/navigation/authentications_query_tab_body.tsx b/x-pack/legacy/plugins/siem/public/pages/hosts/navigation/authentications_query_tab_body.tsx
index fb083b7a7da2f..5a6759fd07221 100644
--- a/x-pack/legacy/plugins/siem/public/pages/hosts/navigation/authentications_query_tab_body.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/hosts/navigation/authentications_query_tab_body.tsx
@@ -25,15 +25,15 @@ const AuthenticationTableManage = manageQuery(AuthenticationTable);
 const ID = 'authenticationsOverTimeQuery';
 const authStackByOptions: MatrixHistogramOption[] = [
   {
-    text: 'event.type',
-    value: 'event.type',
+    text: 'event.outcome',
+    value: 'event.outcome',
   },
 ];
-const DEFAULT_STACK_BY = 'event.type';
+const DEFAULT_STACK_BY = 'event.outcome';
 
 enum AuthMatrixDataGroup {
-  authSuccess = 'authentication_success',
-  authFailure = 'authentication_failure',
+  authSuccess = 'success',
+  authFailure = 'failure',
 }
 
 export const authMatrixDataMappingFields: MatrixHistogramMappingTypes = {
diff --git a/x-pack/legacy/plugins/siem/public/pages/overview/sidebar/index.tsx b/x-pack/legacy/plugins/siem/public/pages/overview/sidebar/index.tsx
index ad2821edde411..3797eae2bb853 100644
--- a/x-pack/legacy/plugins/siem/public/pages/overview/sidebar/index.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/overview/sidebar/index.tsx
@@ -6,13 +6,27 @@
 
 import React, { useState } from 'react';
 
-import { FilterMode } from '../../../components/recent_timelines/types';
+import { FilterMode as RecentTimelinesFilterMode } from '../../../components/recent_timelines/types';
+import { FilterMode as RecentCasesFilterMode } from '../../../components/recent_cases/types';
+
 import { Sidebar } from './sidebar';
 
 export const StatefulSidebar = React.memo(() => {
-  const [filterBy, setFilterBy] = useState<FilterMode>('favorites');
+  const [recentTimelinesFilterBy, setRecentTimelinesFilterBy] = useState<RecentTimelinesFilterMode>(
+    'favorites'
+  );
+  const [recentCasesFilterBy, setRecentCasesFilterBy] = useState<RecentCasesFilterMode>(
+    'recentlyCreated'
+  );
 
-  return <Sidebar filterBy={filterBy} setFilterBy={setFilterBy} />;
+  return (
+    <Sidebar
+      recentCasesFilterBy={recentCasesFilterBy}
+      setRecentCasesFilterBy={setRecentCasesFilterBy}
+      recentTimelinesFilterBy={recentTimelinesFilterBy}
+      setRecentTimelinesFilterBy={setRecentTimelinesFilterBy}
+    />
+  );
 });
 
 StatefulSidebar.displayName = 'StatefulSidebar';
diff --git a/x-pack/legacy/plugins/siem/public/pages/overview/sidebar/sidebar.tsx b/x-pack/legacy/plugins/siem/public/pages/overview/sidebar/sidebar.tsx
index d3b85afe62a2a..52e36b472a0ec 100644
--- a/x-pack/legacy/plugins/siem/public/pages/overview/sidebar/sidebar.tsx
+++ b/x-pack/legacy/plugins/siem/public/pages/overview/sidebar/sidebar.tsx
@@ -8,12 +8,17 @@ import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
 import React, { useMemo } from 'react';
 import styled from 'styled-components';
 
-import { Filters } from '../../../components/recent_timelines/filters';
+import { Filters as RecentCasesFilters } from '../../../components/recent_cases/filters';
+import { Filters as RecentTimelinesFilters } from '../../../components/recent_timelines/filters';
 import { ENABLE_NEWS_FEED_SETTING, NEWS_FEED_URL_SETTING } from '../../../../common/constants';
+import { StatefulRecentCases } from '../../../components/recent_cases';
 import { StatefulRecentTimelines } from '../../../components/recent_timelines';
 import { StatefulNewsFeed } from '../../../components/news_feed';
-import { FilterMode } from '../../../components/recent_timelines/types';
+import { FilterMode as RecentTimelinesFilterMode } from '../../../components/recent_timelines/types';
+import { FilterMode as RecentCasesFilterMode } from '../../../components/recent_cases/types';
+import { DEFAULT_FILTER_OPTIONS } from '../../../containers/case/use_get_cases';
 import { SidebarHeader } from '../../../components/sidebar_header';
+import { useCurrentUser } from '../../../lib/kibana';
 import { useApolloClient } from '../../../utils/apollo_context';
 
 import * as i18n from '../translations';
@@ -22,35 +27,93 @@ const SidebarFlexGroup = styled(EuiFlexGroup)`
   width: 305px;
 `;
 
+const SidebarSpacerComponent = () => (
+  <EuiFlexItem grow={false}>
+    <EuiSpacer size="xxl" />
+  </EuiFlexItem>
+);
+
+SidebarSpacerComponent.displayName = 'SidebarSpacerComponent';
+const Spacer = React.memo(SidebarSpacerComponent);
+
 export const Sidebar = React.memo<{
-  filterBy: FilterMode;
-  setFilterBy: (filterBy: FilterMode) => void;
-}>(({ filterBy, setFilterBy }) => {
-  const apolloClient = useApolloClient();
-  const RecentTimelinesFilters = useMemo(
-    () => <Filters filterBy={filterBy} setFilterBy={setFilterBy} />,
-    [filterBy, setFilterBy]
-  );
-
-  return (
-    <SidebarFlexGroup direction="column" gutterSize="none">
-      <EuiFlexItem grow={false}>
-        <SidebarHeader title={i18n.RECENT_TIMELINES}>{RecentTimelinesFilters}</SidebarHeader>
-        <StatefulRecentTimelines apolloClient={apolloClient!} filterBy={filterBy} />
-      </EuiFlexItem>
-
-      <EuiFlexItem grow={false}>
-        <EuiSpacer size="xxl" />
-      </EuiFlexItem>
-
-      <EuiFlexItem grow={false}>
-        <StatefulNewsFeed
-          enableNewsFeedSetting={ENABLE_NEWS_FEED_SETTING}
-          newsFeedSetting={NEWS_FEED_URL_SETTING}
+  recentCasesFilterBy: RecentCasesFilterMode;
+  recentTimelinesFilterBy: RecentTimelinesFilterMode;
+  setRecentCasesFilterBy: (filterBy: RecentCasesFilterMode) => void;
+  setRecentTimelinesFilterBy: (filterBy: RecentTimelinesFilterMode) => void;
+}>(
+  ({
+    recentCasesFilterBy,
+    recentTimelinesFilterBy,
+    setRecentCasesFilterBy,
+    setRecentTimelinesFilterBy,
+  }) => {
+    const currentUser = useCurrentUser();
+    const apolloClient = useApolloClient();
+    const recentCasesFilters = useMemo(
+      () => (
+        <RecentCasesFilters
+          filterBy={recentCasesFilterBy}
+          setFilterBy={setRecentCasesFilterBy}
+          showMyRecentlyReported={currentUser != null}
         />
-      </EuiFlexItem>
-    </SidebarFlexGroup>
-  );
-});
+      ),
+      [currentUser, recentCasesFilterBy, setRecentCasesFilterBy]
+    );
+    const recentCasesFilterOptions = useMemo(
+      () =>
+        recentCasesFilterBy === 'myRecentlyReported' && currentUser != null
+          ? {
+              ...DEFAULT_FILTER_OPTIONS,
+              reporters: [
+                {
+                  email: currentUser.email,
+                  full_name: currentUser.fullName,
+                  username: currentUser.username,
+                },
+              ],
+            }
+          : DEFAULT_FILTER_OPTIONS,
+      [currentUser, recentCasesFilterBy]
+    );
+    const recentTimelinesFilters = useMemo(
+      () => (
+        <RecentTimelinesFilters
+          filterBy={recentTimelinesFilterBy}
+          setFilterBy={setRecentTimelinesFilterBy}
+        />
+      ),
+      [recentTimelinesFilterBy, setRecentTimelinesFilterBy]
+    );
+
+    return (
+      <SidebarFlexGroup direction="column" gutterSize="none">
+        <EuiFlexItem grow={false}>
+          <SidebarHeader title={i18n.RECENT_CASES}>{recentCasesFilters}</SidebarHeader>
+          <StatefulRecentCases filterOptions={recentCasesFilterOptions} />
+        </EuiFlexItem>
+
+        <Spacer />
+
+        <EuiFlexItem grow={false}>
+          <SidebarHeader title={i18n.RECENT_TIMELINES}>{recentTimelinesFilters}</SidebarHeader>
+          <StatefulRecentTimelines
+            apolloClient={apolloClient!}
+            filterBy={recentTimelinesFilterBy}
+          />
+        </EuiFlexItem>
+
+        <Spacer />
+
+        <EuiFlexItem grow={false}>
+          <StatefulNewsFeed
+            enableNewsFeedSetting={ENABLE_NEWS_FEED_SETTING}
+            newsFeedSetting={NEWS_FEED_URL_SETTING}
+          />
+        </EuiFlexItem>
+      </SidebarFlexGroup>
+    );
+  }
+);
 
 Sidebar.displayName = 'Sidebar';
diff --git a/x-pack/legacy/plugins/siem/public/pages/overview/translations.ts b/x-pack/legacy/plugins/siem/public/pages/overview/translations.ts
index 5ccd25984bc40..601a629d86e57 100644
--- a/x-pack/legacy/plugins/siem/public/pages/overview/translations.ts
+++ b/x-pack/legacy/plugins/siem/public/pages/overview/translations.ts
@@ -26,6 +26,10 @@ export const PAGE_SUBTITLE = i18n.translate('xpack.siem.overview.pageSubtitle',
   defaultMessage: 'Security Information & Event Management with the Elastic Stack',
 });
 
+export const RECENT_CASES = i18n.translate('xpack.siem.overview.recentCasesSidebarTitle', {
+  defaultMessage: 'Recent cases',
+});
+
 export const RECENT_TIMELINES = i18n.translate('xpack.siem.overview.recentTimelinesSidebarTitle', {
   defaultMessage: 'Recent timelines',
 });
diff --git a/x-pack/legacy/plugins/siem/server/graphql/tls/schema.gql.ts b/x-pack/legacy/plugins/siem/server/graphql/tls/schema.gql.ts
index 301960cea33ef..452c615c65aa5 100644
--- a/x-pack/legacy/plugins/siem/server/graphql/tls/schema.gql.ts
+++ b/x-pack/legacy/plugins/siem/server/graphql/tls/schema.gql.ts
@@ -13,11 +13,10 @@ export const tlsSchema = gql`
   type TlsNode {
     _id: String
     timestamp: Date
-    alternativeNames: [String!]
     notAfter: [String!]
-    commonNames: [String!]
+    subjects: [String!]
     ja3: [String!]
-    issuerNames: [String!]
+    issuers: [String!]
   }
   input TlsSortField {
     field: TlsFields!
diff --git a/x-pack/legacy/plugins/siem/server/graphql/types.ts b/x-pack/legacy/plugins/siem/server/graphql/types.ts
index f42da48f2c1da..e2b365f8bfa5b 100644
--- a/x-pack/legacy/plugins/siem/server/graphql/types.ts
+++ b/x-pack/legacy/plugins/siem/server/graphql/types.ts
@@ -1861,15 +1861,13 @@ export interface TlsNode {
 
   timestamp?: Maybe<string>;
 
-  alternativeNames?: Maybe<string[]>;
-
   notAfter?: Maybe<string[]>;
 
-  commonNames?: Maybe<string[]>;
+  subjects?: Maybe<string[]>;
 
   ja3?: Maybe<string[]>;
 
-  issuerNames?: Maybe<string[]>;
+  issuers?: Maybe<string[]>;
 }
 
 export interface UncommonProcessesData {
@@ -7824,15 +7822,13 @@ export namespace TlsNodeResolvers {
 
     timestamp?: TimestampResolver<Maybe<string>, TypeParent, TContext>;
 
-    alternativeNames?: AlternativeNamesResolver<Maybe<string[]>, TypeParent, TContext>;
-
     notAfter?: NotAfterResolver<Maybe<string[]>, TypeParent, TContext>;
 
-    commonNames?: CommonNamesResolver<Maybe<string[]>, TypeParent, TContext>;
+    subjects?: SubjectsResolver<Maybe<string[]>, TypeParent, TContext>;
 
     ja3?: Ja3Resolver<Maybe<string[]>, TypeParent, TContext>;
 
-    issuerNames?: IssuerNamesResolver<Maybe<string[]>, TypeParent, TContext>;
+    issuers?: IssuersResolver<Maybe<string[]>, TypeParent, TContext>;
   }
 
   export type _IdResolver<R = Maybe<string>, Parent = TlsNode, TContext = SiemContext> = Resolver<
@@ -7845,17 +7841,12 @@ export namespace TlsNodeResolvers {
     Parent = TlsNode,
     TContext = SiemContext
   > = Resolver<R, Parent, TContext>;
-  export type AlternativeNamesResolver<
-    R = Maybe<string[]>,
-    Parent = TlsNode,
-    TContext = SiemContext
-  > = Resolver<R, Parent, TContext>;
   export type NotAfterResolver<
     R = Maybe<string[]>,
     Parent = TlsNode,
     TContext = SiemContext
   > = Resolver<R, Parent, TContext>;
-  export type CommonNamesResolver<
+  export type SubjectsResolver<
     R = Maybe<string[]>,
     Parent = TlsNode,
     TContext = SiemContext
@@ -7865,7 +7856,7 @@ export namespace TlsNodeResolvers {
     Parent,
     TContext
   >;
-  export type IssuerNamesResolver<
+  export type IssuersResolver<
     R = Maybe<string[]>,
     Parent = TlsNode,
     TContext = SiemContext
diff --git a/x-pack/legacy/plugins/siem/server/lib/authentications/query.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/authentications/query.dsl.ts
index 333cc79fadabc..b9ed88e91f87d 100644
--- a/x-pack/legacy/plugins/siem/server/lib/authentications/query.dsl.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/authentications/query.dsl.ts
@@ -70,7 +70,7 @@ export const buildQuery = ({
             failures: {
               filter: {
                 term: {
-                  'event.type': 'authentication_failure',
+                  'event.outcome': 'failure',
                 },
               },
               aggs: {
@@ -86,7 +86,7 @@ export const buildQuery = ({
             successes: {
               filter: {
                 term: {
-                  'event.type': 'authentication_success',
+                  'event.outcome': 'success',
                 },
               },
               aggs: {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/add_tags.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/add_tags.test.ts
new file mode 100644
index 0000000000000..e14d20e3bc56e
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/add_tags.test.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { addTags } from './add_tags';
+import { INTERNAL_RULE_ALERT_ID_KEY } from '../../../../common/constants';
+
+describe('add_tags', () => {
+  test('it should add a rule id as an internal structure', () => {
+    const tags = addTags([], 'rule-1');
+    expect(tags).toEqual([`${INTERNAL_RULE_ALERT_ID_KEY}:rule-1`]);
+  });
+
+  test('it should not allow duplicate tags to be created', () => {
+    const tags = addTags(['tag-1', 'tag-1'], 'rule-1');
+    expect(tags).toEqual(['tag-1', `${INTERNAL_RULE_ALERT_ID_KEY}:rule-1`]);
+  });
+
+  test('it should not allow duplicate internal tags to be created when called two times in a row', () => {
+    const tags1 = addTags(['tag-1'], 'rule-1');
+    const tags2 = addTags(tags1, 'rule-1');
+    expect(tags2).toEqual(['tag-1', `${INTERNAL_RULE_ALERT_ID_KEY}:rule-1`]);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/add_tags.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/add_tags.ts
new file mode 100644
index 0000000000000..6955e57d099be
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/add_tags.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { INTERNAL_RULE_ALERT_ID_KEY } from '../../../../common/constants';
+
+export const addTags = (tags: string[] = [], ruleAlertId: string): string[] =>
+  Array.from(new Set([...tags, `${INTERNAL_RULE_ALERT_ID_KEY}:${ruleAlertId}`]));
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.test.ts
new file mode 100644
index 0000000000000..f83a8d40d6ae1
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.test.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { buildSignalsSearchQuery } from './build_signals_query';
+
+describe('buildSignalsSearchQuery', () => {
+  it('returns proper query object', () => {
+    const index = 'index';
+    const ruleId = 'ruleId-12';
+    const from = '123123123';
+    const to = '1123123123';
+
+    expect(
+      buildSignalsSearchQuery({
+        index,
+        from,
+        to,
+        ruleId,
+      })
+    ).toEqual({
+      index,
+      body: {
+        query: {
+          bool: {
+            filter: [
+              {
+                bool: {
+                  should: {
+                    match: {
+                      'signal.rule.rule_id': ruleId,
+                    },
+                  },
+                  minimum_should_match: 1,
+                },
+              },
+              {
+                range: {
+                  '@timestamp': {
+                    gte: from,
+                    lte: to,
+                  },
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.ts
new file mode 100644
index 0000000000000..001650e5b2005
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/build_signals_query.ts
@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+interface BuildSignalsSearchQuery {
+  ruleId: string;
+  index: string;
+  from: string;
+  to: string;
+}
+
+export const buildSignalsSearchQuery = ({ ruleId, index, from, to }: BuildSignalsSearchQuery) => ({
+  index,
+  body: {
+    query: {
+      bool: {
+        filter: [
+          {
+            bool: {
+              should: {
+                match: {
+                  'signal.rule.rule_id': ruleId,
+                },
+              },
+              minimum_should_match: 1,
+            },
+          },
+          {
+            range: {
+              '@timestamp': {
+                gte: from,
+                lte: to,
+              },
+            },
+          },
+        ],
+      },
+    },
+  },
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/create_notifications.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/create_notifications.test.ts
new file mode 100644
index 0000000000000..dea42b0c852f9
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/create_notifications.test.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { alertsClientMock } from '../../../../../../../plugins/alerting/server/mocks';
+import { createNotifications } from './create_notifications';
+
+describe('createNotifications', () => {
+  let alertsClient: ReturnType<typeof alertsClientMock.create>;
+
+  beforeEach(() => {
+    alertsClient = alertsClientMock.create();
+  });
+
+  it('calls the alertsClient with proper params', async () => {
+    const ruleAlertId = 'rule-04128c15-0d1b-4716-a4c5-46997ac7f3bd';
+
+    await createNotifications({
+      alertsClient,
+      actions: [],
+      ruleAlertId,
+      enabled: true,
+      interval: '',
+      name: '',
+      tags: [],
+    });
+
+    expect(alertsClient.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          params: expect.objectContaining({
+            ruleAlertId,
+          }),
+        }),
+      })
+    );
+  });
+
+  it('calls the alertsClient with transformed actions', async () => {
+    const action = {
+      group: 'default',
+      id: '99403909-ca9b-49ba-9d7a-7e5320e68d05',
+      params: { message: 'Rule generated {{state.signalsCount}} signals' },
+      action_type_id: '.slack',
+    };
+    await createNotifications({
+      alertsClient,
+      actions: [action],
+      ruleAlertId: 'new-rule-id',
+      enabled: true,
+      interval: '',
+      name: '',
+      tags: [],
+    });
+
+    expect(alertsClient.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          actions: expect.arrayContaining([
+            {
+              group: action.group,
+              id: action.id,
+              params: action.params,
+              actionTypeId: '.slack',
+            },
+          ]),
+        }),
+      })
+    );
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/create_notifications.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/create_notifications.ts
new file mode 100644
index 0000000000000..3a1697f1c8afc
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/create_notifications.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Alert } from '../../../../../../../plugins/alerting/common';
+import { APP_ID, NOTIFICATIONS_ID } from '../../../../common/constants';
+import { CreateNotificationParams } from './types';
+import { addTags } from './add_tags';
+import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
+
+export const createNotifications = async ({
+  alertsClient,
+  actions,
+  enabled,
+  ruleAlertId,
+  interval,
+  name,
+  tags,
+}: CreateNotificationParams): Promise<Alert> =>
+  alertsClient.create({
+    data: {
+      name,
+      tags: addTags(tags, ruleAlertId),
+      alertTypeId: NOTIFICATIONS_ID,
+      consumer: APP_ID,
+      params: {
+        ruleAlertId,
+      },
+      schedule: { interval },
+      enabled,
+      actions: actions?.map(transformRuleToAlertAction),
+      throttle: null,
+    },
+  });
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/delete_notifications.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/delete_notifications.test.ts
new file mode 100644
index 0000000000000..7e5c0eaf6286e
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/delete_notifications.test.ts
@@ -0,0 +1,141 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { alertsClientMock } from '../../../../../../../plugins/alerting/server/mocks';
+import { deleteNotifications } from './delete_notifications';
+import { readNotifications } from './read_notifications';
+jest.mock('./read_notifications');
+
+describe('deleteNotifications', () => {
+  let alertsClient: ReturnType<typeof alertsClientMock.create>;
+  const notificationId = 'notification-52128c15-0d1b-4716-a4c5-46997ac7f3bd';
+  const ruleAlertId = 'rule-04128c15-0d1b-4716-a4c5-46997ac7f3bd';
+
+  beforeEach(() => {
+    alertsClient = alertsClientMock.create();
+  });
+
+  it('should return null if notification was not found', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue(null);
+
+    const result = await deleteNotifications({
+      alertsClient,
+      id: notificationId,
+      ruleAlertId,
+    });
+
+    expect(result).toBe(null);
+  });
+
+  it('should call alertsClient.delete if notification was found', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue({
+      id: notificationId,
+    });
+
+    const result = await deleteNotifications({
+      alertsClient,
+      id: notificationId,
+      ruleAlertId,
+    });
+
+    expect(alertsClient.delete).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notificationId,
+      })
+    );
+    expect(result).toEqual({ id: notificationId });
+  });
+
+  it('should call alertsClient.delete if notification.id was null', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue({
+      id: null,
+    });
+
+    const result = await deleteNotifications({
+      alertsClient,
+      id: notificationId,
+      ruleAlertId,
+    });
+
+    expect(alertsClient.delete).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notificationId,
+      })
+    );
+    expect(result).toEqual({ id: null });
+  });
+
+  it('should return null if alertsClient.delete rejects with 404 if notification.id was null', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue({
+      id: null,
+    });
+
+    alertsClient.delete.mockRejectedValue({
+      output: {
+        statusCode: 404,
+      },
+    });
+
+    const result = await deleteNotifications({
+      alertsClient,
+      id: notificationId,
+      ruleAlertId,
+    });
+
+    expect(alertsClient.delete).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notificationId,
+      })
+    );
+    expect(result).toEqual(null);
+  });
+
+  it('should return error object if alertsClient.delete rejects with status different than 404 and if notification.id was null', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue({
+      id: null,
+    });
+
+    const errorObject = {
+      output: {
+        statusCode: 500,
+      },
+    };
+
+    alertsClient.delete.mockRejectedValue(errorObject);
+
+    let errorResult;
+    try {
+      await deleteNotifications({
+        alertsClient,
+        id: notificationId,
+        ruleAlertId,
+      });
+    } catch (error) {
+      errorResult = error;
+    }
+
+    expect(alertsClient.delete).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notificationId,
+      })
+    );
+    expect(errorResult).toEqual(errorObject);
+  });
+
+  it('should return null if notification.id and id were null', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue({
+      id: null,
+    });
+
+    const result = await deleteNotifications({
+      alertsClient,
+      id: undefined,
+      ruleAlertId,
+    });
+
+    expect(result).toEqual(null);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/delete_notifications.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/delete_notifications.ts
new file mode 100644
index 0000000000000..7e244f96f1649
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/delete_notifications.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { readNotifications } from './read_notifications';
+import { DeleteNotificationParams } from './types';
+
+export const deleteNotifications = async ({
+  alertsClient,
+  id,
+  ruleAlertId,
+}: DeleteNotificationParams) => {
+  const notification = await readNotifications({ alertsClient, id, ruleAlertId });
+  if (notification == null) {
+    return null;
+  }
+
+  if (notification.id != null) {
+    await alertsClient.delete({ id: notification.id });
+    return notification;
+  } else if (id != null) {
+    try {
+      await alertsClient.delete({ id });
+      return notification;
+    } catch (err) {
+      if (err.output.statusCode === 404) {
+        return null;
+      } else {
+        throw err;
+      }
+    }
+  } else {
+    return null;
+  }
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/find_notifications.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/find_notifications.test.ts
new file mode 100644
index 0000000000000..0e9e4a8370ec8
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/find_notifications.test.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getFilter } from './find_notifications';
+import { NOTIFICATIONS_ID } from '../../../../common/constants';
+
+describe('find_notifications', () => {
+  test('it returns a full filter with an AND if sent down', () => {
+    expect(getFilter('alert.attributes.enabled: true')).toEqual(
+      `alert.attributes.alertTypeId: ${NOTIFICATIONS_ID} AND alert.attributes.enabled: true`
+    );
+  });
+
+  test('it returns existing filter with no AND when not set', () => {
+    expect(getFilter(null)).toEqual(`alert.attributes.alertTypeId: ${NOTIFICATIONS_ID}`);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/find_notifications.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/find_notifications.ts
new file mode 100644
index 0000000000000..fcdeda608fe4e
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/find_notifications.ts
@@ -0,0 +1,37 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FindResult } from '../../../../../../../plugins/alerting/server';
+import { NOTIFICATIONS_ID } from '../../../../common/constants';
+import { FindNotificationParams } from './types';
+
+export const getFilter = (filter: string | null | undefined) => {
+  if (filter == null) {
+    return `alert.attributes.alertTypeId: ${NOTIFICATIONS_ID}`;
+  } else {
+    return `alert.attributes.alertTypeId: ${NOTIFICATIONS_ID} AND ${filter}`;
+  }
+};
+
+export const findNotifications = async ({
+  alertsClient,
+  perPage,
+  page,
+  fields,
+  filter,
+  sortField,
+  sortOrder,
+}: FindNotificationParams): Promise<FindResult> =>
+  alertsClient.find({
+    options: {
+      fields,
+      page,
+      perPage,
+      filter: getFilter(filter),
+      sortOrder,
+      sortField,
+    },
+  });
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/get_signals_count.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/get_signals_count.ts
new file mode 100644
index 0000000000000..6ae7922660bd7
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/get_signals_count.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment';
+import { getNotificationResultsLink } from './utils';
+import { NotificationExecutorOptions } from './types';
+import { parseScheduleDates } from '../signals/utils';
+import { buildSignalsSearchQuery } from './build_signals_query';
+
+interface SignalsCountResults {
+  signalsCount: string;
+  resultsLink: string;
+}
+
+interface GetSignalsCount {
+  from: Date | string;
+  to: Date | string;
+  ruleAlertId: string;
+  ruleId: string;
+  index: string;
+  kibanaUrl: string | undefined;
+  callCluster: NotificationExecutorOptions['services']['callCluster'];
+}
+
+export const getSignalsCount = async ({
+  from,
+  to,
+  ruleAlertId,
+  ruleId,
+  index,
+  callCluster,
+  kibanaUrl = '',
+}: GetSignalsCount): Promise<SignalsCountResults> => {
+  const fromMoment = moment.isDate(from) ? moment(from) : parseScheduleDates(from);
+  const toMoment = moment.isDate(to) ? moment(to) : parseScheduleDates(to);
+
+  if (!fromMoment || !toMoment) {
+    throw new Error(`There was an issue with parsing ${from} or ${to} into Moment object`);
+  }
+
+  const fromInMs = fromMoment.format('x');
+  const toInMs = toMoment.format('x');
+
+  const query = buildSignalsSearchQuery({
+    index,
+    ruleId,
+    to: toInMs,
+    from: fromInMs,
+  });
+
+  const result = await callCluster('count', query);
+  const resultsLink = getNotificationResultsLink({
+    baseUrl: kibanaUrl,
+    id: ruleAlertId,
+    from: fromInMs,
+    to: toInMs,
+  });
+
+  return {
+    signalsCount: result.count,
+    resultsLink,
+  };
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/read_notifications.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/read_notifications.test.ts
new file mode 100644
index 0000000000000..834ad2460959c
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/read_notifications.test.ts
@@ -0,0 +1,154 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { readNotifications } from './read_notifications';
+import { alertsClientMock } from '../../../../../../../plugins/alerting/server/mocks';
+import {
+  getNotificationResult,
+  getFindNotificationsResultWithSingleHit,
+} from '../routes/__mocks__/request_responses';
+
+class TestError extends Error {
+  constructor() {
+    super();
+
+    this.name = 'CustomError';
+    this.output = { statusCode: 404 };
+  }
+  public output: { statusCode: number };
+}
+
+describe('read_notifications', () => {
+  let alertsClient: ReturnType<typeof alertsClientMock.create>;
+
+  beforeEach(() => {
+    alertsClient = alertsClientMock.create();
+  });
+
+  describe('readNotifications', () => {
+    test('should return the output from alertsClient if id is set but ruleAlertId is undefined', async () => {
+      alertsClient.get.mockResolvedValue(getNotificationResult());
+
+      const rule = await readNotifications({
+        alertsClient,
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        ruleAlertId: undefined,
+      });
+      expect(rule).toEqual(getNotificationResult());
+    });
+    test('should return null if saved object found by alerts client given id is not alert type', async () => {
+      const result = getNotificationResult();
+      delete result.alertTypeId;
+      alertsClient.get.mockResolvedValue(result);
+
+      const rule = await readNotifications({
+        alertsClient,
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        ruleAlertId: undefined,
+      });
+      expect(rule).toEqual(null);
+    });
+
+    test('should return error if alerts client throws 404 error on get', async () => {
+      alertsClient.get.mockImplementation(() => {
+        throw new TestError();
+      });
+
+      const rule = await readNotifications({
+        alertsClient,
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        ruleAlertId: undefined,
+      });
+      expect(rule).toEqual(null);
+    });
+
+    test('should return error if alerts client throws error on get', async () => {
+      alertsClient.get.mockImplementation(() => {
+        throw new Error('Test error');
+      });
+      try {
+        await readNotifications({
+          alertsClient,
+          id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+          ruleAlertId: undefined,
+        });
+      } catch (exc) {
+        expect(exc.message).toEqual('Test error');
+      }
+    });
+
+    test('should return the output from alertsClient if id is set but ruleAlertId is null', async () => {
+      alertsClient.get.mockResolvedValue(getNotificationResult());
+
+      const rule = await readNotifications({
+        alertsClient,
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        ruleAlertId: null,
+      });
+      expect(rule).toEqual(getNotificationResult());
+    });
+
+    test('should return the output from alertsClient if id is undefined but ruleAlertId is set', async () => {
+      alertsClient.get.mockResolvedValue(getNotificationResult());
+      alertsClient.find.mockResolvedValue(getFindNotificationsResultWithSingleHit());
+
+      const rule = await readNotifications({
+        alertsClient,
+        id: undefined,
+        ruleAlertId: 'rule-1',
+      });
+      expect(rule).toEqual(getNotificationResult());
+    });
+
+    test('should return null if the output from alertsClient with ruleAlertId set is empty', async () => {
+      alertsClient.get.mockResolvedValue(getNotificationResult());
+      alertsClient.find.mockResolvedValue({ data: [], page: 0, perPage: 1, total: 0 });
+
+      const rule = await readNotifications({
+        alertsClient,
+        id: undefined,
+        ruleAlertId: 'rule-1',
+      });
+      expect(rule).toEqual(null);
+    });
+
+    test('should return the output from alertsClient if id is null but ruleAlertId is set', async () => {
+      alertsClient.get.mockResolvedValue(getNotificationResult());
+      alertsClient.find.mockResolvedValue(getFindNotificationsResultWithSingleHit());
+
+      const rule = await readNotifications({
+        alertsClient,
+        id: null,
+        ruleAlertId: 'rule-1',
+      });
+      expect(rule).toEqual(getNotificationResult());
+    });
+
+    test('should return null if id and ruleAlertId are null', async () => {
+      alertsClient.get.mockResolvedValue(getNotificationResult());
+      alertsClient.find.mockResolvedValue(getFindNotificationsResultWithSingleHit());
+
+      const rule = await readNotifications({
+        alertsClient,
+        id: null,
+        ruleAlertId: null,
+      });
+      expect(rule).toEqual(null);
+    });
+
+    test('should return null if id and ruleAlertId are undefined', async () => {
+      alertsClient.get.mockResolvedValue(getNotificationResult());
+      alertsClient.find.mockResolvedValue(getFindNotificationsResultWithSingleHit());
+
+      const rule = await readNotifications({
+        alertsClient,
+        id: undefined,
+        ruleAlertId: undefined,
+      });
+      expect(rule).toEqual(null);
+    });
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/read_notifications.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/read_notifications.ts
new file mode 100644
index 0000000000000..87bdd6f3f40e1
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/read_notifications.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SanitizedAlert } from '../../../../../../../plugins/alerting/common';
+import { ReadNotificationParams, isAlertType } from './types';
+import { findNotifications } from './find_notifications';
+import { INTERNAL_RULE_ALERT_ID_KEY } from '../../../../common/constants';
+
+export const readNotifications = async ({
+  alertsClient,
+  id,
+  ruleAlertId,
+}: ReadNotificationParams): Promise<SanitizedAlert | null> => {
+  if (id != null) {
+    try {
+      const notification = await alertsClient.get({ id });
+      if (isAlertType(notification)) {
+        return notification;
+      } else {
+        return null;
+      }
+    } catch (err) {
+      if (err?.output?.statusCode === 404) {
+        return null;
+      } else {
+        // throw non-404 as they would be 500 or other internal errors
+        throw err;
+      }
+    }
+  } else if (ruleAlertId != null) {
+    const notificationFromFind = await findNotifications({
+      alertsClient,
+      filter: `alert.attributes.tags: "${INTERNAL_RULE_ALERT_ID_KEY}:${ruleAlertId}"`,
+      page: 1,
+    });
+    if (notificationFromFind.data.length === 0 || !isAlertType(notificationFromFind.data[0])) {
+      return null;
+    } else {
+      return notificationFromFind.data[0];
+    }
+  } else {
+    // should never get here, and yet here we are.
+    return null;
+  }
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.test.ts
new file mode 100644
index 0000000000000..ff0126b129636
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.test.ts
@@ -0,0 +1,142 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { savedObjectsClientMock } from 'src/core/server/mocks';
+import { loggerMock } from 'src/core/server/logging/logger.mock';
+import { getResult } from '../routes/__mocks__/request_responses';
+import { rulesNotificationAlertType } from './rules_notification_alert_type';
+import { buildSignalsSearchQuery } from './build_signals_query';
+import { AlertInstance } from '../../../../../../../plugins/alerting/server';
+import { NotificationExecutorOptions } from './types';
+jest.mock('./build_signals_query');
+
+describe('rules_notification_alert_type', () => {
+  let payload: NotificationExecutorOptions;
+  let alert: ReturnType<typeof rulesNotificationAlertType>;
+  let alertInstanceMock: Record<string, jest.Mock>;
+  let alertInstanceFactoryMock: () => AlertInstance;
+  let savedObjectsClient: ReturnType<typeof savedObjectsClientMock.create>;
+  let logger: ReturnType<typeof loggerMock.create>;
+  let callClusterMock: jest.Mock;
+
+  beforeEach(() => {
+    alertInstanceMock = {
+      scheduleActions: jest.fn(),
+      replaceState: jest.fn(),
+    };
+    alertInstanceMock.replaceState.mockReturnValue(alertInstanceMock);
+    alertInstanceFactoryMock = jest.fn().mockReturnValue(alertInstanceMock);
+    callClusterMock = jest.fn();
+    savedObjectsClient = savedObjectsClientMock.create();
+    logger = loggerMock.create();
+
+    payload = {
+      alertId: '1111',
+      services: {
+        savedObjectsClient,
+        alertInstanceFactory: alertInstanceFactoryMock,
+        callCluster: callClusterMock,
+      },
+      params: { ruleAlertId: '2222' },
+      state: {},
+      spaceId: '',
+      name: 'name',
+      tags: [],
+      startedAt: new Date('2019-12-14T16:40:33.400Z'),
+      previousStartedAt: new Date('2019-12-13T16:40:33.400Z'),
+      createdBy: 'elastic',
+      updatedBy: 'elastic',
+    };
+
+    alert = rulesNotificationAlertType({
+      logger,
+    });
+  });
+
+  describe('executor', () => {
+    it('throws an error if rule alert was not found', async () => {
+      savedObjectsClient.get.mockResolvedValue({
+        id: 'id',
+        attributes: {},
+        type: 'type',
+        references: [],
+      });
+      await alert.executor(payload);
+      expect(logger.error).toHaveBeenCalledWith(
+        `Saved object for alert ${payload.params.ruleAlertId} was not found`
+      );
+    });
+
+    it('should call buildSignalsSearchQuery with proper params', async () => {
+      const ruleAlert = getResult();
+      savedObjectsClient.get.mockResolvedValue({
+        id: 'id',
+        type: 'type',
+        references: [],
+        attributes: ruleAlert,
+      });
+      callClusterMock.mockResolvedValue({
+        count: 0,
+      });
+
+      await alert.executor(payload);
+
+      expect(buildSignalsSearchQuery).toHaveBeenCalledWith(
+        expect.objectContaining({
+          from: '1576255233400',
+          index: '.siem-signals',
+          ruleId: 'rule-1',
+          to: '1576341633400',
+        })
+      );
+    });
+
+    it('should not call alertInstanceFactory if signalsCount was 0', async () => {
+      const ruleAlert = getResult();
+      savedObjectsClient.get.mockResolvedValue({
+        id: 'id',
+        type: 'type',
+        references: [],
+        attributes: ruleAlert,
+      });
+      callClusterMock.mockResolvedValue({
+        count: 0,
+      });
+
+      await alert.executor(payload);
+
+      expect(alertInstanceFactoryMock).not.toHaveBeenCalled();
+    });
+
+    it('should call scheduleActions if signalsCount was greater than 0', async () => {
+      const ruleAlert = getResult();
+      savedObjectsClient.get.mockResolvedValue({
+        id: 'id',
+        type: 'type',
+        references: [],
+        attributes: ruleAlert,
+      });
+      callClusterMock.mockResolvedValue({
+        count: 10,
+      });
+
+      await alert.executor(payload);
+
+      expect(alertInstanceFactoryMock).toHaveBeenCalled();
+      expect(alertInstanceMock.replaceState).toHaveBeenCalledWith(
+        expect.objectContaining({ signalsCount: 10 })
+      );
+      expect(alertInstanceMock.scheduleActions).toHaveBeenCalledWith(
+        'default',
+        expect.objectContaining({
+          rule: expect.objectContaining({
+            name: ruleAlert.name,
+          }),
+        })
+      );
+    });
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.ts
new file mode 100644
index 0000000000000..c5dc4c3a27e16
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/rules_notification_alert_type.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Logger } from 'src/core/server';
+import { schema } from '@kbn/config-schema';
+import { NOTIFICATIONS_ID } from '../../../../common/constants';
+
+import { NotificationAlertTypeDefinition } from './types';
+import { getSignalsCount } from './get_signals_count';
+import { RuleAlertAttributes } from '../signals/types';
+import { siemRuleActionGroups } from '../signals/siem_rule_action_groups';
+import { scheduleNotificationActions } from './schedule_notification_actions';
+
+export const rulesNotificationAlertType = ({
+  logger,
+}: {
+  logger: Logger;
+}): NotificationAlertTypeDefinition => ({
+  id: NOTIFICATIONS_ID,
+  name: 'SIEM Notifications',
+  actionGroups: siemRuleActionGroups,
+  defaultActionGroupId: 'default',
+  validate: {
+    params: schema.object({
+      ruleAlertId: schema.string(),
+    }),
+  },
+  async executor({ startedAt, previousStartedAt, alertId, services, params }) {
+    const ruleAlertSavedObject = await services.savedObjectsClient.get<RuleAlertAttributes>(
+      'alert',
+      params.ruleAlertId
+    );
+
+    if (!ruleAlertSavedObject.attributes.params) {
+      logger.error(`Saved object for alert ${params.ruleAlertId} was not found`);
+      return;
+    }
+
+    const { params: ruleAlertParams, name: ruleName } = ruleAlertSavedObject.attributes;
+    const ruleParams = { ...ruleAlertParams, name: ruleName };
+
+    const { signalsCount, resultsLink } = await getSignalsCount({
+      from: previousStartedAt ?? `now-${ruleParams.interval}`,
+      to: startedAt,
+      index: ruleParams.outputIndex,
+      ruleId: ruleParams.ruleId!,
+      kibanaUrl: ruleAlertParams.meta?.kibanaUrl as string,
+      ruleAlertId: ruleAlertSavedObject.id,
+      callCluster: services.callCluster,
+    });
+
+    logger.info(
+      `Found ${signalsCount} signals using signal rule name: "${ruleParams.name}", id: "${params.ruleAlertId}", rule_id: "${ruleParams.ruleId}" in "${ruleParams.outputIndex}" index`
+    );
+
+    if (signalsCount) {
+      const alertInstance = services.alertInstanceFactory(alertId);
+      scheduleNotificationActions({ alertInstance, signalsCount, resultsLink, ruleParams });
+    }
+  },
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/schedule_notification_actions.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/schedule_notification_actions.ts
new file mode 100644
index 0000000000000..9c38c88a12411
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/schedule_notification_actions.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { AlertInstance } from '../../../../../../../plugins/alerting/server';
+import { RuleTypeParams } from '../types';
+
+type NotificationRuleTypeParams = RuleTypeParams & {
+  name: string;
+};
+
+interface ScheduleNotificationActions {
+  alertInstance: AlertInstance;
+  signalsCount: string;
+  resultsLink: string;
+  ruleParams: NotificationRuleTypeParams;
+}
+
+export const scheduleNotificationActions = ({
+  alertInstance,
+  signalsCount,
+  resultsLink,
+  ruleParams,
+}: ScheduleNotificationActions): AlertInstance =>
+  alertInstance
+    .replaceState({
+      signalsCount,
+    })
+    .scheduleActions('default', {
+      resultsLink,
+      rule: ruleParams,
+    });
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/types.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/types.test.ts
new file mode 100644
index 0000000000000..4fce037b483d5
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/types.test.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { loggerMock } from 'src/core/server/logging/logger.mock';
+import { getNotificationResult, getResult } from '../routes/__mocks__/request_responses';
+import { isAlertTypes, isNotificationAlertExecutor } from './types';
+import { rulesNotificationAlertType } from './rules_notification_alert_type';
+
+describe('types', () => {
+  it('isAlertTypes should return true if is RuleNotificationAlertType type', () => {
+    expect(isAlertTypes([getNotificationResult()])).toEqual(true);
+  });
+
+  it('isAlertTypes should return false if is not RuleNotificationAlertType', () => {
+    expect(isAlertTypes([getResult()])).toEqual(false);
+  });
+
+  it('isNotificationAlertExecutor should return true it passed object is NotificationAlertTypeDefinition type', () => {
+    expect(
+      isNotificationAlertExecutor(rulesNotificationAlertType({ logger: loggerMock.create() }))
+    ).toEqual(true);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/types.ts
new file mode 100644
index 0000000000000..edcd821353bc8
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/types.ts
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  AlertsClient,
+  PartialAlert,
+  AlertType,
+  State,
+  AlertExecutorOptions,
+} from '../../../../../../../plugins/alerting/server';
+import { Alert } from '../../../../../../../plugins/alerting/common';
+import { NOTIFICATIONS_ID } from '../../../../common/constants';
+import { RuleAlertAction } from '../../../../common/detection_engine/types';
+
+export interface RuleNotificationAlertType extends Alert {
+  params: {
+    ruleAlertId: string;
+  };
+}
+
+export interface FindNotificationParams {
+  alertsClient: AlertsClient;
+  perPage?: number;
+  page?: number;
+  sortField?: string;
+  filter?: string;
+  fields?: string[];
+  sortOrder?: 'asc' | 'desc';
+}
+
+export interface FindNotificationsRequestParams {
+  per_page: number;
+  page: number;
+  search?: string;
+  sort_field?: string;
+  filter?: string;
+  fields?: string[];
+  sort_order?: 'asc' | 'desc';
+}
+
+export interface Clients {
+  alertsClient: AlertsClient;
+}
+
+export type UpdateNotificationParams = Omit<NotificationAlertParams, 'interval' | 'actions'> & {
+  actions: RuleAlertAction[];
+  id?: string;
+  tags?: string[];
+  interval: string | null;
+  ruleAlertId: string;
+} & Clients;
+
+export type DeleteNotificationParams = Clients & {
+  id?: string;
+  ruleAlertId?: string;
+};
+
+export interface NotificationAlertParams {
+  actions: RuleAlertAction[];
+  enabled: boolean;
+  ruleAlertId: string;
+  interval: string;
+  name: string;
+  tags?: string[];
+  throttle?: null;
+}
+
+export type CreateNotificationParams = NotificationAlertParams & Clients;
+
+export interface ReadNotificationParams {
+  alertsClient: AlertsClient;
+  id?: string | null;
+  ruleAlertId?: string | null;
+}
+
+export const isAlertTypes = (
+  partialAlert: PartialAlert[]
+): partialAlert is RuleNotificationAlertType[] => {
+  return partialAlert.every(rule => isAlertType(rule));
+};
+
+export const isAlertType = (
+  partialAlert: PartialAlert
+): partialAlert is RuleNotificationAlertType => {
+  return partialAlert.alertTypeId === NOTIFICATIONS_ID;
+};
+
+export type NotificationExecutorOptions = Omit<AlertExecutorOptions, 'params'> & {
+  params: {
+    ruleAlertId: string;
+  };
+};
+
+// This returns true because by default a NotificationAlertTypeDefinition is an AlertType
+// since we are only increasing the strictness of params.
+export const isNotificationAlertExecutor = (
+  obj: NotificationAlertTypeDefinition
+): obj is AlertType => {
+  return true;
+};
+
+export type NotificationAlertTypeDefinition = Omit<AlertType, 'executor'> & {
+  executor: ({ services, params, state }: NotificationExecutorOptions) => Promise<State | void>;
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/update_notifications.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/update_notifications.test.ts
new file mode 100644
index 0000000000000..e1b452c911443
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/update_notifications.test.ts
@@ -0,0 +1,137 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { alertsClientMock } from '../../../../../../../plugins/alerting/server/mocks';
+import { updateNotifications } from './update_notifications';
+import { readNotifications } from './read_notifications';
+import { createNotifications } from './create_notifications';
+import { getNotificationResult } from '../routes/__mocks__/request_responses';
+jest.mock('./read_notifications');
+jest.mock('./create_notifications');
+
+describe('updateNotifications', () => {
+  const notification = getNotificationResult();
+  let alertsClient: ReturnType<typeof alertsClientMock.create>;
+
+  beforeEach(() => {
+    alertsClient = alertsClientMock.create();
+  });
+
+  it('should update the existing notification if interval provided', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue(notification);
+
+    await updateNotifications({
+      alertsClient,
+      actions: [],
+      ruleAlertId: 'new-rule-id',
+      enabled: true,
+      interval: '10m',
+      name: '',
+      tags: [],
+    });
+
+    expect(alertsClient.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notification.id,
+        data: expect.objectContaining({
+          params: expect.objectContaining({
+            ruleAlertId: 'new-rule-id',
+          }),
+        }),
+      })
+    );
+  });
+
+  it('should create a new notification if did not exist', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue(null);
+
+    const params = {
+      alertsClient,
+      actions: [],
+      ruleAlertId: 'new-rule-id',
+      enabled: true,
+      interval: '10m',
+      name: '',
+      tags: [],
+    };
+
+    await updateNotifications(params);
+
+    expect(createNotifications).toHaveBeenCalledWith(expect.objectContaining(params));
+  });
+
+  it('should delete notification if notification was found and interval is null', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue(notification);
+
+    await updateNotifications({
+      alertsClient,
+      actions: [],
+      ruleAlertId: 'new-rule-id',
+      enabled: true,
+      interval: null,
+      name: '',
+      tags: [],
+    });
+
+    expect(alertsClient.delete).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notification.id,
+      })
+    );
+  });
+
+  it('should call the alertsClient with transformed actions', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue(notification);
+    const action = {
+      group: 'default',
+      id: '99403909-ca9b-49ba-9d7a-7e5320e68d05',
+      params: { message: 'Rule generated {{state.signalsCount}} signals' },
+      action_type_id: '.slack',
+    };
+    await updateNotifications({
+      alertsClient,
+      actions: [action],
+      ruleAlertId: 'new-rule-id',
+      enabled: true,
+      interval: '10m',
+      name: '',
+      tags: [],
+    });
+
+    expect(alertsClient.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          actions: expect.arrayContaining([
+            {
+              group: action.group,
+              id: action.id,
+              params: action.params,
+              actionTypeId: '.slack',
+            },
+          ]),
+        }),
+      })
+    );
+  });
+
+  it('returns null if notification was not found and interval was null', async () => {
+    (readNotifications as jest.Mock).mockResolvedValue(null);
+    const ruleAlertId = 'rule-04128c15-0d1b-4716-a4c5-46997ac7f3bd';
+
+    const result = await updateNotifications({
+      alertsClient,
+      actions: [],
+      enabled: true,
+      id: notification.id,
+      ruleAlertId,
+      name: notification.name,
+      tags: notification.tags,
+      interval: null,
+    });
+
+    expect(result).toEqual(null);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/update_notifications.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/update_notifications.ts
new file mode 100644
index 0000000000000..3197d21c0e95a
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/update_notifications.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PartialAlert } from '../../../../../../../plugins/alerting/server';
+import { readNotifications } from './read_notifications';
+import { UpdateNotificationParams } from './types';
+import { addTags } from './add_tags';
+import { createNotifications } from './create_notifications';
+import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
+
+export const updateNotifications = async ({
+  alertsClient,
+  actions,
+  enabled,
+  id,
+  ruleAlertId,
+  name,
+  tags,
+  interval,
+}: UpdateNotificationParams): Promise<PartialAlert | null> => {
+  const notification = await readNotifications({ alertsClient, id, ruleAlertId });
+
+  if (interval && notification) {
+    const result = await alertsClient.update({
+      id: notification.id,
+      data: {
+        tags: addTags(tags, ruleAlertId),
+        name,
+        schedule: {
+          interval,
+        },
+        actions: actions?.map(transformRuleToAlertAction),
+        params: {
+          ruleAlertId,
+        },
+        throttle: null,
+      },
+    });
+    return result;
+  }
+
+  if (interval && !notification) {
+    const result = await createNotifications({
+      alertsClient,
+      enabled,
+      tags,
+      name,
+      interval,
+      actions,
+      ruleAlertId,
+    });
+    return result;
+  }
+
+  if (!interval && notification) {
+    await alertsClient.delete({ id: notification.id });
+    return null;
+  }
+
+  return null;
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.test.ts
new file mode 100644
index 0000000000000..4c3f311d10acc
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.test.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { getNotificationResultsLink } from './utils';
+
+describe('utils', () => {
+  it('getNotificationResultsLink', () => {
+    const resultLink = getNotificationResultsLink({
+      baseUrl: 'http://localhost:5601',
+      id: 'notification-id',
+      from: '00000',
+      to: '1111',
+    });
+    expect(resultLink).toEqual(
+      `http://localhost:5601/app/siem#/detections/rules/id/notification-id?timerange=(global:(linkTo:!(timeline),timerange:(from:00000,kind:absolute,to:1111)),timeline:(linkTo:!(global),timerange:(from:00000,kind:absolute,to:1111)))`
+    );
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.ts
new file mode 100644
index 0000000000000..ed502d31d2fb5
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/notifications/utils.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const getNotificationResultsLink = ({
+  baseUrl,
+  id,
+  from,
+  to,
+}: {
+  baseUrl: string;
+  id: string;
+  from: string;
+  to: string;
+}) =>
+  `${baseUrl}/app/siem#/detections/rules/id/${id}?timerange=(global:(linkTo:!(timeline),timerange:(from:${from},kind:absolute,to:${to})),timeline:(linkTo:!(global),timerange:(from:${from},kind:absolute,to:${to})))`;
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
index 0e0ab58a7a199..6435410f31797 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/__mocks__/request_responses.ts
@@ -28,6 +28,7 @@ import {
 } from '../../rules/types';
 import { RuleAlertParamsRest, PrepackagedRules } from '../../types';
 import { requestMock } from './request';
+import { RuleNotificationAlertType } from '../../notifications/types';
 
 export const mockPrepackagedRule = (): PrepackagedRules => ({
   rule_id: 'rule-1',
@@ -204,11 +205,11 @@ export const getPrepackagedRulesStatusRequest = () =>
     path: `${DETECTION_ENGINE_PREPACKAGED_URL}/_status`,
   });
 
-export interface FindHit {
+export interface FindHit<T = RuleAlertType> {
   page: number;
   perPage: number;
   total: number;
-  data: RuleAlertType[];
+  data: T[];
 }
 
 export const getEmptyFindResult = (): FindHit => ({
@@ -309,6 +310,27 @@ export const createMlRuleRequest = () => {
   });
 };
 
+export const createRuleWithActionsRequest = () => {
+  const payload = typicalPayload();
+
+  return requestMock.create({
+    method: 'post',
+    path: DETECTION_ENGINE_RULES_URL,
+    body: {
+      ...payload,
+      throttle: '5m',
+      actions: [
+        {
+          group: 'default',
+          id: '99403909-ca9b-49ba-9d7a-7e5320e68d05',
+          params: { message: 'Rule generated {{state.signalsCount}} signals' },
+          action_type_id: '.slack',
+        },
+      ],
+    },
+  });
+};
+
 export const getSetSignalStatusByIdsRequest = () =>
   requestMock.create({
     method: 'post',
@@ -616,3 +638,45 @@ export const getEmptyIndex = (): { _shards: Partial<ShardsResponse> } => ({
 export const getNonEmptyIndex = (): { _shards: Partial<ShardsResponse> } => ({
   _shards: { total: 1 },
 });
+
+export const getNotificationResult = (): RuleNotificationAlertType => ({
+  id: '200dbf2f-b269-4bf9-aa85-11ba32ba73ba',
+  name: 'Notification for Rule Test',
+  tags: ['__internal_rule_alert_id:85b64e8a-2e40-4096-86af-5ac172c10825'],
+  alertTypeId: 'siem.notifications',
+  consumer: 'siem',
+  params: {
+    ruleAlertId: '85b64e8a-2e40-4096-86af-5ac172c10825',
+  },
+  schedule: {
+    interval: '5m',
+  },
+  enabled: true,
+  actions: [
+    {
+      actionTypeId: '.slack',
+      params: {
+        message: 'Rule generated {{state.signalsCount}} signals\n\n{{rule.name}}\n{{resultsLink}}',
+      },
+      group: 'default',
+      id: '99403909-ca9b-49ba-9d7a-7e5320e68d05',
+    },
+  ],
+  throttle: null,
+  apiKey: null,
+  apiKeyOwner: 'elastic',
+  createdBy: 'elastic',
+  updatedBy: 'elastic',
+  createdAt: new Date('2020-03-21T11:15:13.530Z'),
+  muteAll: false,
+  mutedInstanceIds: [],
+  scheduledTaskId: '62b3a130-6b70-11ea-9ce9-6b9818c4cbd7',
+  updatedAt: new Date('2020-03-21T12:37:08.730Z'),
+});
+
+export const getFindNotificationsResultWithSingleHit = (): FindHit<RuleNotificationAlertType> => ({
+  page: 1,
+  perPage: 1,
+  total: 1,
+  data: [getNotificationResult()],
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.test.ts
index 1a4e19c2047b5..14592dd499d43 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.test.ts
@@ -15,10 +15,13 @@ import {
   getEmptyIndex,
   getFindResultWithSingleHit,
   createMlRuleRequest,
+  createRuleWithActionsRequest,
 } from '../__mocks__/request_responses';
 import { requestContextMock, serverMock, requestMock } from '../__mocks__';
 import { createRulesRoute } from './create_rules_route';
 import { setFeatureFlagsForTestsOnly, unSetFeatureFlagsForTestsOnly } from '../../feature_flags';
+import { createNotifications } from '../../notifications/create_notifications';
+jest.mock('../../notifications/create_notifications');
 
 describe('create_rules', () => {
   let server: ReturnType<typeof serverMock.create>;
@@ -65,6 +68,18 @@ describe('create_rules', () => {
     });
   });
 
+  describe('creating a Notification if throttle and actions were provided ', () => {
+    it('is successful', async () => {
+      const response = await server.inject(createRuleWithActionsRequest(), context);
+      expect(response.status).toEqual(200);
+      expect(createNotifications).toHaveBeenCalledWith(
+        expect.objectContaining({
+          ruleAlertId: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+        })
+      );
+    });
+  });
+
   describe('unhappy paths', () => {
     test('it returns a 400 if the index does not exist', async () => {
       clients.clusterClient.callAsCurrentUser.mockResolvedValue(getEmptyIndex());
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts
index cee9054cf922e..1fbbb5274d738 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/create_rules_route.ts
@@ -17,6 +17,7 @@ import { transformValidate } from './validate';
 import { getIndexExists } from '../../index/get_index_exists';
 import { createRulesSchema } from '../schemas/create_rules_schema';
 import { buildRouteValidation, transformError, buildSiemResponse } from '../utils';
+import { createNotifications } from '../../notifications/create_notifications';
 
 export const createRulesRoute = (router: IRouter): void => {
   router.post(
@@ -131,6 +132,18 @@ export const createRulesRoute = (router: IRouter): void => {
           version: 1,
           lists,
         });
+
+        if (throttle && actions.length) {
+          await createNotifications({
+            alertsClient,
+            enabled,
+            name,
+            interval,
+            actions,
+            ruleAlertId: createdRule.id,
+          });
+        }
+
         const ruleStatuses = await savedObjectsClient.find<
           IRuleSavedAttributesSavedObjectAttributes
         >({
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_bulk_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_bulk_route.ts
index c56f34588cbc6..85cfeefdceead 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_bulk_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_bulk_route.ts
@@ -16,6 +16,7 @@ import {
   DeleteRulesRequestParams,
 } from '../../rules/types';
 import { deleteRules } from '../../rules/delete_rules';
+import { deleteNotifications } from '../../notifications/delete_notifications';
 import { ruleStatusSavedObjectType } from '../../rules/saved_object_mappings';
 
 type Config = RouteConfig<unknown, unknown, DeleteRulesRequestParams, 'delete' | 'post'>;
@@ -57,6 +58,7 @@ export const deleteRulesBulkRoute = (router: IRouter) => {
             ruleId,
           });
           if (rule != null) {
+            await deleteNotifications({ alertsClient, ruleAlertId: rule.id });
             const ruleStatuses = await savedObjectsClient.find<
               IRuleSavedAttributesSavedObjectAttributes
             >({
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.ts
index 753b281dbc09e..6fd50abd9364a 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/delete_rules_route.ts
@@ -16,6 +16,7 @@ import {
   IRuleSavedAttributesSavedObjectAttributes,
 } from '../../rules/types';
 import { ruleStatusSavedObjectType } from '../../rules/saved_object_mappings';
+import { deleteNotifications } from '../../notifications/delete_notifications';
 
 export const deleteRulesRoute = (router: IRouter) => {
   router.delete(
@@ -52,6 +53,7 @@ export const deleteRulesRoute = (router: IRouter) => {
           ruleId,
         });
         if (rule != null) {
+          await deleteNotifications({ alertsClient, ruleAlertId: rule.id });
           const ruleStatuses = await savedObjectsClient.find<
             IRuleSavedAttributesSavedObjectAttributes
           >({
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts
index 7e56c32ade92a..f8cca6494e000 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/update_rules_route.ts
@@ -16,6 +16,7 @@ import { getIdError } from './utils';
 import { transformValidate } from './validate';
 import { ruleStatusSavedObjectType } from '../../rules/saved_object_mappings';
 import { updateRules } from '../../rules/update_rules';
+import { updateNotifications } from '../../notifications/update_notifications';
 
 export const updateRulesRoute = (router: IRouter) => {
   router.put(
@@ -117,7 +118,17 @@ export const updateRulesRoute = (router: IRouter) => {
           version,
           lists,
         });
+
         if (rule != null) {
+          await updateNotifications({
+            alertsClient,
+            actions,
+            enabled,
+            ruleAlertId: rule.id,
+            interval: throttle,
+            name,
+          });
+
           const ruleStatuses = await savedObjectsClient.find<
             IRuleSavedAttributesSavedObjectAttributes
           >({
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts
index e0ecbdedaac7c..a0458dc3a133d 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/rules/utils.ts
@@ -29,7 +29,7 @@ import {
   OutputError,
 } from '../utils';
 import { hasListsFeature } from '../../feature_flags';
-import { transformAlertToRuleAction } from '../../rules/transform_actions';
+import { transformAlertToRuleAction } from '../../../../../common/detection_engine/transform_actions';
 
 type PromiseFromStreams = ImportRuleAlertRest | Error;
 
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.test.ts
index 2b18e1b9bf52c..b10627d151fa2 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/add_prepackaged_rules_schema.test.ts
@@ -5,7 +5,8 @@
  */
 
 import { AlertAction } from '../../../../../../../../plugins/alerting/common';
-import { ThreatParams, PrepackagedRules, RuleAlertAction } from '../../types';
+import { RuleAlertAction } from '../../../../../common/detection_engine/types';
+import { ThreatParams, PrepackagedRules } from '../../types';
 import { addPrepackagedRulesSchema } from './add_prepackaged_rules_schema';
 import { setFeatureFlagsForTestsOnly, unSetFeatureFlagsForTestsOnly } from '../../feature_flags';
 
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.test.ts
index d9c3055512815..08bd01ee9a1a0 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/create_rules_schema.test.ts
@@ -7,7 +7,8 @@
 import { AlertAction } from '../../../../../../../../plugins/alerting/common';
 import { createRulesSchema } from './create_rules_schema';
 import { PatchRuleAlertParamsRest } from '../../rules/types';
-import { ThreatParams, RuleAlertParamsRest, RuleAlertAction } from '../../types';
+import { RuleAlertAction } from '../../../../../common/detection_engine/types';
+import { ThreatParams, RuleAlertParamsRest } from '../../types';
 import { setFeatureFlagsForTestsOnly, unSetFeatureFlagsForTestsOnly } from '../../feature_flags';
 
 describe('create rules schema', () => {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/import_rules_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/import_rules_schema.test.ts
index ffb49896ef7c7..c8e5bb981f921 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/import_rules_schema.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/import_rules_schema.test.ts
@@ -10,7 +10,8 @@ import {
   importRulesQuerySchema,
   importRulesPayloadSchema,
 } from './import_rules_schema';
-import { ThreatParams, ImportRuleAlertRest, RuleAlertAction } from '../../types';
+import { RuleAlertAction } from '../../../../../common/detection_engine/types';
+import { ThreatParams, ImportRuleAlertRest } from '../../types';
 import { ImportRulesRequestParams } from '../../rules/types';
 import { setFeatureFlagsForTestsOnly, unSetFeatureFlagsForTestsOnly } from '../../feature_flags';
 
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/patch_rules_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/patch_rules_schema.test.ts
index 42945e0970cba..45b5028f392b9 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/patch_rules_schema.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/patch_rules_schema.test.ts
@@ -7,7 +7,8 @@
 import { AlertAction } from '../../../../../../../../plugins/alerting/common';
 import { patchRulesSchema } from './patch_rules_schema';
 import { PatchRuleAlertParamsRest } from '../../rules/types';
-import { ThreatParams, RuleAlertAction } from '../../types';
+import { RuleAlertAction } from '../../../../../common/detection_engine/types';
+import { ThreatParams } from '../../types';
 import { setFeatureFlagsForTestsOnly, unSetFeatureFlagsForTestsOnly } from '../../feature_flags';
 
 describe('patch rules schema', () => {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.test.ts
index db3709cd6b126..6f6beea7fa5fb 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/routes/schemas/update_rules_schema.test.ts
@@ -7,7 +7,8 @@
 import { AlertAction } from '../../../../../../../../plugins/alerting/common';
 import { updateRulesSchema } from './update_rules_schema';
 import { PatchRuleAlertParamsRest } from '../../rules/types';
-import { ThreatParams, RuleAlertParamsRest, RuleAlertAction } from '../../types';
+import { RuleAlertAction } from '../../../../../common/detection_engine/types';
+import { ThreatParams, RuleAlertParamsRest } from '../../types';
 import { setFeatureFlagsForTestsOnly, unSetFeatureFlagsForTestsOnly } from '../../feature_flags';
 
 describe('create rules schema', () => {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
index db70b90d5a17c..a45b28ba3e105 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/create_rules.ts
@@ -6,12 +6,12 @@
 
 import { Alert } from '../../../../../../../plugins/alerting/common';
 import { APP_ID, SIGNALS_ID } from '../../../../common/constants';
+import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
 import { CreateRuleParams } from './types';
 import { addTags } from './add_tags';
 import { hasListsFeature } from '../feature_flags';
-import { transformRuleToAlertAction } from './transform_actions';
 
-export const createRules = ({
+export const createRules = async ({
   alertsClient,
   actionsClient, // TODO: Use this actionsClient once we have actions such as email, etc...
   actions,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/delete_rules.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/delete_rules.test.ts
new file mode 100644
index 0000000000000..38fc1dc5d1930
--- /dev/null
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/delete_rules.test.ts
@@ -0,0 +1,150 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { actionsClientMock } from '../../../../../../../plugins/actions/server/mocks';
+import { alertsClientMock } from '../../../../../../../plugins/alerting/server/mocks';
+import { deleteRules } from './delete_rules';
+import { readRules } from './read_rules';
+jest.mock('./read_rules');
+
+describe('deleteRules', () => {
+  let actionsClient: ReturnType<typeof actionsClientMock.create>;
+  let alertsClient: ReturnType<typeof alertsClientMock.create>;
+  const notificationId = 'notification-52128c15-0d1b-4716-a4c5-46997ac7f3bd';
+  const ruleId = 'rule-04128c15-0d1b-4716-a4c5-46997ac7f3bd';
+
+  beforeEach(() => {
+    actionsClient = actionsClientMock.create();
+    alertsClient = alertsClientMock.create();
+  });
+
+  it('should return null if notification was not found', async () => {
+    (readRules as jest.Mock).mockResolvedValue(null);
+
+    const result = await deleteRules({
+      alertsClient,
+      actionsClient,
+      id: notificationId,
+      ruleId,
+    });
+
+    expect(result).toBe(null);
+  });
+
+  it('should call alertsClient.delete if notification was found', async () => {
+    (readRules as jest.Mock).mockResolvedValue({
+      id: notificationId,
+    });
+
+    const result = await deleteRules({
+      alertsClient,
+      actionsClient,
+      id: notificationId,
+      ruleId,
+    });
+
+    expect(alertsClient.delete).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notificationId,
+      })
+    );
+    expect(result).toEqual({ id: notificationId });
+  });
+
+  it('should call alertsClient.delete if ruleId was null', async () => {
+    (readRules as jest.Mock).mockResolvedValue({
+      id: null,
+    });
+
+    const result = await deleteRules({
+      alertsClient,
+      actionsClient,
+      id: notificationId,
+      ruleId: null,
+    });
+
+    expect(alertsClient.delete).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notificationId,
+      })
+    );
+    expect(result).toEqual({ id: null });
+  });
+
+  it('should return null if alertsClient.delete rejects with 404 if ruleId was null', async () => {
+    (readRules as jest.Mock).mockResolvedValue({
+      id: null,
+    });
+
+    alertsClient.delete.mockRejectedValue({
+      output: {
+        statusCode: 404,
+      },
+    });
+
+    const result = await deleteRules({
+      alertsClient,
+      actionsClient,
+      id: notificationId,
+      ruleId: null,
+    });
+
+    expect(alertsClient.delete).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notificationId,
+      })
+    );
+    expect(result).toEqual(null);
+  });
+
+  it('should return error object if alertsClient.delete rejects with status different than 404 and if ruleId was null', async () => {
+    (readRules as jest.Mock).mockResolvedValue({
+      id: null,
+    });
+
+    const errorObject = {
+      output: {
+        statusCode: 500,
+      },
+    };
+
+    alertsClient.delete.mockRejectedValue(errorObject);
+
+    let errorResult;
+    try {
+      await deleteRules({
+        alertsClient,
+        actionsClient,
+        id: notificationId,
+        ruleId: null,
+      });
+    } catch (error) {
+      errorResult = error;
+    }
+
+    expect(alertsClient.delete).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: notificationId,
+      })
+    );
+    expect(errorResult).toEqual(errorObject);
+  });
+
+  it('should return null if ruleId and id was null', async () => {
+    (readRules as jest.Mock).mockResolvedValue({
+      id: null,
+    });
+
+    const result = await deleteRules({
+      alertsClient,
+      actionsClient,
+      id: undefined,
+      ruleId: null,
+    });
+
+    expect(result).toEqual(null);
+  });
+});
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/patch_rules.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/patch_rules.test.ts
index b424d2912ebc8..cd18bee6f606f 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/patch_rules.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/patch_rules.test.ts
@@ -7,7 +7,7 @@
 import { savedObjectsClientMock } from '../../../../../../../../src/core/server/mocks';
 import { alertsClientMock } from '../../../../../../../plugins/alerting/server/mocks';
 import { actionsClientMock } from '../../../../../../../plugins/actions/server/mocks';
-import { getMlResult } from '../routes/__mocks__/request_responses';
+import { getResult, getMlResult } from '../routes/__mocks__/request_responses';
 import { patchRules } from './patch_rules';
 
 describe('patchRules', () => {
@@ -21,6 +21,59 @@ describe('patchRules', () => {
     savedObjectsClient = savedObjectsClientMock.create();
   });
 
+  it('should call alertsClient.disable is the rule was enabled and enabled is false', async () => {
+    const rule = getResult();
+    alertsClient.get.mockResolvedValue(getResult());
+
+    await patchRules({
+      alertsClient,
+      actionsClient,
+      actions: [],
+      savedObjectsClient,
+      id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      ...rule.params,
+      enabled: false,
+      throttle: null,
+      interval: '',
+      name: '',
+      tags: [],
+    });
+
+    expect(alertsClient.disable).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      })
+    );
+  });
+
+  it('should call alertsClient.enable is the rule was disabled and enabled is true', async () => {
+    const rule = getResult();
+    alertsClient.get.mockResolvedValue({
+      ...getResult(),
+      enabled: false,
+    });
+
+    await patchRules({
+      alertsClient,
+      actionsClient,
+      actions: [],
+      savedObjectsClient,
+      id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      ...rule.params,
+      enabled: true,
+      throttle: null,
+      interval: '',
+      name: '',
+      tags: [],
+    });
+
+    expect(alertsClient.enable).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      })
+    );
+  });
+
   it('calls the alertsClient with ML params', async () => {
     alertsClient.get.mockResolvedValue(getMlResult());
     const params = {
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/patch_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/patch_rules.ts
index 5b6fd08a9ea89..5394af526c917 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/patch_rules.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/patch_rules.ts
@@ -6,12 +6,12 @@
 
 import { defaults } from 'lodash/fp';
 import { PartialAlert } from '../../../../../../../plugins/alerting/server';
+import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
 import { readRules } from './read_rules';
 import { PatchRuleParams, IRuleSavedAttributesSavedObjectAttributes } from './types';
 import { addTags } from './add_tags';
 import { ruleStatusSavedObjectType } from './saved_object_mappings';
 import { calculateVersion, calculateName, calculateInterval } from './utils';
-import { transformRuleToAlertAction } from './transform_actions';
 
 export const patchRules = async ({
   alertsClient,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/read_rules.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/read_rules.test.ts
index 862ea9d2dcbe5..38a883329318b 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/read_rules.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/read_rules.test.ts
@@ -8,7 +8,7 @@ import { readRules } from './read_rules';
 import { alertsClientMock } from '../../../../../../../plugins/alerting/server/mocks';
 import { getResult, getFindResultWithSingleHit } from '../routes/__mocks__/request_responses';
 
-class TestError extends Error {
+export class TestError extends Error {
   constructor() {
     // Pass remaining arguments (including vendor specific ones) to parent constructor
     super();
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.test.ts
index 967a32df20c3b..af00816abfc3d 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.test.ts
@@ -7,7 +7,7 @@
 import { savedObjectsClientMock } from '../../../../../../../../src/core/server/mocks';
 import { alertsClientMock } from '../../../../../../../plugins/alerting/server/mocks';
 import { actionsClientMock } from '../../../../../../../plugins/actions/server/mocks';
-import { getMlResult } from '../routes/__mocks__/request_responses';
+import { getResult, getMlResult } from '../routes/__mocks__/request_responses';
 import { updateRules } from './update_rules';
 
 describe('updateRules', () => {
@@ -21,6 +21,59 @@ describe('updateRules', () => {
     savedObjectsClient = savedObjectsClientMock.create();
   });
 
+  it('should call alertsClient.disable is the rule was enabled and enabled is false', async () => {
+    const rule = getResult();
+    alertsClient.get.mockResolvedValue(getResult());
+
+    await updateRules({
+      alertsClient,
+      actionsClient,
+      actions: [],
+      savedObjectsClient,
+      id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      ...rule.params,
+      enabled: false,
+      throttle: null,
+      interval: '',
+      name: '',
+      tags: [],
+    });
+
+    expect(alertsClient.disable).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      })
+    );
+  });
+
+  it('should call alertsClient.enable is the rule was disabled and enabled is true', async () => {
+    const rule = getResult();
+    alertsClient.get.mockResolvedValue({
+      ...getResult(),
+      enabled: false,
+    });
+
+    await updateRules({
+      alertsClient,
+      actionsClient,
+      actions: [],
+      savedObjectsClient,
+      id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      ...rule.params,
+      enabled: true,
+      throttle: null,
+      interval: '',
+      name: '',
+      tags: [],
+    });
+
+    expect(alertsClient.enable).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: '04128c15-0d1b-4716-a4c5-46997ac7f3bd',
+      })
+    );
+  });
+
   it('calls the alertsClient with ML params', async () => {
     alertsClient.get.mockResolvedValue(getMlResult());
 
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts
index a80f986482010..72cbc959c0105 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/update_rules.ts
@@ -5,13 +5,13 @@
  */
 
 import { PartialAlert } from '../../../../../../../plugins/alerting/server';
+import { transformRuleToAlertAction } from '../../../../common/detection_engine/transform_actions';
 import { readRules } from './read_rules';
 import { IRuleSavedAttributesSavedObjectAttributes, UpdateRuleParams } from './types';
 import { addTags } from './add_tags';
 import { ruleStatusSavedObjectType } from './saved_object_mappings';
 import { calculateVersion } from './utils';
 import { hasListsFeature } from '../feature_flags';
-import { transformRuleToAlertAction } from './transform_actions';
 
 export const updateRules = async ({
   alertsClient,
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts
index adbd5f81d372a..f485769dffabc 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_bulk_body.ts
@@ -8,7 +8,8 @@ import { SignalSourceHit, SignalHit } from './types';
 import { buildRule } from './build_rule';
 import { buildSignal } from './build_signal';
 import { buildEventTypeSignal } from './build_event_type_signal';
-import { RuleTypeParams, RuleAlertAction } from '../types';
+import { RuleAlertAction } from '../../../../common/detection_engine/types';
+import { RuleTypeParams } from '../types';
 
 interface BuildBulkBodyParams {
   doc: SignalSourceHit;
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts
index e94ca18b186e4..1de80ca0b7eaf 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/build_rule.ts
@@ -5,7 +5,8 @@
  */
 
 import { pickBy } from 'lodash/fp';
-import { RuleTypeParams, OutputRuleAlertRest, RuleAlertAction } from '../types';
+import { RuleAlertAction } from '../../../../common/detection_engine/types';
+import { RuleTypeParams, OutputRuleAlertRest } from '../types';
 
 interface BuildRuleParams {
   ruleParams: RuleTypeParams;
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/bulk_create_ml_signals.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/bulk_create_ml_signals.ts
index 95adb90172404..66e9f42061658 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/bulk_create_ml_signals.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/bulk_create_ml_signals.ts
@@ -9,7 +9,8 @@ import { SearchResponse } from 'elasticsearch';
 
 import { Logger } from '../../../../../../../../src/core/server';
 import { AlertServices } from '../../../../../../../plugins/alerting/server';
-import { RuleTypeParams, RuleAlertAction } from '../types';
+import { RuleAlertAction } from '../../../../common/detection_engine/types';
+import { RuleTypeParams } from '../types';
 import { singleBulkCreate } from './single_bulk_create';
 import { AnomalyResults, Anomaly } from '../../machine_learning';
 
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.test.ts
index b49f43ce9e7ac..86d1278031695 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.test.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/get_filter.test.ts
@@ -510,6 +510,20 @@ describe('get_filter', () => {
       ).rejects.toThrow('savedId parameter should be defined');
     });
 
+    test('throws on machine learning query', async () => {
+      await expect(
+        getFilter({
+          type: 'machine_learning',
+          filters: undefined,
+          language: undefined,
+          query: undefined,
+          savedId: 'some-id',
+          services: servicesMock,
+          index: undefined,
+        })
+      ).rejects.toThrow('Unsupported Rule of type "machine_learning" supplied to getFilter');
+    });
+
     test('it works with references and does not add indexes', () => {
       const esQuery = getQueryFilter(
         '(event.module:suricata and event.kind:alert) and suricata.eve.alert.signature_id: (2610182 or 2610183 or 2610184 or 2610185 or 2610186 or 2610187)',
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts
index a12778d5b8f16..4f1a187a82937 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/search_after_bulk_create.ts
@@ -5,7 +5,8 @@
  */
 
 import { AlertServices } from '../../../../../../../plugins/alerting/server';
-import { RuleTypeParams, RuleAlertAction } from '../types';
+import { RuleAlertAction } from '../../../../common/detection_engine/types';
+import { RuleTypeParams } from '../types';
 import { Logger } from '../../../../../../../../src/core/server';
 import { singleSearchAfter } from './single_search_after';
 import { singleBulkCreate } from './single_bulk_create';
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
index 89dcd3274ebed..03d48a6b27867 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -5,13 +5,17 @@
  */
 
 import { Logger } from 'src/core/server';
-import { SIGNALS_ID, DEFAULT_SEARCH_AFTER_PAGE_SIZE } from '../../../../common/constants';
+import {
+  SIGNALS_ID,
+  DEFAULT_SEARCH_AFTER_PAGE_SIZE,
+  NOTIFICATION_THROTTLE_RULE,
+} from '../../../../common/constants';
 
 import { buildEventsSearchQuery } from './build_events_query';
 import { getInputIndex } from './get_input_output_index';
 import { searchAfterAndBulkCreate } from './search_after_bulk_create';
 import { getFilter } from './get_filter';
-import { SignalRuleAlertTypeDefinition, AlertAttributes } from './types';
+import { SignalRuleAlertTypeDefinition, RuleAlertAttributes } from './types';
 import { getGapBetweenRuns } from './utils';
 import { writeSignalRuleExceptionToSavedObject } from './write_signal_rule_exception_to_saved_object';
 import { signalParamsSchema } from './signal_params_schema';
@@ -22,6 +26,8 @@ import { getCurrentStatusSavedObject } from './get_current_status_saved_object';
 import { writeCurrentStatusSucceeded } from './write_current_status_succeeded';
 import { findMlSignals } from './find_ml_signals';
 import { bulkCreateMlSignals } from './bulk_create_ml_signals';
+import { getSignalsCount } from '../notifications/get_signals_count';
+import { scheduleNotificationActions } from '../notifications/schedule_notification_actions';
 
 export const signalRulesAlertType = ({
   logger,
@@ -46,6 +52,7 @@ export const signalRulesAlertType = ({
         index,
         filters,
         language,
+        meta,
         machineLearningJobId,
         outputIndex,
         savedId,
@@ -53,7 +60,10 @@ export const signalRulesAlertType = ({
         to,
         type,
       } = params;
-      const savedObject = await services.savedObjectsClient.get<AlertAttributes>('alert', alertId);
+      const savedObject = await services.savedObjectsClient.get<RuleAlertAttributes>(
+        'alert',
+        alertId
+      );
 
       const ruleStatusSavedObjects = await getRuleStatusSavedObjects({
         alertId,
@@ -76,6 +86,7 @@ export const signalRulesAlertType = ({
         enabled,
         schedule: { interval },
         throttle,
+        params: ruleParams,
       } = savedObject.attributes;
 
       const updatedAt = savedObject.updated_at ?? '';
@@ -199,6 +210,36 @@ export const signalRulesAlertType = ({
         }
 
         if (creationSucceeded) {
+          if (meta?.throttle === NOTIFICATION_THROTTLE_RULE && actions.length) {
+            const notificationRuleParams = {
+              ...ruleParams,
+              name,
+            };
+            const { signalsCount, resultsLink } = await getSignalsCount({
+              from: `now-${interval}`,
+              to: 'now',
+              index: ruleParams.outputIndex,
+              ruleId: ruleParams.ruleId!,
+              kibanaUrl: meta?.kibanaUrl as string,
+              ruleAlertId: savedObject.id,
+              callCluster: services.callCluster,
+            });
+
+            logger.info(
+              `Found ${signalsCount} signals using signal rule name: "${notificationRuleParams.name}", id: "${notificationRuleParams.ruleId}", rule_id: "${notificationRuleParams.ruleId}" in "${notificationRuleParams.outputIndex}" index`
+            );
+
+            if (signalsCount) {
+              const alertInstance = services.alertInstanceFactory(alertId);
+              scheduleNotificationActions({
+                alertInstance,
+                signalsCount,
+                resultsLink,
+                ruleParams: notificationRuleParams,
+              });
+            }
+          }
+
           logger.debug(
             `Finished signal rule name: "${name}", id: "${alertId}", rule_id: "${ruleId}", output_index: "${outputIndex}"`
           );
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.ts
index 333a938e09d45..e2e4471f609ac 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.ts
@@ -8,7 +8,8 @@ import { countBy, isEmpty } from 'lodash';
 import { performance } from 'perf_hooks';
 import { AlertServices } from '../../../../../../../plugins/alerting/server';
 import { SignalSearchResponse, BulkResponse } from './types';
-import { RuleTypeParams, RuleAlertAction } from '../types';
+import { RuleAlertAction } from '../../../../common/detection_engine/types';
+import { RuleTypeParams } from '../types';
 import { generateId } from './utils';
 import { buildBulkBody } from './build_bulk_body';
 import { Logger } from '../../../../../../../../src/core/server';
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts
index 06acff825f68e..93c48ed38c7c4 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/types.ts
@@ -4,7 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { RuleAlertParams, OutputRuleAlertRest, RuleAlertAction } from '../types';
+import { RuleAlertAction } from '../../../../common/detection_engine/types';
+import { RuleAlertParams, OutputRuleAlertRest } from '../types';
 import { SearchResponse } from '../../types';
 import {
   AlertType,
@@ -159,3 +160,7 @@ export interface AlertAttributes {
   };
   throttle: string | null;
 }
+
+export interface RuleAlertAttributes extends AlertAttributes {
+  params: RuleAlertParams;
+}
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts
index 2cbdc7db3ba64..aae8763a7ea39 100644
--- a/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/detection_engine/types.ts
@@ -4,11 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AlertAction } from '../../../../../../plugins/alerting/common';
 import { CallAPIOptions } from '../../../../../../../src/core/server';
 import { Filter } from '../../../../../../../src/plugins/data/server';
 import { IRuleStatusAttributes } from './rules/types';
 import { ListsDefaultArraySchema } from './routes/schemas/types/lists_default_array';
+import { RuleAlertAction } from '../../../common/detection_engine/types';
 
 export type PartialFilter = Partial<Filter>;
 
@@ -24,10 +24,6 @@ export interface ThreatParams {
   technique: IMitreAttack[];
 }
 
-export type RuleAlertAction = Omit<AlertAction, 'actionTypeId'> & {
-  action_type_id: string;
-};
-
 // Notice below we are using lists: ListsDefaultArraySchema[]; which is coming directly from the response output section.
 // TODO: Eventually this whole RuleAlertParams will be replaced with io-ts. For now we can slowly strangle it out and reduce duplicate types
 // We don't have the input types defined through io-ts just yet but as we being introducing types from there we will more and more remove
@@ -56,7 +52,7 @@ export interface RuleAlertParams {
   query: string | undefined | null;
   references: string[];
   savedId?: string | undefined | null;
-  meta: Record<string, {}> | undefined | null;
+  meta: Record<string, {} | string> | undefined | null;
   severity: string;
   tags: string[];
   to: string;
@@ -123,6 +119,7 @@ export type OutputRuleAlertRest = RuleAlertParamsRest & {
   created_by: string | undefined | null;
   updated_by: string | undefined | null;
   immutable: boolean;
+  throttle: string | undefined | null;
 };
 
 export type ImportRuleAlertRest = Omit<OutputRuleAlertRest, 'rule_id' | 'id'> & {
diff --git a/x-pack/legacy/plugins/siem/server/lib/kpi_hosts/mock.ts b/x-pack/legacy/plugins/siem/server/lib/kpi_hosts/mock.ts
index b82a540900bd0..ed9fbf0ba0646 100644
--- a/x-pack/legacy/plugins/siem/server/lib/kpi_hosts/mock.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/kpi_hosts/mock.ts
@@ -356,15 +356,15 @@ export const mockKpiHostDetailsUniqueIpsQuery = [
 ];
 
 const mockAuthAggs = {
-  authentication_success: { filter: { term: { 'event.type': 'authentication_success' } } },
+  authentication_success: { filter: { term: { 'event.outcome': 'success' } } },
   authentication_success_histogram: {
     auto_date_histogram: { field: '@timestamp', buckets: '6' },
-    aggs: { count: { filter: { term: { 'event.type': 'authentication_success' } } } },
+    aggs: { count: { filter: { term: { 'event.outcome': 'success' } } } },
   },
-  authentication_failure: { filter: { term: { 'event.type': 'authentication_failure' } } },
+  authentication_failure: { filter: { term: { 'event.outcome': 'failure' } } },
   authentication_failure_histogram: {
     auto_date_histogram: { field: '@timestamp', buckets: '6' },
-    aggs: { count: { filter: { term: { 'event.type': 'authentication_failure' } } } },
+    aggs: { count: { filter: { term: { 'event.outcome': 'failure' } } } },
   },
 };
 
diff --git a/x-pack/legacy/plugins/siem/server/lib/kpi_hosts/query_authentication.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/kpi_hosts/query_authentication.dsl.ts
index 5734aa6ee88cc..0b7803d007194 100644
--- a/x-pack/legacy/plugins/siem/server/lib/kpi_hosts/query_authentication.dsl.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/kpi_hosts/query_authentication.dsl.ts
@@ -49,7 +49,7 @@ export const buildAuthQuery = ({
         authentication_success: {
           filter: {
             term: {
-              'event.type': 'authentication_success',
+              'event.outcome': 'success',
             },
           },
         },
@@ -62,7 +62,7 @@ export const buildAuthQuery = ({
             count: {
               filter: {
                 term: {
-                  'event.type': 'authentication_success',
+                  'event.outcome': 'success',
                 },
               },
             },
@@ -71,7 +71,7 @@ export const buildAuthQuery = ({
         authentication_failure: {
           filter: {
             term: {
-              'event.type': 'authentication_failure',
+              'event.outcome': 'failure',
             },
           },
         },
@@ -84,7 +84,7 @@ export const buildAuthQuery = ({
             count: {
               filter: {
                 term: {
-                  'event.type': 'authentication_failure',
+                  'event.outcome': 'failure',
                 },
               },
             },
diff --git a/x-pack/legacy/plugins/siem/server/lib/matrix_histogram/query.authentications_over_time.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/matrix_histogram/query.authentications_over_time.dsl.ts
index ccf0d235abdd3..34a3804f974de 100644
--- a/x-pack/legacy/plugins/siem/server/lib/matrix_histogram/query.authentications_over_time.dsl.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/matrix_histogram/query.authentications_over_time.dsl.ts
@@ -13,10 +13,21 @@ export const buildAuthenticationsOverTimeQuery = ({
   sourceConfiguration: {
     fields: { timestamp },
   },
-  stackByField = 'event.type',
+  stackByField = 'event.outcome',
 }: MatrixHistogramRequestOptions) => {
   const filter = [
     ...createQueryFilterClauses(filterQuery),
+    {
+      bool: {
+        must: [
+          {
+            term: {
+              'event.category': 'authentication',
+            },
+          },
+        ],
+      },
+    },
     {
       range: {
         [timestamp]: {
@@ -45,7 +56,7 @@ export const buildAuthenticationsOverTimeQuery = ({
       eventActionGroup: {
         terms: {
           field: stackByField,
-          include: ['authentication_success', 'authentication_failure'],
+          include: ['success', 'failure'],
           order: {
             _count: 'desc',
           },
diff --git a/x-pack/legacy/plugins/siem/server/lib/tls/elasticsearch_adapter.ts b/x-pack/legacy/plugins/siem/server/lib/tls/elasticsearch_adapter.ts
index 716eea3f8df5b..10929c3d03641 100644
--- a/x-pack/legacy/plugins/siem/server/lib/tls/elasticsearch_adapter.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/tls/elasticsearch_adapter.ts
@@ -66,10 +66,9 @@ export const formatTlsEdges = (buckets: TlsBuckets[]): TlsEdges[] => {
     const edge: TlsEdges = {
       node: {
         _id: bucket.key,
-        alternativeNames: bucket.alternative_names.buckets.map(({ key }) => key),
-        commonNames: bucket.common_names.buckets.map(({ key }) => key),
+        subjects: bucket.subjects.buckets.map(({ key }) => key),
         ja3: bucket.ja3.buckets.map(({ key }) => key),
-        issuerNames: bucket.issuer_names.buckets.map(({ key }) => key),
+        issuers: bucket.issuers.buckets.map(({ key }) => key),
         // eslint-disable-next-line @typescript-eslint/camelcase
         notAfter: bucket.not_after.buckets.map(({ key_as_string }) => key_as_string),
       },
diff --git a/x-pack/legacy/plugins/siem/server/lib/tls/mock.ts b/x-pack/legacy/plugins/siem/server/lib/tls/mock.ts
index 4b27d541ec992..b97a6fa509ef2 100644
--- a/x-pack/legacy/plugins/siem/server/lib/tls/mock.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/tls/mock.ts
@@ -20,11 +20,10 @@ export const mockTlsQuery = {
           order: { _key: 'desc' },
         },
         aggs: {
-          issuer_names: { terms: { field: 'tls.server_certificate.issuer.common_name' } },
-          common_names: { terms: { field: 'tls.server_certificate.subject.common_name' } },
-          alternative_names: { terms: { field: 'tls.server_certificate.alternative_names' } },
-          not_after: { terms: { field: 'tls.server_certificate.not_after' } },
-          ja3: { terms: { field: 'tls.fingerprints.ja3.hash' } },
+          issuers: { terms: { field: 'tls.server.issuer' } },
+          subjects: { terms: { field: 'tls.server.subject' } },
+          not_after: { terms: { field: 'tls.server.not_after' } },
+          ja3: { terms: { field: 'tls.server.ja3s' } },
         },
       },
     },
@@ -44,16 +43,8 @@ export const expectedTlsEdges = [
     },
     node: {
       _id: 'fff8dc95436e0e25ce46b1526a1a547e8cf3bb82',
-      alternativeNames: [
-        '*.1.nflxso.net',
-        '*.a.nflxso.net',
-        'assets.nflxext.com',
-        'cast.netflix.com',
-        'codex.nflxext.com',
-        'tvui.netflix.com',
-      ],
-      commonNames: ['*.1.nflxso.net'],
-      issuerNames: ['DigiCert SHA2 Secure Server CA'],
+      subjects: ['*.1.nflxso.net'],
+      issuers: ['DigiCert SHA2 Secure Server CA'],
       ja3: ['95d2dd53a89b334cddd5c22e81e7fe61'],
       notAfter: ['2019-10-27T12:00:00.000Z'],
     },
@@ -65,9 +56,8 @@ export const expectedTlsEdges = [
     },
     node: {
       _id: 'fd8440c4b20978b173e0910e2639d114f0d405c5',
-      alternativeNames: ['*.cogocast.net', 'cogocast.net'],
-      commonNames: ['cogocast.net'],
-      issuerNames: ['Amazon'],
+      subjects: ['cogocast.net'],
+      issuers: ['Amazon'],
       ja3: ['a111d93cdf31f993c40a8a9ef13e8d7e'],
       notAfter: ['2020-02-01T12:00:00.000Z'],
     },
@@ -76,12 +66,8 @@ export const expectedTlsEdges = [
     cursor: { tiebreaker: null, value: 'fcdc16645ebb3386adc96e7ba735c4745709b9dd' },
     node: {
       _id: 'fcdc16645ebb3386adc96e7ba735c4745709b9dd',
-      alternativeNames: [
-        'player-devintever2-imperva.mountain.siriusxm.com',
-        'player-devintever2.mountain.siriusxm.com',
-      ],
-      commonNames: ['player-devintever2.mountain.siriusxm.com'],
-      issuerNames: ['Trustwave Organization Validation SHA256 CA, Level 1'],
+      subjects: ['player-devintever2.mountain.siriusxm.com'],
+      issuers: ['Trustwave Organization Validation SHA256 CA, Level 1'],
       ja3: ['6fa3244afc6bb6f9fad207b6b52af26b'],
       notAfter: ['2020-03-06T21:57:09.000Z'],
     },
@@ -90,15 +76,8 @@ export const expectedTlsEdges = [
     cursor: { tiebreaker: null, value: 'fccf375789cb7e671502a7b0cc969f218a4b2c70' },
     node: {
       _id: 'fccf375789cb7e671502a7b0cc969f218a4b2c70',
-      alternativeNames: [
-        'appleid-nc-s.apple.com',
-        'appleid-nwk-s.apple.com',
-        'appleid-prn-s.apple.com',
-        'appleid-rno-s.apple.com',
-        'appleid.apple.com',
-      ],
-      commonNames: ['appleid.apple.com'],
-      issuerNames: ['DigiCert SHA2 Extended Validation Server CA'],
+      subjects: ['appleid.apple.com'],
+      issuers: ['DigiCert SHA2 Extended Validation Server CA'],
       ja3: ['6fa3244afc6bb6f9fad207b6b52af26b'],
       notAfter: ['2020-07-04T12:00:00.000Z'],
     },
@@ -107,20 +86,8 @@ export const expectedTlsEdges = [
     cursor: { tiebreaker: null, value: 'fc4a296b706fa18ac50b96f5c0327c69db4a8981' },
     node: {
       _id: 'fc4a296b706fa18ac50b96f5c0327c69db4a8981',
-      alternativeNames: [
-        'api.itunes.apple.com',
-        'appsto.re',
-        'ax.init.itunes.apple.com',
-        'bag.itunes.apple.com',
-        'bookkeeper.itunes.apple.com',
-        'c.itunes.apple.com',
-        'carrierbundle.itunes.apple.com',
-        'client-api.itunes.apple.com',
-        'cma.itunes.apple.com',
-        'courses.apple.com',
-      ],
-      commonNames: ['itunes.apple.com'],
-      issuerNames: ['DigiCert SHA2 Extended Validation Server CA'],
+      subjects: ['itunes.apple.com'],
+      issuers: ['DigiCert SHA2 Extended Validation Server CA'],
       ja3: ['a441a33aaee795f498d6b764cc78989a'],
       notAfter: ['2020-03-24T12:00:00.000Z'],
     },
@@ -129,20 +96,8 @@ export const expectedTlsEdges = [
     cursor: { tiebreaker: null, value: 'fc2cbc41f6a0e9c0118de4fe40f299f7207b797e' },
     node: {
       _id: 'fc2cbc41f6a0e9c0118de4fe40f299f7207b797e',
-      alternativeNames: [
-        '*.adlercasino.com',
-        '*.allaustraliancasino.com',
-        '*.alletf.com',
-        '*.appareldesignpartners.com',
-        '*.atmosfir.net',
-        '*.cityofboston.gov',
-        '*.cp.mytoyotaentune.com',
-        '*.decathlon.be',
-        '*.decathlon.co.uk',
-        '*.decathlon.de',
-      ],
-      commonNames: ['incapsula.com'],
-      issuerNames: ['GlobalSign CloudSSL CA - SHA256 - G3'],
+      subjects: ['incapsula.com'],
+      issuers: ['GlobalSign CloudSSL CA - SHA256 - G3'],
       ja3: ['6fa3244afc6bb6f9fad207b6b52af26b'],
       notAfter: ['2020-04-04T14:05:06.000Z'],
     },
@@ -151,9 +106,8 @@ export const expectedTlsEdges = [
     cursor: { tiebreaker: null, value: 'fb70d78ffa663a3a4374d841b3288d2de9759566' },
     node: {
       _id: 'fb70d78ffa663a3a4374d841b3288d2de9759566',
-      alternativeNames: ['*.siriusxm.com', 'siriusxm.com'],
-      commonNames: ['*.siriusxm.com'],
-      issuerNames: ['DigiCert Baltimore CA-2 G2'],
+      subjects: ['*.siriusxm.com'],
+      issuers: ['DigiCert Baltimore CA-2 G2'],
       ja3: ['535aca3d99fc247509cd50933cd71d37', '6fa3244afc6bb6f9fad207b6b52af26b'],
       notAfter: ['2021-10-27T12:00:00.000Z'],
     },
@@ -162,16 +116,8 @@ export const expectedTlsEdges = [
     cursor: { tiebreaker: null, value: 'fb59038dcec33ab3a01a6ae60d0835ad0e04ccf0' },
     node: {
       _id: 'fb59038dcec33ab3a01a6ae60d0835ad0e04ccf0',
-      alternativeNames: [
-        'photos.amazon.co.uk',
-        'photos.amazon.de',
-        'photos.amazon.es',
-        'photos.amazon.eu',
-        'photos.amazon.fr',
-        'photos.amazon.it',
-      ],
-      commonNames: ['photos.amazon.eu'],
-      issuerNames: ['Amazon'],
+      subjects: ['photos.amazon.eu'],
+      issuers: ['Amazon'],
       ja3: ['6fa3244afc6bb6f9fad207b6b52af26b'],
       notAfter: ['2020-04-23T12:00:00.000Z'],
     },
@@ -180,20 +126,8 @@ export const expectedTlsEdges = [
     cursor: { tiebreaker: null, value: 'f9815293c883a6006f0b2d95a4895bdc501fd174' },
     node: {
       _id: 'f9815293c883a6006f0b2d95a4895bdc501fd174',
-      alternativeNames: [
-        '*.api.cdn.hbo.com',
-        '*.artist.cdn.hbo.com',
-        '*.cdn.hbo.com',
-        '*.lv3.cdn.hbo.com',
-        'artist.api.cdn.hbo.com',
-        'artist.api.lv3.cdn.hbo.com',
-        'artist.staging.cdn.hbo.com',
-        'artist.staging.hurley.lv3.cdn.hbo.com',
-        'atv.api.lv3.cdn.hbo.com',
-        'atv.staging.hurley.lv3.cdn.hbo.com',
-      ],
-      commonNames: ['cdn.hbo.com'],
-      issuerNames: ['Sectigo RSA Organization Validation Secure Server CA'],
+      subjects: ['cdn.hbo.com'],
+      issuers: ['Sectigo RSA Organization Validation Secure Server CA'],
       ja3: ['6fa3244afc6bb6f9fad207b6b52af26b'],
       notAfter: ['2021-02-10T23:59:59.000Z'],
     },
@@ -202,9 +136,8 @@ export const expectedTlsEdges = [
     cursor: { tiebreaker: null, value: 'f8db6a69797e383dca2529727369595733123386' },
     node: {
       _id: 'f8db6a69797e383dca2529727369595733123386',
-      alternativeNames: ['www.google.com'],
-      commonNames: ['www.google.com'],
-      issuerNames: ['GTS CA 1O1'],
+      subjects: ['www.google.com'],
+      issuers: ['GTS CA 1O1'],
       ja3: ['a111d93cdf31f993c40a8a9ef13e8d7e'],
       notAfter: ['2019-12-10T13:32:54.000Z'],
     },
@@ -226,7 +159,7 @@ export const mockRequest = {
       timerange: { interval: '12h', from: 1570716261267, to: 1570802661267 },
     },
     query:
-      'query GetTlsQuery($sourceId: ID!, $filterQuery: String, $flowTarget: FlowTarget!, $ip: String!, $pagination: PaginationInputPaginated!, $sort: TlsSortField!, $timerange: TimerangeInput!, $defaultIndex: [String!]!, $inspect: Boolean!) {\n  source(id: $sourceId) {\n    id\n    Tls(filterQuery: $filterQuery, flowTarget: $flowTarget, ip: $ip, pagination: $pagination, sort: $sort, timerange: $timerange, defaultIndex: $defaultIndex) {\n      totalCount\n      edges {\n        node {\n          _id\n          alternativeNames\n          commonNames\n          ja3\n          issuerNames\n          notAfter\n          __typename\n        }\n        cursor {\n          value\n          __typename\n        }\n        __typename\n      }\n      pageInfo {\n        activePage\n        fakeTotalCount\n        showMorePagesIndicator\n        __typename\n      }\n      inspect @include(if: $inspect) {\n        dsl\n        response\n        __typename\n      }\n      __typename\n    }\n    __typename\n  }\n}\n',
+      'query GetTlsQuery($sourceId: ID!, $filterQuery: String, $flowTarget: FlowTarget!, $ip: String!, $pagination: PaginationInputPaginated!, $sort: TlsSortField!, $timerange: TimerangeInput!, $defaultIndex: [String!]!, $inspect: Boolean!) {\n  source(id: $sourceId) {\n    id\n    Tls(filterQuery: $filterQuery, flowTarget: $flowTarget, ip: $ip, pagination: $pagination, sort: $sort, timerange: $timerange, defaultIndex: $defaultIndex) {\n      totalCount\n      edges {\n        node {\n          _id\n          subjects\n          ja3\n          issuers\n          notAfter\n          __typename\n        }\n        cursor {\n          value\n          __typename\n        }\n        __typename\n      }\n      pageInfo {\n        activePage\n        fakeTotalCount\n        showMorePagesIndicator\n        __typename\n      }\n      inspect @include(if: $inspect) {\n        dsl\n        response\n        __typename\n      }\n      __typename\n    }\n    __typename\n  }\n}\n',
   },
 };
 
@@ -250,28 +183,16 @@ export const mockResponse = {
               { key: 1572177600000, key_as_string: '2019-10-27T12:00:00.000Z', doc_count: 1 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'DigiCert SHA2 Secure Server CA', doc_count: 1 }],
           },
-          common_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: '*.1.nflxso.net', doc_count: 1 }],
           },
-          alternative_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 0,
-            buckets: [
-              { key: '*.1.nflxso.net', doc_count: 1 },
-              { key: '*.a.nflxso.net', doc_count: 1 },
-              { key: 'assets.nflxext.com', doc_count: 1 },
-              { key: 'cast.netflix.com', doc_count: 1 },
-              { key: 'codex.nflxext.com', doc_count: 1 },
-              { key: 'tvui.netflix.com', doc_count: 1 },
-            ],
-          },
           ja3: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
@@ -288,24 +209,16 @@ export const mockResponse = {
               { key: 1580558400000, key_as_string: '2020-02-01T12:00:00.000Z', doc_count: 1 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'Amazon', doc_count: 1 }],
           },
-          common_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'cogocast.net', doc_count: 1 }],
           },
-          alternative_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 0,
-            buckets: [
-              { key: '*.cogocast.net', doc_count: 1 },
-              { key: 'cogocast.net', doc_count: 1 },
-            ],
-          },
           ja3: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
@@ -322,26 +235,18 @@ export const mockResponse = {
               { key: 1583531829000, key_as_string: '2020-03-06T21:57:09.000Z', doc_count: 1 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [
               { key: 'Trustwave Organization Validation SHA256 CA, Level 1', doc_count: 1 },
             ],
           },
-          common_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'player-devintever2.mountain.siriusxm.com', doc_count: 1 }],
           },
-          alternative_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 0,
-            buckets: [
-              { key: 'player-devintever2-imperva.mountain.siriusxm.com', doc_count: 1 },
-              { key: 'player-devintever2.mountain.siriusxm.com', doc_count: 1 },
-            ],
-          },
           ja3: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
@@ -358,27 +263,16 @@ export const mockResponse = {
               { key: 1593864000000, key_as_string: '2020-07-04T12:00:00.000Z', doc_count: 1 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'DigiCert SHA2 Extended Validation Server CA', doc_count: 1 }],
           },
-          common_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'appleid.apple.com', doc_count: 1 }],
           },
-          alternative_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 0,
-            buckets: [
-              { key: 'appleid-nc-s.apple.com', doc_count: 1 },
-              { key: 'appleid-nwk-s.apple.com', doc_count: 1 },
-              { key: 'appleid-prn-s.apple.com', doc_count: 1 },
-              { key: 'appleid-rno-s.apple.com', doc_count: 1 },
-              { key: 'appleid.apple.com', doc_count: 1 },
-            ],
-          },
           ja3: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
@@ -395,32 +289,16 @@ export const mockResponse = {
               { key: 1585051200000, key_as_string: '2020-03-24T12:00:00.000Z', doc_count: 2 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'DigiCert SHA2 Extended Validation Server CA', doc_count: 2 }],
           },
-          common_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'itunes.apple.com', doc_count: 2 }],
           },
-          alternative_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 156,
-            buckets: [
-              { key: 'api.itunes.apple.com', doc_count: 2 },
-              { key: 'appsto.re', doc_count: 2 },
-              { key: 'ax.init.itunes.apple.com', doc_count: 2 },
-              { key: 'bag.itunes.apple.com', doc_count: 2 },
-              { key: 'bookkeeper.itunes.apple.com', doc_count: 2 },
-              { key: 'c.itunes.apple.com', doc_count: 2 },
-              { key: 'carrierbundle.itunes.apple.com', doc_count: 2 },
-              { key: 'client-api.itunes.apple.com', doc_count: 2 },
-              { key: 'cma.itunes.apple.com', doc_count: 2 },
-              { key: 'courses.apple.com', doc_count: 2 },
-            ],
-          },
           ja3: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
@@ -437,32 +315,16 @@ export const mockResponse = {
               { key: 1586009106000, key_as_string: '2020-04-04T14:05:06.000Z', doc_count: 1 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'GlobalSign CloudSSL CA - SHA256 - G3', doc_count: 1 }],
           },
-          common_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'incapsula.com', doc_count: 1 }],
           },
-          alternative_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 110,
-            buckets: [
-              { key: '*.adlercasino.com', doc_count: 1 },
-              { key: '*.allaustraliancasino.com', doc_count: 1 },
-              { key: '*.alletf.com', doc_count: 1 },
-              { key: '*.appareldesignpartners.com', doc_count: 1 },
-              { key: '*.atmosfir.net', doc_count: 1 },
-              { key: '*.cityofboston.gov', doc_count: 1 },
-              { key: '*.cp.mytoyotaentune.com', doc_count: 1 },
-              { key: '*.decathlon.be', doc_count: 1 },
-              { key: '*.decathlon.co.uk', doc_count: 1 },
-              { key: '*.decathlon.de', doc_count: 1 },
-            ],
-          },
           ja3: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
@@ -479,24 +341,16 @@ export const mockResponse = {
               { key: 1635336000000, key_as_string: '2021-10-27T12:00:00.000Z', doc_count: 325 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'DigiCert Baltimore CA-2 G2', doc_count: 325 }],
           },
-          common_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: '*.siriusxm.com', doc_count: 325 }],
           },
-          alternative_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 0,
-            buckets: [
-              { key: '*.siriusxm.com', doc_count: 325 },
-              { key: 'siriusxm.com', doc_count: 325 },
-            ],
-          },
           ja3: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
@@ -516,28 +370,16 @@ export const mockResponse = {
               { key: 1587643200000, key_as_string: '2020-04-23T12:00:00.000Z', doc_count: 5 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'Amazon', doc_count: 5 }],
           },
-          common_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'photos.amazon.eu', doc_count: 5 }],
           },
-          alternative_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 0,
-            buckets: [
-              { key: 'photos.amazon.co.uk', doc_count: 5 },
-              { key: 'photos.amazon.de', doc_count: 5 },
-              { key: 'photos.amazon.es', doc_count: 5 },
-              { key: 'photos.amazon.eu', doc_count: 5 },
-              { key: 'photos.amazon.fr', doc_count: 5 },
-              { key: 'photos.amazon.it', doc_count: 5 },
-            ],
-          },
           ja3: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
@@ -554,34 +396,18 @@ export const mockResponse = {
               { key: 1613001599000, key_as_string: '2021-02-10T23:59:59.000Z', doc_count: 29 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [
               { key: 'Sectigo RSA Organization Validation Secure Server CA', doc_count: 29 },
             ],
           },
-          common_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'cdn.hbo.com', doc_count: 29 }],
           },
-          alternative_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 29,
-            buckets: [
-              { key: '*.api.cdn.hbo.com', doc_count: 29 },
-              { key: '*.artist.cdn.hbo.com', doc_count: 29 },
-              { key: '*.cdn.hbo.com', doc_count: 29 },
-              { key: '*.lv3.cdn.hbo.com', doc_count: 29 },
-              { key: 'artist.api.cdn.hbo.com', doc_count: 29 },
-              { key: 'artist.api.lv3.cdn.hbo.com', doc_count: 29 },
-              { key: 'artist.staging.cdn.hbo.com', doc_count: 29 },
-              { key: 'artist.staging.hurley.lv3.cdn.hbo.com', doc_count: 29 },
-              { key: 'atv.api.lv3.cdn.hbo.com', doc_count: 29 },
-              { key: 'atv.staging.hurley.lv3.cdn.hbo.com', doc_count: 29 },
-            ],
-          },
           ja3: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
@@ -598,17 +424,12 @@ export const mockResponse = {
               { key: 1575984774000, key_as_string: '2019-12-10T13:32:54.000Z', doc_count: 5 },
             ],
           },
-          issuer_names: {
+          issuers: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'GTS CA 1O1', doc_count: 5 }],
           },
-          common_names: {
-            doc_count_error_upper_bound: 0,
-            sum_other_doc_count: 0,
-            buckets: [{ key: 'www.google.com', doc_count: 5 }],
-          },
-          alternative_names: {
+          subjects: {
             doc_count_error_upper_bound: 0,
             sum_other_doc_count: 0,
             buckets: [{ key: 'www.google.com', doc_count: 5 }],
@@ -643,10 +464,9 @@ export const mockOptions = {
   fields: [
     'totalCount',
     '_id',
-    'alternativeNames',
-    'commonNames',
+    'subjects',
     'ja3',
-    'issuerNames',
+    'issuers',
     'notAfter',
     'edges.cursor.value',
     'pageInfo.activePage',
diff --git a/x-pack/legacy/plugins/siem/server/lib/tls/query_tls.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/tls/query_tls.dsl.ts
index 2ff33a800fcd5..bc65be642dabc 100644
--- a/x-pack/legacy/plugins/siem/server/lib/tls/query_tls.dsl.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/tls/query_tls.dsl.ts
@@ -12,41 +12,36 @@ import { TlsSortField, Direction, TlsFields } from '../../graphql/types';
 const getAggs = (querySize: number, sort: TlsSortField) => ({
   count: {
     cardinality: {
-      field: 'tls.server_certificate.fingerprint.sha1',
+      field: 'tls.server.hash.sha1',
     },
   },
   sha1: {
     terms: {
-      field: 'tls.server_certificate.fingerprint.sha1',
+      field: 'tls.server.hash.sha1',
       size: querySize,
       order: {
         ...getQueryOrder(sort),
       },
     },
     aggs: {
-      issuer_names: {
+      issuers: {
         terms: {
-          field: 'tls.server_certificate.issuer.common_name',
+          field: 'tls.server.issuer',
         },
       },
-      common_names: {
+      subjects: {
         terms: {
-          field: 'tls.server_certificate.subject.common_name',
-        },
-      },
-      alternative_names: {
-        terms: {
-          field: 'tls.server_certificate.alternative_names',
+          field: 'tls.server.subject',
         },
       },
       not_after: {
         terms: {
-          field: 'tls.server_certificate.not_after',
+          field: 'tls.server.not_after',
         },
       },
       ja3: {
         terms: {
-          field: 'tls.fingerprints.ja3.hash',
+          field: 'tls.server.ja3s',
         },
       },
     },
diff --git a/x-pack/legacy/plugins/siem/server/lib/tls/types.ts b/x-pack/legacy/plugins/siem/server/lib/tls/types.ts
index bac5426f72e08..1fbb31ba3e0f3 100644
--- a/x-pack/legacy/plugins/siem/server/lib/tls/types.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/tls/types.ts
@@ -18,11 +18,7 @@ export interface TlsBuckets {
     value_as_string: string;
   };
 
-  alternative_names: {
-    buckets: Readonly<Array<{ key: string; doc_count: number }>>;
-  };
-
-  common_names: {
+  subjects: {
     buckets: Readonly<Array<{ key: string; doc_count: number }>>;
   };
 
@@ -30,7 +26,7 @@ export interface TlsBuckets {
     buckets: Readonly<Array<{ key: string; doc_count: number }>>;
   };
 
-  issuer_names: {
+  issuers: {
     buckets: Readonly<Array<{ key: string; doc_count: number }>>;
   };
 
diff --git a/x-pack/legacy/plugins/siem/server/lib/uncommon_processes/query.dsl.ts b/x-pack/legacy/plugins/siem/server/lib/uncommon_processes/query.dsl.ts
index dc38824989da3..24cae53d5d353 100644
--- a/x-pack/legacy/plugins/siem/server/lib/uncommon_processes/query.dsl.ts
+++ b/x-pack/legacy/plugins/siem/server/lib/uncommon_processes/query.dsl.ts
@@ -191,6 +191,22 @@ export const buildQuery = ({
                 ],
               },
             },
+            {
+              bool: {
+                filter: [
+                  {
+                    term: {
+                      'event.category': 'process',
+                    },
+                  },
+                  {
+                    term: {
+                      'event.type': 'start',
+                    },
+                  },
+                ],
+              },
+            },
           ],
           minimum_should_match: 1,
           filter,
diff --git a/x-pack/legacy/plugins/siem/server/plugin.ts b/x-pack/legacy/plugins/siem/server/plugin.ts
index c505edc79bc76..d785de32eab7e 100644
--- a/x-pack/legacy/plugins/siem/server/plugin.ts
+++ b/x-pack/legacy/plugins/siem/server/plugin.ts
@@ -27,6 +27,8 @@ import { compose } from './lib/compose/kibana';
 import { initRoutes } from './routes';
 import { isAlertExecutor } from './lib/detection_engine/signals/types';
 import { signalRulesAlertType } from './lib/detection_engine/signals/signal_rule_alert_type';
+import { rulesNotificationAlertType } from './lib/detection_engine/notifications/rules_notification_alert_type';
+import { isNotificationAlertExecutor } from './lib/detection_engine/notifications/types';
 import {
   noteSavedObjectType,
   pinnedEventSavedObjectType,
@@ -95,12 +97,15 @@ export class Plugin {
       name: i18n.translate('xpack.siem.featureRegistry.linkSiemTitle', {
         defaultMessage: 'SIEM',
       }),
+      order: 1100,
       icon: 'securityAnalyticsApp',
       navLinkId: 'siem',
       app: ['siem', 'kibana'],
       catalogue: ['siem'],
       privileges: {
         all: {
+          app: ['siem', 'kibana'],
+          catalogue: ['siem'],
           api: ['siem', 'actions-read', 'actions-all', 'alerting-read', 'alerting-all'],
           savedObject: {
             all: [
@@ -126,6 +131,8 @@ export class Plugin {
           ],
         },
         read: {
+          app: ['siem', 'kibana'],
+          catalogue: ['siem'],
           api: ['siem', 'actions-read', 'actions-all', 'alerting-read', 'alerting-all'],
           savedObject: {
             all: ['alert', 'action', 'action_task_params'],
@@ -151,12 +158,20 @@ export class Plugin {
     });
 
     if (plugins.alerting != null) {
-      const type = signalRulesAlertType({
+      const signalRuleType = signalRulesAlertType({
         logger: this.logger,
         version: this.context.env.packageInfo.version,
       });
-      if (isAlertExecutor(type)) {
-        plugins.alerting.registerType(type);
+      const ruleNotificationType = rulesNotificationAlertType({
+        logger: this.logger,
+      });
+
+      if (isAlertExecutor(signalRuleType)) {
+        plugins.alerting.registerType(signalRuleType);
+      }
+
+      if (isNotificationAlertExecutor(ruleNotificationType)) {
+        plugins.alerting.registerType(ruleNotificationType);
       }
     }
 
diff --git a/x-pack/legacy/plugins/uptime/common/constants/rest_api.ts b/x-pack/legacy/plugins/uptime/common/constants/rest_api.ts
index 61197d6dc373d..a1a3e86e6a97e 100644
--- a/x-pack/legacy/plugins/uptime/common/constants/rest_api.ts
+++ b/x-pack/legacy/plugins/uptime/common/constants/rest_api.ts
@@ -16,4 +16,10 @@ export enum API_URLS {
   PING_HISTOGRAM = `/api/uptime/ping/histogram`,
   SNAPSHOT_COUNT = `/api/uptime/snapshot/count`,
   FILTERS = `/api/uptime/filters`,
+
+  ML_MODULE_JOBS = `/api/ml/modules/jobs_exist/`,
+  ML_SETUP_MODULE = '/api/ml/modules/setup/',
+  ML_DELETE_JOB = `/api/ml/jobs/delete_jobs`,
+  ML_CAPABILITIES = '/api/ml/ml_capabilities',
+  ML_ANOMALIES_RESULT = `/api/ml/results/anomalies_table_data`,
 }
diff --git a/x-pack/legacy/plugins/uptime/common/constants/ui.ts b/x-pack/legacy/plugins/uptime/common/constants/ui.ts
index 8d223dbbba556..29e8dabf53f92 100644
--- a/x-pack/legacy/plugins/uptime/common/constants/ui.ts
+++ b/x-pack/legacy/plugins/uptime/common/constants/ui.ts
@@ -15,6 +15,10 @@ export enum STATUS {
   DOWN = 'down',
 }
 
+export const ML_JOB_ID = 'high_latency_by_geo';
+
+export const ML_MODULE_ID = 'uptime_heartbeat';
+
 export const UNNAMED_LOCATION = 'Unnamed-location';
 
 export const SHORT_TS_LOCALE = 'en-short-locale';
diff --git a/x-pack/legacy/plugins/uptime/common/graphql/types.ts b/x-pack/legacy/plugins/uptime/common/graphql/types.ts
index 1a37ce0b18c73..bd017e6cfaf4c 100644
--- a/x-pack/legacy/plugins/uptime/common/graphql/types.ts
+++ b/x-pack/legacy/plugins/uptime/common/graphql/types.ts
@@ -552,6 +552,8 @@ export interface GetMonitorStatesQueryArgs {
   filters?: string | null;
 
   statusFilter?: string | null;
+
+  pageSize: number;
 }
 
 // ====================================================
diff --git a/x-pack/legacy/plugins/uptime/public/components/connected/charts/monitor_duration.tsx b/x-pack/legacy/plugins/uptime/public/components/connected/charts/monitor_duration.tsx
index 8d2b8d2cd8e0d..7d1cb08cb8b1c 100644
--- a/x-pack/legacy/plugins/uptime/public/components/connected/charts/monitor_duration.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/connected/charts/monitor_duration.tsx
@@ -7,10 +7,21 @@
 import React, { useContext, useEffect } from 'react';
 import { useDispatch, useSelector } from 'react-redux';
 import { useUrlParams } from '../../../hooks';
-import { getMonitorDurationAction } from '../../../state/actions';
+import {
+  getAnomalyRecordsAction,
+  getMLCapabilitiesAction,
+  getMonitorDurationAction,
+} from '../../../state/actions';
 import { DurationChartComponent } from '../../functional/charts';
-import { selectDurationLines } from '../../../state/selectors';
+import {
+  anomaliesSelector,
+  hasMLFeatureAvailable,
+  hasMLJobSelector,
+  selectDurationLines,
+} from '../../../state/selectors';
 import { UptimeRefreshContext } from '../../../contexts';
+import { getMLJobId } from '../../../state/api/ml_anomaly';
+import { JobStat } from '../../../../../../../plugins/ml/common/types/data_recognizer';
 
 interface Props {
   monitorId: string;
@@ -18,24 +29,58 @@ interface Props {
 
 export const DurationChart: React.FC<Props> = ({ monitorId }: Props) => {
   const [getUrlParams] = useUrlParams();
-  const { dateRangeStart, dateRangeEnd } = getUrlParams();
+  const {
+    dateRangeStart,
+    dateRangeEnd,
+    absoluteDateRangeStart,
+    absoluteDateRangeEnd,
+  } = getUrlParams();
 
-  const { monitor_duration, loading } = useSelector(selectDurationLines);
+  const { durationLines, loading } = useSelector(selectDurationLines);
+
+  const isMLAvailable = useSelector(hasMLFeatureAvailable);
+
+  const { data: mlJobs, loading: jobsLoading } = useSelector(hasMLJobSelector);
+
+  const hasMLJob =
+    !!mlJobs?.jobsExist &&
+    !!mlJobs.jobs.find((job: JobStat) => job.id === getMLJobId(monitorId as string));
+
+  const anomalies = useSelector(anomaliesSelector);
 
   const dispatch = useDispatch();
 
   const { lastRefresh } = useContext(UptimeRefreshContext);
 
   useEffect(() => {
-    dispatch(
-      getMonitorDurationAction({ monitorId, dateStart: dateRangeStart, dateEnd: dateRangeEnd })
-    );
+    if (isMLAvailable) {
+      const anomalyParams = {
+        listOfMonitorIds: [monitorId],
+        dateStart: absoluteDateRangeStart,
+        dateEnd: absoluteDateRangeEnd,
+      };
+
+      dispatch(getAnomalyRecordsAction.get(anomalyParams));
+    }
+
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [dateRangeStart, dateRangeEnd, dispatch, lastRefresh, monitorId, isMLAvailable]);
+
+  useEffect(() => {
+    const params = { monitorId, dateStart: dateRangeStart, dateEnd: dateRangeEnd };
+    dispatch(getMonitorDurationAction(params));
   }, [dateRangeStart, dateRangeEnd, dispatch, lastRefresh, monitorId]);
 
+  useEffect(() => {
+    dispatch(getMLCapabilitiesAction.get());
+  }, [dispatch]);
+
   return (
     <DurationChartComponent
-      locationDurationLines={monitor_duration?.locationDurationLines ?? []}
-      loading={loading}
+      anomalies={anomalies}
+      hasMLJob={hasMLJob}
+      loading={loading || jobsLoading}
+      locationDurationLines={durationLines?.locationDurationLines ?? []}
     />
   );
 };
diff --git a/x-pack/legacy/plugins/uptime/public/components/connected/empty_state/empty_state.tsx b/x-pack/legacy/plugins/uptime/public/components/connected/empty_state/empty_state.tsx
index cac7042ca5b5c..b383a696095a3 100644
--- a/x-pack/legacy/plugins/uptime/public/components/connected/empty_state/empty_state.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/connected/empty_state/empty_state.tsx
@@ -11,7 +11,7 @@ import { indexStatusSelector } from '../../../state/selectors';
 import { EmptyStateComponent } from '../../functional/empty_state/empty_state';
 
 export const EmptyState: React.FC = ({ children }) => {
-  const { data, loading, errors } = useSelector(indexStatusSelector);
+  const { data, loading, error } = useSelector(indexStatusSelector);
 
   const dispatch = useDispatch();
 
@@ -23,7 +23,7 @@ export const EmptyState: React.FC = ({ children }) => {
     <EmptyStateComponent
       statesIndexStatus={data}
       loading={loading}
-      errors={errors}
+      errors={error ? [error] : undefined}
       children={children as React.ReactElement}
     />
   );
diff --git a/x-pack/legacy/plugins/uptime/public/components/connected/monitor/status_bar_container.tsx b/x-pack/legacy/plugins/uptime/public/components/connected/monitor/status_bar_container.tsx
index 456fa2b30bca8..9e7834ae6f242 100644
--- a/x-pack/legacy/plugins/uptime/public/components/connected/monitor/status_bar_container.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/connected/monitor/status_bar_container.tsx
@@ -22,7 +22,8 @@ interface StateProps {
 }
 
 interface DispatchProps {
-  loadMonitorStatus: (dateStart: string, dateEnd: string, monitorId: string) => void;
+  loadMonitorStatus: typeof getMonitorStatusAction;
+  loadSelectedMonitor: typeof getSelectedMonitorAction;
 }
 
 interface OwnProps {
@@ -33,6 +34,7 @@ type Props = OwnProps & StateProps & DispatchProps;
 
 const Container: React.FC<Props> = ({
   loadMonitorStatus,
+  loadSelectedMonitor,
   monitorId,
   monitorStatus,
   monitorLocations,
@@ -43,8 +45,9 @@ const Container: React.FC<Props> = ({
   const { dateRangeStart: dateStart, dateRangeEnd: dateEnd } = getUrlParams();
 
   useEffect(() => {
-    loadMonitorStatus(dateStart, dateEnd, monitorId);
-  }, [monitorId, dateStart, dateEnd, loadMonitorStatus, lastRefresh]);
+    loadMonitorStatus({ dateStart, dateEnd, monitorId });
+    loadSelectedMonitor({ monitorId });
+  }, [monitorId, dateStart, dateEnd, loadMonitorStatus, lastRefresh, loadSelectedMonitor]);
 
   return (
     <MonitorStatusBarComponent
@@ -61,20 +64,8 @@ const mapStateToProps = (state: AppState, ownProps: OwnProps) => ({
 });
 
 const mapDispatchToProps = (dispatch: Dispatch<any>): DispatchProps => ({
-  loadMonitorStatus: (dateStart: string, dateEnd: string, monitorId: string) => {
-    dispatch(
-      getMonitorStatusAction({
-        monitorId,
-        dateStart,
-        dateEnd,
-      })
-    );
-    dispatch(
-      getSelectedMonitorAction({
-        monitorId,
-      })
-    );
-  },
+  loadSelectedMonitor: params => dispatch(getSelectedMonitorAction(params)),
+  loadMonitorStatus: params => dispatch(getMonitorStatusAction(params)),
 });
 
 // @ts-ignore TODO: Investigate typescript issues here
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/__snapshots__/duration_charts.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/__snapshots__/duration_charts.test.tsx.snap
index 1e2d2b9144416..6c38f3e338cfd 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/__snapshots__/duration_charts.test.tsx.snap
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/__snapshots__/duration_charts.test.tsx.snap
@@ -52,6 +52,8 @@ exports[`MonitorCharts component renders the component without errors 1`] = `
   }
 >
   <DurationChartComponent
+    anomalies={null}
+    hasMLJob={false}
     loading={false}
     locationDurationLines={
       Array [
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/duration_charts.test.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/duration_charts.test.tsx
index 34a358171ead2..aac84c69d8d7b 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/duration_charts.test.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/charts/__tests__/duration_charts.test.tsx
@@ -64,8 +64,10 @@ describe('MonitorCharts component', () => {
   it('renders the component without errors', () => {
     const component = shallowWithRouter(
       <DurationChartComponent
-        locationDurationLines={chartResponse.monitorChartsData.locationDurationLines}
         loading={false}
+        hasMLJob={false}
+        anomalies={null}
+        locationDurationLines={chartResponse.monitorChartsData.locationDurationLines}
       />
     );
     expect(component).toMatchSnapshot();
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/charts/annotation_tooltip.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/charts/annotation_tooltip.tsx
new file mode 100644
index 0000000000000..ad2a6d02c5364
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/charts/annotation_tooltip.tsx
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import moment from 'moment';
+import styled from 'styled-components';
+import { FormattedMessage } from '@kbn/i18n/react';
+
+const Header = styled.div`
+  font-weight: bold;
+  padding-left: 4px;
+`;
+
+const RecordSeverity = styled.div`
+  font-weight: bold;
+  border-left: 4px solid ${props => props.color};
+  padding-left: 2px;
+`;
+
+const TimeDiv = styled.div`
+  font-weight: 500;
+  border-bottom: 1px solid gray;
+  padding-bottom: 2px;
+`;
+
+export const AnnotationTooltip = ({ details }: { details: string }) => {
+  const data = JSON.parse(details);
+
+  function capitalizeFirstLetter(str: string) {
+    return str.charAt(0).toUpperCase() + str.slice(1);
+  }
+
+  return (
+    <>
+      <TimeDiv>{moment(data.time).format('lll')}</TimeDiv>
+      <Header>
+        <FormattedMessage
+          id="xpack.uptime.charts.mlAnnotation.header"
+          defaultMessage="Score: {score}"
+          values={{ score: data.score.toFixed(2) }}
+        />
+      </Header>
+      <RecordSeverity color={data.color}>
+        <FormattedMessage
+          id="xpack.uptime.charts.mlAnnotation.severity"
+          defaultMessage="Severity: {severity}"
+          values={{ severity: capitalizeFirstLetter(data.severity) }}
+        />
+      </RecordSeverity>
+    </>
+  );
+};
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/charts/duration_chart.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/charts/duration_chart.tsx
index 6bd4e7431f97a..d149e7a6deb5a 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/charts/duration_chart.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/charts/duration_chart.tsx
@@ -4,12 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Axis, Chart, Position, timeFormatter, Settings } from '@elastic/charts';
-import { EuiPanel, EuiTitle } from '@elastic/eui';
-import React from 'react';
+import React, { useState } from 'react';
 import { i18n } from '@kbn/i18n';
 import moment from 'moment';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiFlexGroup, EuiFlexItem, EuiPanel, EuiTitle } from '@elastic/eui';
+import { Axis, Chart, Position, timeFormatter, Settings } from '@elastic/charts';
+import { SeriesIdentifier } from '@elastic/charts/dist/chart_types/xy_chart/utils/series';
 import { getChartDateLabel } from '../../../lib/helper';
 import { LocationDurationLine } from '../../../../common/types';
 import { DurationLineSeriesList } from './duration_line_series_list';
@@ -17,6 +18,9 @@ import { ChartWrapper } from './chart_wrapper';
 import { useUrlParams } from '../../../hooks';
 import { getTickFormat } from './get_tick_format';
 import { ChartEmptyState } from './chart_empty_state';
+import { DurationAnomaliesBar } from './duration_line_bar_list';
+import { MLIntegrationComponent } from '../../monitor_details/ml/ml_integeration';
+import { AnomalyRecords } from '../../../state/actions';
 
 interface DurationChartProps {
   /**
@@ -29,6 +33,10 @@ interface DurationChartProps {
    * To represent the loading spinner on chart
    */
   loading: boolean;
+
+  hasMLJob: boolean;
+
+  anomalies: AnomalyRecords | null;
 }
 
 /**
@@ -37,29 +45,64 @@ interface DurationChartProps {
  * milliseconds.
  * @param props The props required for this component to render properly
  */
-export const DurationChartComponent = ({ locationDurationLines, loading }: DurationChartProps) => {
+export const DurationChartComponent = ({
+  locationDurationLines,
+  anomalies,
+  loading,
+  hasMLJob,
+}: DurationChartProps) => {
   const hasLines = locationDurationLines.length > 0;
   const [getUrlParams, updateUrlParams] = useUrlParams();
   const { absoluteDateRangeStart: min, absoluteDateRangeEnd: max } = getUrlParams();
 
+  const [hiddenLegends, setHiddenLegends] = useState<string[]>([]);
+
   const onBrushEnd = (minX: number, maxX: number) => {
     updateUrlParams({
       dateRangeStart: moment(minX).toISOString(),
       dateRangeEnd: moment(maxX).toISOString(),
     });
   };
+
+  const legendToggleVisibility = (legendItem: SeriesIdentifier | null) => {
+    if (legendItem) {
+      setHiddenLegends(prevState => {
+        if (prevState.includes(legendItem.specId)) {
+          return [...prevState.filter(item => item !== legendItem.specId)];
+        } else {
+          return [...prevState, legendItem.specId];
+        }
+      });
+    }
+  };
+
   return (
     <>
       <EuiPanel paddingSize="m">
-        <EuiTitle size="xs">
-          <h4>
-            <FormattedMessage
-              id="xpack.uptime.monitorCharts.monitorDuration.titleLabel"
-              defaultMessage="Monitor duration"
-              description="The 'ms' is an abbreviation for milliseconds."
-            />
-          </h4>
-        </EuiTitle>
+        <EuiFlexGroup>
+          <EuiFlexItem>
+            <EuiTitle size="xs">
+              <h4>
+                {hasMLJob ? (
+                  <FormattedMessage
+                    id="xpack.uptime.monitorCharts.monitorDuration.titleLabelWithAnomaly"
+                    defaultMessage="Monitor duration (Anomalies: {noOfAnomalies})"
+                    values={{ noOfAnomalies: anomalies?.anomalies?.length ?? 0 }}
+                  />
+                ) : (
+                  <FormattedMessage
+                    id="xpack.uptime.monitorCharts.monitorDuration.titleLabel"
+                    defaultMessage="Monitor duration"
+                  />
+                )}
+              </h4>
+            </EuiTitle>
+          </EuiFlexItem>
+          <EuiFlexItem grow={false}>
+            <MLIntegrationComponent />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+
         <ChartWrapper height="400px" loading={loading}>
           {hasLines ? (
             <Chart>
@@ -69,6 +112,7 @@ export const DurationChartComponent = ({ locationDurationLines, loading }: Durat
                 showLegendExtra
                 legendPosition={Position.Bottom}
                 onBrushEnd={onBrushEnd}
+                onLegendItemClick={legendToggleVisibility}
               />
               <Axis
                 id="bottom"
@@ -89,6 +133,7 @@ export const DurationChartComponent = ({ locationDurationLines, loading }: Durat
                 })}
               />
               <DurationLineSeriesList lines={locationDurationLines} />
+              <DurationAnomaliesBar anomalies={anomalies} hiddenLegends={hiddenLegends} />
             </Chart>
           ) : (
             <ChartEmptyState
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/charts/duration_line_bar_list.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/charts/duration_line_bar_list.tsx
new file mode 100644
index 0000000000000..a31a143b71fd2
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/charts/duration_line_bar_list.tsx
@@ -0,0 +1,91 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import moment from 'moment';
+import { AnnotationTooltipFormatter, RectAnnotation } from '@elastic/charts';
+import { RectAnnotationDatum } from '@elastic/charts/dist/chart_types/xy_chart/utils/specs';
+import { AnnotationTooltip } from './annotation_tooltip';
+import { ANOMALY_SEVERITY } from '../../../../../../../plugins/ml/common/constants/anomalies';
+import {
+  getSeverityColor,
+  getSeverityType,
+} from '../../../../../../../plugins/ml/common/util/anomaly_utils';
+
+interface Props {
+  anomalies: any;
+  hiddenLegends: string[];
+}
+
+export const DurationAnomaliesBar = ({ anomalies, hiddenLegends }: Props) => {
+  const anomalyAnnotations: Map<string, { rect: RectAnnotationDatum[]; color: string }> = new Map();
+
+  Object.keys(ANOMALY_SEVERITY).forEach(severityLevel => {
+    anomalyAnnotations.set(severityLevel.toLowerCase(), { rect: [], color: '' });
+  });
+
+  if (anomalies?.anomalies) {
+    const records = anomalies.anomalies;
+    records.forEach((record: any) => {
+      let recordObsvLoc = record.source['observer.geo.name']?.[0] ?? 'N/A';
+      if (recordObsvLoc === '') {
+        recordObsvLoc = 'N/A';
+      }
+      if (hiddenLegends.length && hiddenLegends.includes(`loc-avg-${recordObsvLoc}`)) {
+        return;
+      }
+      const severityLevel = getSeverityType(record.severity);
+
+      const tooltipData = {
+        time: record.source.timestamp,
+        score: record.severity,
+        severity: severityLevel,
+        color: getSeverityColor(record.severity),
+      };
+
+      const anomalyRect = {
+        coordinates: {
+          x0: moment(record.source.timestamp).valueOf(),
+          x1: moment(record.source.timestamp)
+            .add(record.source.bucket_span, 's')
+            .valueOf(),
+        },
+        details: JSON.stringify(tooltipData),
+      };
+      anomalyAnnotations.get(severityLevel)!.rect.push(anomalyRect);
+      anomalyAnnotations.get(severityLevel)!.color = getSeverityColor(record.severity);
+    });
+  }
+
+  const getRectStyle = (color: string) => {
+    return {
+      fill: color,
+      opacity: 1,
+      strokeWidth: 2,
+      stroke: color,
+    };
+  };
+
+  const tooltipFormatter: AnnotationTooltipFormatter = (details?: string) => {
+    return <AnnotationTooltip details={details || ''} />;
+  };
+
+  return (
+    <>
+      {Array.from(anomalyAnnotations).map(([keyIndex, rectAnnotation]) => {
+        return rectAnnotation.rect.length > 0 ? (
+          <RectAnnotation
+            dataValues={rectAnnotation.rect}
+            key={keyIndex}
+            id={keyIndex}
+            style={getRectStyle(rectAnnotation.color)}
+            renderTooltip={tooltipFormatter}
+          />
+        ) : null;
+      })}
+    </>
+  );
+};
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/__tests__/__snapshots__/empty_state.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/__tests__/__snapshots__/empty_state.test.tsx.snap
index cf46c6944ac17..66100f717244d 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/__tests__/__snapshots__/empty_state.test.tsx.snap
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/__tests__/__snapshots__/empty_state.test.tsx.snap
@@ -749,17 +749,7 @@ exports[`EmptyState component renders error message when an error occurs 1`] = `
 <EmptyStateComponent
   errors={
     Array [
-      Object {
-        "extensions": undefined,
-        "locations": undefined,
-        "message": "An error occurred",
-        "name": "foo",
-        "nodes": undefined,
-        "originalError": undefined,
-        "path": undefined,
-        "positions": undefined,
-        "source": undefined,
-      },
+      [error: There was an error fetching your data.],
     ]
   }
   intl={
@@ -870,17 +860,7 @@ exports[`EmptyState component renders error message when an error occurs 1`] = `
   <EmptyStateError
     errors={
       Array [
-        Object {
-          "extensions": undefined,
-          "locations": undefined,
-          "message": "An error occurred",
-          "name": "foo",
-          "nodes": undefined,
-          "originalError": undefined,
-          "path": undefined,
-          "positions": undefined,
-          "source": undefined,
-        },
+        [error: There was an error fetching your data.],
       ]
     }
   >
@@ -904,7 +884,7 @@ exports[`EmptyState component renders error message when an error occurs 1`] = `
                   body={
                     <React.Fragment>
                       <p>
-                        An error occurred
+                        There was an error fetching your data.
                       </p>
                     </React.Fragment>
                   }
@@ -971,9 +951,9 @@ exports[`EmptyState component renders error message when an error occurs 1`] = `
                             className="euiText euiText--medium"
                           >
                             <p
-                              key="An error occurred"
+                              key="There was an error fetching your data."
                             >
-                              An error occurred
+                              There was an error fetching your data.
                             </p>
                           </div>
                         </EuiText>
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/__tests__/empty_state.test.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/__tests__/empty_state.test.tsx
index 20113df3010f8..a74ad543c3318 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/__tests__/empty_state.test.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/__tests__/empty_state.test.tsx
@@ -7,8 +7,9 @@
 import React from 'react';
 import { mountWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
 import { EmptyStateComponent } from '../empty_state';
-import { GraphQLError } from 'graphql';
 import { StatesIndexStatus } from '../../../../../common/runtime_types';
+import { IHttpFetchError } from '../../../../../../../../../target/types/core/public/http';
+import { HttpFetchError } from '../../../../../../../../../src/core/public/http/http_fetch_error';
 
 describe('EmptyState component', () => {
   let statesIndexStatus: StatesIndexStatus;
@@ -41,18 +42,8 @@ describe('EmptyState component', () => {
   });
 
   it(`renders error message when an error occurs`, () => {
-    const errors: GraphQLError[] = [
-      {
-        message: 'An error occurred',
-        locations: undefined,
-        path: undefined,
-        nodes: undefined,
-        source: undefined,
-        positions: undefined,
-        originalError: undefined,
-        extensions: undefined,
-        name: 'foo',
-      },
+    const errors: IHttpFetchError[] = [
+      new HttpFetchError('There was an error fetching your data.', 'error', {} as any),
     ];
     const component = mountWithIntl(
       <EmptyStateComponent statesIndexStatus={null} errors={errors} loading={false}>
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/empty_state.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/empty_state.tsx
index 80afc2894ea44..ae6a1b892bc99 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/empty_state.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/empty_state.tsx
@@ -10,12 +10,13 @@ import { EmptyStateError } from './empty_state_error';
 import { EmptyStateLoading } from './empty_state_loading';
 import { DataMissing } from './data_missing';
 import { StatesIndexStatus } from '../../../../common/runtime_types';
+import { IHttpFetchError } from '../../../../../../../../target/types/core/public/http';
 
 interface EmptyStateProps {
   children: JSX.Element[] | JSX.Element;
   statesIndexStatus: StatesIndexStatus | null;
   loading: boolean;
-  errors?: Error[];
+  errors?: IHttpFetchError[];
 }
 
 export const EmptyStateComponent = ({
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/empty_state_error.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/empty_state_error.tsx
index c8e2bece1cb7f..1135b969018a1 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/empty_state_error.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/empty_state/empty_state_error.tsx
@@ -7,9 +7,10 @@
 import { EuiEmptyPrompt, EuiPanel, EuiTitle, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import React, { Fragment } from 'react';
+import { IHttpFetchError } from '../../../../../../../../target/types/core/public/http';
 
 interface EmptyStateErrorProps {
-  errors: Error[];
+  errors: IHttpFetchError[];
 }
 
 export const EmptyStateError = ({ errors }: EmptyStateErrorProps) => {
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/__snapshots__/monitor_list.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/__snapshots__/monitor_list.test.tsx.snap
index 5f1d790430bdd..2b8bc0bb06ddf 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/__snapshots__/monitor_list.test.tsx.snap
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/__snapshots__/monitor_list.test.tsx.snap
@@ -80,25 +80,42 @@ exports[`MonitorList component renders a no items message when no data is provid
       size="m"
     />
     <EuiFlexGroup
+      justifyContent="spaceBetween"
       responsive={false}
     >
       <EuiFlexItem
         grow={false}
       >
-        <OverviewPageLink
-          dataTestSubj="xpack.uptime.monitorList.prevButton"
-          direction="prev"
-          pagination=""
+        <MonitorListPageSizeSelect
+          setSize={[MockFunction]}
+          size={25}
         />
       </EuiFlexItem>
       <EuiFlexItem
         grow={false}
       >
-        <OverviewPageLink
-          dataTestSubj="xpack.uptime.monitorList.nextButton"
-          direction="next"
-          pagination=""
-        />
+        <EuiFlexGroup
+          responsive={false}
+        >
+          <EuiFlexItem
+            grow={false}
+          >
+            <OverviewPageLink
+              dataTestSubj="xpack.uptime.monitorList.prevButton"
+              direction="prev"
+              pagination=""
+            />
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
+          >
+            <OverviewPageLink
+              dataTestSubj="xpack.uptime.monitorList.nextButton"
+              direction="next"
+              pagination=""
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
       </EuiFlexItem>
     </EuiFlexGroup>
   </EuiPanel>
@@ -110,6 +127,10 @@ exports[`MonitorList component renders the monitor list 1`] = `
   padding-left: 17px;
 }
 
+.c3 {
+  padding-top: 12px;
+}
+
 .c2 {
   white-space: nowrap;
   overflow: hidden;
@@ -570,41 +591,81 @@ exports[`MonitorList component renders the monitor list 1`] = `
     class="euiSpacer euiSpacer--m"
   />
   <div
-    class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow"
+    class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow"
   >
     <div
       class="euiFlexItem euiFlexItem--flexGrowZero"
     >
-      <button
-        aria-label="A disabled pagination button indicating that there cannot be any further navigation in the monitors list."
-        class="euiButtonIcon euiButtonIcon--text"
-        data-test-subj="xpack.uptime.monitorList.prevButton"
-        disabled=""
-        type="button"
+      <div
+        class="euiPopover euiPopover--anchorUpLeft"
       >
         <div
-          aria-hidden="true"
-          class="euiButtonIcon__icon"
-          data-euiicon-type="arrowLeft"
-        />
-      </button>
+          class="euiPopover__anchor"
+        >
+          <button
+            class="euiButtonEmpty euiButtonEmpty--text euiButtonEmpty--iconRight"
+            data-test-subj="xpack.uptime.monitorList.pageSizeSelect.popoverOpen"
+            type="button"
+          >
+            <span
+              class="euiButtonEmpty__content"
+            >
+              <div
+                aria-hidden="true"
+                class="euiButtonEmpty__icon"
+                data-euiicon-type="arrowDown"
+              />
+              <span
+                class="euiButtonEmpty__text"
+              >
+                Rows per page: 25
+              </span>
+            </span>
+          </button>
+        </div>
+      </div>
     </div>
     <div
       class="euiFlexItem euiFlexItem--flexGrowZero"
     >
-      <button
-        aria-label="A disabled pagination button indicating that there cannot be any further navigation in the monitors list."
-        class="euiButtonIcon euiButtonIcon--text"
-        data-test-subj="xpack.uptime.monitorList.nextButton"
-        disabled=""
-        type="button"
+      <div
+        class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--directionRow"
       >
         <div
-          aria-hidden="true"
-          class="euiButtonIcon__icon"
-          data-euiicon-type="arrowRight"
-        />
-      </button>
+          class="euiFlexItem euiFlexItem--flexGrowZero"
+        >
+          <button
+            aria-label="A disabled pagination button indicating that there cannot be any further navigation in the monitors list."
+            class="euiButtonIcon euiButtonIcon--text c3"
+            data-test-subj="xpack.uptime.monitorList.prevButton"
+            disabled=""
+            type="button"
+          >
+            <div
+              aria-hidden="true"
+              class="euiButtonIcon__icon"
+              data-euiicon-type="arrowLeft"
+            />
+          </button>
+        </div>
+        <div
+          class="euiFlexItem euiFlexItem--flexGrowZero"
+        >
+          <button
+            aria-label="A disabled pagination button indicating that there cannot be any further navigation in the monitors list."
+            class="euiButtonIcon euiButtonIcon--text c3"
+            data-test-subj="xpack.uptime.monitorList.nextButton"
+            disabled=""
+            type="button"
+          >
+            <div
+              aria-hidden="true"
+              class="euiButtonIcon__icon"
+              data-euiicon-type="arrowRight"
+            />
+          </button>
+        </div>
+      </div>
     </div>
   </div>
 </div>
@@ -752,25 +813,42 @@ exports[`MonitorList component shallow renders the monitor list 1`] = `
       size="m"
     />
     <EuiFlexGroup
+      justifyContent="spaceBetween"
       responsive={false}
     >
       <EuiFlexItem
         grow={false}
       >
-        <OverviewPageLink
-          dataTestSubj="xpack.uptime.monitorList.prevButton"
-          direction="prev"
-          pagination=""
+        <MonitorListPageSizeSelect
+          setSize={[MockFunction]}
+          size={25}
         />
       </EuiFlexItem>
       <EuiFlexItem
         grow={false}
       >
-        <OverviewPageLink
-          dataTestSubj="xpack.uptime.monitorList.nextButton"
-          direction="next"
-          pagination=""
-        />
+        <EuiFlexGroup
+          responsive={false}
+        >
+          <EuiFlexItem
+            grow={false}
+          >
+            <OverviewPageLink
+              dataTestSubj="xpack.uptime.monitorList.prevButton"
+              direction="prev"
+              pagination=""
+            />
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
+          >
+            <OverviewPageLink
+              dataTestSubj="xpack.uptime.monitorList.nextButton"
+              direction="next"
+              pagination=""
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
       </EuiFlexItem>
     </EuiFlexGroup>
   </EuiPanel>
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/__snapshots__/monitor_list_pagination.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/__snapshots__/monitor_list_pagination.test.tsx.snap
index 29ab7a8455fe6..db5bfa72deb36 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/__snapshots__/monitor_list_pagination.test.tsx.snap
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/__snapshots__/monitor_list_pagination.test.tsx.snap
@@ -80,25 +80,42 @@ exports[`MonitorListPagination component renders a no items message when no data
       size="m"
     />
     <EuiFlexGroup
+      justifyContent="spaceBetween"
       responsive={false}
     >
       <EuiFlexItem
         grow={false}
       >
-        <OverviewPageLink
-          dataTestSubj="xpack.uptime.monitorList.prevButton"
-          direction="prev"
-          pagination=""
+        <MonitorListPageSizeSelect
+          setSize={[MockFunction]}
+          size={25}
         />
       </EuiFlexItem>
       <EuiFlexItem
         grow={false}
       >
-        <OverviewPageLink
-          dataTestSubj="xpack.uptime.monitorList.nextButton"
-          direction="next"
-          pagination=""
-        />
+        <EuiFlexGroup
+          responsive={false}
+        >
+          <EuiFlexItem
+            grow={false}
+          >
+            <OverviewPageLink
+              dataTestSubj="xpack.uptime.monitorList.prevButton"
+              direction="prev"
+              pagination=""
+            />
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
+          >
+            <OverviewPageLink
+              dataTestSubj="xpack.uptime.monitorList.nextButton"
+              direction="next"
+              pagination=""
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
       </EuiFlexItem>
     </EuiFlexGroup>
   </EuiPanel>
@@ -247,25 +264,42 @@ exports[`MonitorListPagination component renders the monitor list 1`] = `
       size="m"
     />
     <EuiFlexGroup
+      justifyContent="spaceBetween"
       responsive={false}
     >
       <EuiFlexItem
         grow={false}
       >
-        <OverviewPageLink
-          dataTestSubj="xpack.uptime.monitorList.prevButton"
-          direction="prev"
-          pagination="{\\"cursorKey\\":{\\"monitor_id\\":123},\\"cursorDirection\\":\\"BEFORE\\",\\"sortOrder\\":\\"ASC\\"}"
+        <MonitorListPageSizeSelect
+          setSize={[MockFunction]}
+          size={25}
         />
       </EuiFlexItem>
       <EuiFlexItem
         grow={false}
       >
-        <OverviewPageLink
-          dataTestSubj="xpack.uptime.monitorList.nextButton"
-          direction="next"
-          pagination="{\\"cursorKey\\":{\\"monitor_id\\":456},\\"cursorDirection\\":\\"AFTER\\",\\"sortOrder\\":\\"ASC\\"}"
-        />
+        <EuiFlexGroup
+          responsive={false}
+        >
+          <EuiFlexItem
+            grow={false}
+          >
+            <OverviewPageLink
+              dataTestSubj="xpack.uptime.monitorList.prevButton"
+              direction="prev"
+              pagination="{\\"cursorKey\\":{\\"monitor_id\\":123},\\"cursorDirection\\":\\"BEFORE\\",\\"sortOrder\\":\\"ASC\\"}"
+            />
+          </EuiFlexItem>
+          <EuiFlexItem
+            grow={false}
+          >
+            <OverviewPageLink
+              dataTestSubj="xpack.uptime.monitorList.nextButton"
+              direction="next"
+              pagination="{\\"cursorKey\\":{\\"monitor_id\\":456},\\"cursorDirection\\":\\"AFTER\\",\\"sortOrder\\":\\"ASC\\"}"
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
       </EuiFlexItem>
     </EuiFlexGroup>
   </EuiPanel>
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list.test.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list.test.tsx
index 5cdd1772a7f24..d2030155d0092 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list.test.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list.test.tsx
@@ -87,6 +87,8 @@ describe('MonitorList component', () => {
         data={{ monitorStates: result }}
         hasActiveFilters={false}
         loading={false}
+        pageSize={25}
+        setPageSize={jest.fn()}
         successColor="primary"
       />
     );
@@ -101,6 +103,8 @@ describe('MonitorList component', () => {
         data={{}}
         hasActiveFilters={false}
         loading={false}
+        pageSize={25}
+        setPageSize={jest.fn()}
         successColor="primary"
       />
     );
@@ -114,6 +118,8 @@ describe('MonitorList component', () => {
         data={{ monitorStates: result }}
         hasActiveFilters={false}
         loading={false}
+        pageSize={25}
+        setPageSize={jest.fn()}
         successColor="primary"
       />
     );
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list_page_size_select.test.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list_page_size_select.test.tsx
new file mode 100644
index 0000000000000..0642712d951fe
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list_page_size_select.test.tsx
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { MonitorListPageSizeSelectComponent } from '../monitor_list_page_size_select';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+
+describe('MonitorListPageSizeSelect', () => {
+  it('updates the state when selection changes', () => {
+    const setSize = jest.fn();
+    const setUrlParams = jest.fn();
+    const wrapper = mountWithIntl(
+      <MonitorListPageSizeSelectComponent size={10} setSize={setSize} setUrlParams={setUrlParams} />
+    );
+    wrapper
+      .find('[data-test-subj="xpack.uptime.monitorList.pageSizeSelect.popoverOpen"]')
+      .first()
+      .simulate('click');
+    wrapper
+      .find('[data-test-subj="xpack.uptime.monitorList.pageSizeSelect.sizeSelectItem25"]')
+      .first()
+      .simulate('click');
+    expect(setSize).toHaveBeenCalledTimes(1);
+    expect(setSize.mock.calls).toMatchInlineSnapshot(`
+      Array [
+        Array [
+          25,
+        ],
+      ]
+    `);
+    expect(setUrlParams).toHaveBeenCalledTimes(1);
+    expect(setUrlParams.mock.calls).toMatchInlineSnapshot(`
+      Array [
+        Array [
+          Object {
+            "pagination": undefined,
+          },
+        ],
+      ]
+    `);
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list_pagination.test.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list_pagination.test.tsx
index 1aef9281a3066..b08b8b3fabc3e 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list_pagination.test.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/__tests__/monitor_list_pagination.test.tsx
@@ -99,6 +99,8 @@ describe('MonitorListPagination component', () => {
         dangerColor="danger"
         data={{ monitorStates: result }}
         loading={false}
+        pageSize={25}
+        setPageSize={jest.fn()}
         successColor="primary"
         hasActiveFilters={false}
       />
@@ -114,6 +116,8 @@ describe('MonitorListPagination component', () => {
         data={{}}
         loading={false}
         successColor="primary"
+        pageSize={25}
+        setPageSize={jest.fn()}
         hasActiveFilters={false}
       />
     );
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/monitor_list.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/monitor_list.tsx
index 58250222e1330..a9fb1ce2f4be1 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/monitor_list.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/monitor_list.tsx
@@ -33,6 +33,7 @@ import { MonitorPageLink } from './monitor_page_link';
 import { OverviewPageLink } from './overview_page_link';
 import * as labels from './translations';
 import { MonitorListDrawer } from '../../connected';
+import { MonitorListPageSizeSelect } from './monitor_list_page_size_select';
 
 interface MonitorListQueryResult {
   monitorStates?: MonitorSummaryResult;
@@ -43,6 +44,8 @@ interface MonitorListProps {
   hasActiveFilters: boolean;
   successColor: string;
   linkParameters?: string;
+  pageSize: number;
+  setPageSize: (size: number) => void;
 }
 
 type Props = UptimeGraphQLQueryProps<MonitorListQueryResult> & MonitorListProps;
@@ -185,20 +188,27 @@ export const MonitorListComponent = (props: Props) => {
           columns={columns}
         />
         <EuiSpacer size="m" />
-        <EuiFlexGroup responsive={false}>
+        <EuiFlexGroup justifyContent="spaceBetween" responsive={false}>
           <EuiFlexItem grow={false}>
-            <OverviewPageLink
-              dataTestSubj="xpack.uptime.monitorList.prevButton"
-              direction="prev"
-              pagination={prevPagePagination}
-            />
+            <MonitorListPageSizeSelect size={props.pageSize} setSize={props.setPageSize} />
           </EuiFlexItem>
           <EuiFlexItem grow={false}>
-            <OverviewPageLink
-              dataTestSubj="xpack.uptime.monitorList.nextButton"
-              direction="next"
-              pagination={nextPagePagination}
-            />
+            <EuiFlexGroup responsive={false}>
+              <EuiFlexItem grow={false}>
+                <OverviewPageLink
+                  dataTestSubj="xpack.uptime.monitorList.prevButton"
+                  direction="prev"
+                  pagination={prevPagePagination}
+                />
+              </EuiFlexItem>
+              <EuiFlexItem grow={false}>
+                <OverviewPageLink
+                  dataTestSubj="xpack.uptime.monitorList.nextButton"
+                  direction="next"
+                  pagination={nextPagePagination}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
           </EuiFlexItem>
         </EuiFlexGroup>
       </EuiPanel>
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/monitor_list_page_size_select.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/monitor_list_page_size_select.tsx
new file mode 100644
index 0000000000000..abfc1384bb1af
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/monitor_list_page_size_select.tsx
@@ -0,0 +1,132 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EuiButtonEmpty, EuiContextMenuPanel, EuiContextMenuItem, EuiPopover } from '@elastic/eui';
+import React, { useState, useEffect } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { useUrlParams, UpdateUrlParams } from '../../../hooks';
+
+interface PopoverButtonProps {
+  setIsOpen: (isOpen: boolean) => any;
+  size: number;
+}
+
+const PopoverButton: React.FC<PopoverButtonProps> = ({ setIsOpen, size }) => (
+  <EuiButtonEmpty
+    color="text"
+    data-test-subj="xpack.uptime.monitorList.pageSizeSelect.popoverOpen"
+    iconType="arrowDown"
+    iconSide="right"
+    onClick={() => setIsOpen(true)}
+  >
+    <FormattedMessage
+      id="xpack.uptime.monitorList.pageSizePopoverButtonText"
+      defaultMessage="Rows per page: {size}"
+      values={{ size }}
+    />
+  </EuiButtonEmpty>
+);
+
+interface ContextItemProps {
+  'data-test-subj': string;
+  key: string;
+  numRows: number;
+}
+
+const items: ContextItemProps[] = [
+  {
+    'data-test-subj': 'xpack.uptime.monitorList.pageSizeSelect.sizeSelectItem10',
+    key: '10 rows',
+    numRows: 10,
+  },
+  {
+    'data-test-subj': 'xpack.uptime.monitorList.pageSizeSelect.sizeSelectItem25',
+    key: '25 rows',
+    numRows: 25,
+  },
+  {
+    'data-test-subj': 'xpack.uptime.monitorList.pageSizeSelect.sizeSelectItem50',
+    key: '50 rows',
+    numRows: 50,
+  },
+  {
+    'data-test-subj': 'xpack.uptime.monitorList.pageSizeSelect.sizeSelectItem100',
+    key: '100 rows',
+    numRows: 100,
+  },
+];
+
+const LOCAL_STORAGE_KEY = 'xpack.uptime.monitorList.pageSize';
+
+interface MonitorListPageSizeSelectProps {
+  size: number;
+  setSize: (value: number) => void;
+}
+
+/**
+ * This component wraps the underlying UI functionality to make the component more testable.
+ * The features leveraged in this function are tested elsewhere, and are not novel to this component.
+ */
+export const MonitorListPageSizeSelect: React.FC<MonitorListPageSizeSelectProps> = ({
+  size,
+  setSize,
+}) => {
+  const [, setUrlParams] = useUrlParams();
+
+  useEffect(() => {
+    localStorage.setItem(LOCAL_STORAGE_KEY, size.toString());
+  }, [size]);
+
+  return (
+    <MonitorListPageSizeSelectComponent size={size} setSize={setSize} setUrlParams={setUrlParams} />
+  );
+};
+
+interface ComponentProps extends MonitorListPageSizeSelectProps {
+  setUrlParams: UpdateUrlParams;
+}
+
+/**
+ * This function contains the UI functionality for the page select feature. It's agnostic to any
+ * external services/features, and focuses only on providing the UI and handling user interaction.
+ */
+export const MonitorListPageSizeSelectComponent: React.FC<ComponentProps> = ({
+  size,
+  setSize,
+  setUrlParams,
+}) => {
+  const [isOpen, setIsOpen] = useState(false);
+  return (
+    <EuiPopover
+      button={<PopoverButton setIsOpen={value => setIsOpen(value)} size={size} />}
+      isOpen={isOpen}
+      closePopover={() => setIsOpen(false)}
+      anchorPosition="upLeft"
+    >
+      <EuiContextMenuPanel
+        items={items.map(({ 'data-test-subj': dataTestSubj, key, numRows }) => (
+          <EuiContextMenuItem
+            data-test-subj={dataTestSubj}
+            key={key}
+            icon={size === numRows ? 'check' : 'empty'}
+            onClick={() => {
+              setSize(numRows);
+              // reset pagination because the page size has changed
+              setUrlParams({ pagination: undefined });
+              setIsOpen(false);
+            }}
+          >
+            <FormattedMessage
+              id="xpack.uptime.monitorList.pageSizeSelect.numRowsItemMessage"
+              defaultMessage="{numRows} rows"
+              values={{ numRows }}
+            />
+          </EuiContextMenuItem>
+        ))}
+      />
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/overview_page_link.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/overview_page_link.tsx
index 9d8f28cdb34c3..f79da4c98dfed 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/overview_page_link.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/overview_page_link.tsx
@@ -7,8 +7,13 @@
 import { EuiButtonIcon } from '@elastic/eui';
 import React, { FunctionComponent } from 'react';
 import { i18n } from '@kbn/i18n';
+import styled from 'styled-components';
 import { useUrlParams } from '../../../hooks';
 
+const OverviewPageLinkButtonIcon = styled(EuiButtonIcon)`
+  padding-top: 12px;
+`;
+
 interface OverviewPageLinkProps {
   dataTestSubj: string;
   direction: string;
@@ -38,8 +43,8 @@ export const OverviewPageLink: FunctionComponent<OverviewPageLinkProps> = ({
   });
 
   return (
-    <EuiButtonIcon
-      color={'text'}
+    <OverviewPageLinkButtonIcon
+      color="text"
       onClick={() => {
         updateUrlParams({ pagination });
       }}
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/translations.ts b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/translations.ts
index 5252d90215e95..7b9b2d07f2a76 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/translations.ts
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/monitor_list/translations.ts
@@ -64,3 +64,10 @@ export const UP = i18n.translate('xpack.uptime.monitorList.statusColumn.upLabel'
 export const DOWN = i18n.translate('xpack.uptime.monitorList.statusColumn.downLabel', {
   defaultMessage: 'Down',
 });
+
+export const RESPONSE_ANOMALY_SCORE = i18n.translate(
+  'xpack.uptime.monitorList.anomalyColumn.label',
+  {
+    defaultMessage: 'Response Anomaly Score',
+  }
+);
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/location_name.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/ping_list/location_name.tsx
similarity index 100%
rename from x-pack/legacy/plugins/uptime/public/components/functional/location_name.tsx
rename to x-pack/legacy/plugins/uptime/public/components/functional/ping_list/location_name.tsx
diff --git a/x-pack/legacy/plugins/uptime/public/components/functional/ping_list/ping_list.tsx b/x-pack/legacy/plugins/uptime/public/components/functional/ping_list/ping_list.tsx
index e8825dacc0078..d245bc1456e6a 100644
--- a/x-pack/legacy/plugins/uptime/public/components/functional/ping_list/ping_list.tsx
+++ b/x-pack/legacy/plugins/uptime/public/components/functional/ping_list/ping_list.tsx
@@ -29,7 +29,7 @@ import { Ping, PingResults } from '../../../../common/graphql/types';
 import { convertMicrosecondsToMilliseconds as microsToMillis } from '../../../lib/helper';
 import { UptimeGraphQLQueryProps, withUptimeGraphQL } from '../../higher_order';
 import { pingsQuery } from '../../../queries';
-import { LocationName } from './../location_name';
+import { LocationName } from './location_name';
 import { Pagination } from './../monitor_list';
 import { PingListExpandedRowComponent } from './expanded_row';
 
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/confirm_delete.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/confirm_delete.test.tsx.snap
new file mode 100644
index 0000000000000..24ef7eda0d129
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/confirm_delete.test.tsx.snap
@@ -0,0 +1,56 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`ML Confirm Job Delete shallow renders without errors 1`] = `
+<EuiOverlayMask>
+  <EuiConfirmModal
+    buttonColor="danger"
+    cancelButtonText="Cancel"
+    confirmButtonText="Delete"
+    defaultFocusedButton="confirm"
+    onCancel={[MockFunction]}
+    onConfirm={[MockFunction]}
+    title="Delete anomaly detection job?"
+  >
+    <p>
+      <FormattedMessage
+        defaultMessage="Are you sure you want to delete this job?"
+        id="xpack.uptime.monitorDetails.ml.confirmDeleteMessage"
+        values={Object {}}
+      />
+    </p>
+    <p>
+      <FormattedMessage
+        defaultMessage="Deleting a job can be time consuming. It will be deleted in the background and data may not disappear instantly."
+        id="xpack.uptime.monitorDetails.ml.deleteJobWarning"
+        values={Object {}}
+      />
+    </p>
+  </EuiConfirmModal>
+</EuiOverlayMask>
+`;
+
+exports[`ML Confirm Job Delete shallow renders without errors while loading 1`] = `
+<EuiOverlayMask>
+  <EuiConfirmModal
+    buttonColor="danger"
+    cancelButtonText="Cancel"
+    confirmButtonText="Delete"
+    defaultFocusedButton="confirm"
+    onCancel={[MockFunction]}
+    onConfirm={[MockFunction]}
+    title="Delete anomaly detection job?"
+  >
+    <p>
+      <FormattedMessage
+        defaultMessage="Deleting jobs..."
+        id="xpack.uptime.monitorDetails.ml.deleteMessage"
+        values={Object {}}
+      />
+      )
+    </p>
+    <EuiLoadingSpinner
+      size="xl"
+    />
+  </EuiConfirmModal>
+</EuiOverlayMask>
+`;
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/license_info.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/license_info.test.tsx.snap
new file mode 100644
index 0000000000000..2457488c4facc
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/license_info.test.tsx.snap
@@ -0,0 +1,73 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`ShowLicenseInfo renders without errors 1`] = `
+Array [
+  <div
+    class="euiCallOut euiCallOut--primary license-info-trial"
+  >
+    <div
+      class="euiCallOutHeader"
+    >
+      <div
+        aria-hidden="true"
+        class="euiCallOutHeader__icon"
+        data-euiicon-type="help"
+      />
+      <span
+        class="euiCallOutHeader__title"
+      >
+        Start free 14-day trial
+      </span>
+    </div>
+    <div
+      class="euiText euiText--small"
+    >
+      <p>
+        In order to access duration anomaly detection, you have to be subscribed to an Elastic Platinum license.
+      </p>
+      <a
+        class="euiButton euiButton--primary"
+        href="/app/kibana#/management/elasticsearch/license_management/home"
+        rel="noopener noreferrer"
+        target="_blank"
+      >
+        <span
+          class="euiButton__content"
+        >
+          <span
+            class="euiButton__text"
+          >
+            Start free 14-day trial
+          </span>
+        </span>
+      </a>
+    </div>
+  </div>,
+  <div
+    class="euiSpacer euiSpacer--l"
+  />,
+]
+`;
+
+exports[`ShowLicenseInfo shallow renders without errors 1`] = `
+<Fragment>
+  <EuiCallOut
+    className="license-info-trial"
+    color="primary"
+    iconType="help"
+    title="Start free 14-day trial"
+  >
+    <p>
+      In order to access duration anomaly detection, you have to be subscribed to an Elastic Platinum license.
+    </p>
+    <EuiButton
+      color="primary"
+      href="/app/kibana#/management/elasticsearch/license_management/home"
+      target="_blank"
+    >
+      Start free 14-day trial
+    </EuiButton>
+  </EuiCallOut>
+  <EuiSpacer />
+</Fragment>
+`;
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_flyout.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_flyout.test.tsx.snap
new file mode 100644
index 0000000000000..354521e7c55b9
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_flyout.test.tsx.snap
@@ -0,0 +1,240 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`ML Flyout component renders without errors 1`] = `
+<EuiFlyout
+  closeButtonAriaLabel="Closes this dialog"
+  hideCloseButton={false}
+  maxWidth={false}
+  onClose={[Function]}
+  ownFocus={false}
+  size="s"
+>
+  <EuiFlyoutHeader>
+    <EuiTitle>
+      <h2>
+        Enable anomaly detection
+      </h2>
+    </EuiTitle>
+    <EuiSpacer
+      size="s"
+    />
+  </EuiFlyoutHeader>
+  <EuiFlyoutBody>
+    <ShowLicenseInfo />
+    <EuiText>
+      <p>
+        Here you can create a machine learning job to calculate anomaly scores on
+    response durations for Uptime Monitor. Once enabled, the monitor duration chart on the details page
+    will show the expected bounds and annotate the graph with anomalies. You can also potentially
+     identify periods of increased latency across geographical regions.
+      </p>
+      <p>
+        <FormattedMessage
+          defaultMessage="Once a job is created, you can manage it and see more details in the {mlJobsPageLink}."
+          id="xpack.uptime.ml.enableAnomalyDetectionPanel.manageMLJobDescription"
+          values={
+            Object {
+              "mlJobsPageLink": <ForwardRef
+                href="/app/ml"
+              >
+                Machine Learning jobs management page
+              </ForwardRef>,
+            }
+          }
+        />
+      </p>
+      <p>
+        <em>
+          Note: It might take a few minutes for the job to begin calculating results.
+        </em>
+      </p>
+    </EuiText>
+    <EuiSpacer />
+  </EuiFlyoutBody>
+  <EuiFlyoutFooter>
+    <EuiFlexGroup
+      alignItems="flexEnd"
+      justifyContent="spaceBetween"
+    >
+      <EuiFlexItem
+        grow={false}
+      >
+        <EuiButton
+          disabled={true}
+          fill={true}
+          isLoading={false}
+          onClick={[Function]}
+        >
+          Create new job
+        </EuiButton>
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  </EuiFlyoutFooter>
+</EuiFlyout>
+`;
+
+exports[`ML Flyout component shows license info if no ml available 1`] = `
+<div>
+  <div
+    data-focus-guard="true"
+    style="width:1px;height:0px;padding:0;overflow:hidden;position:fixed;top:1px;left:1px"
+    tabindex="0"
+  />
+  <div
+    data-focus-guard="true"
+    style="width:1px;height:0px;padding:0;overflow:hidden;position:fixed;top:1px;left:1px"
+    tabindex="1"
+  />
+  <div
+    data-focus-lock-disabled="false"
+  >
+    <div
+      class="euiFlyout euiFlyout--small"
+      role="dialog"
+      tabindex="0"
+    >
+      <button
+        aria-label="Closes this dialog"
+        class="euiButtonIcon euiButtonIcon--text euiFlyout__closeButton"
+        data-test-subj="euiFlyoutCloseButton"
+        type="button"
+      >
+        <div
+          aria-hidden="true"
+          class="euiButtonIcon__icon"
+          data-euiicon-type="cross"
+        />
+      </button>
+      <div
+        class="euiFlyoutHeader"
+      >
+        <h2
+          class="euiTitle euiTitle--medium"
+        >
+          Enable anomaly detection
+        </h2>
+        <div
+          class="euiSpacer euiSpacer--s"
+        />
+      </div>
+      <div
+        class="euiFlyoutBody"
+      >
+        <div
+          class="euiFlyoutBody__overflow"
+        >
+          <div
+            class="euiFlyoutBody__overflowContent"
+          >
+            <div
+              class="euiCallOut euiCallOut--primary license-info-trial"
+            >
+              <div
+                class="euiCallOutHeader"
+              >
+                <div
+                  aria-hidden="true"
+                  class="euiCallOutHeader__icon"
+                  data-euiicon-type="help"
+                />
+                <span
+                  class="euiCallOutHeader__title"
+                >
+                  Start free 14-day trial
+                </span>
+              </div>
+              <div
+                class="euiText euiText--small"
+              >
+                <p>
+                  In order to access duration anomaly detection, you have to be subscribed to an Elastic Platinum license.
+                </p>
+                <a
+                  class="euiButton euiButton--primary"
+                  href="/app/kibana#/management/elasticsearch/license_management/home"
+                  rel="noopener noreferrer"
+                  target="_blank"
+                >
+                  <span
+                    class="euiButton__content"
+                  >
+                    <span
+                      class="euiButton__text"
+                    >
+                      Start free 14-day trial
+                    </span>
+                  </span>
+                </a>
+              </div>
+            </div>
+            <div
+              class="euiSpacer euiSpacer--l"
+            />
+            <div
+              class="euiText euiText--medium"
+            >
+              <p>
+                Here you can create a machine learning job to calculate anomaly scores on
+    response durations for Uptime Monitor. Once enabled, the monitor duration chart on the details page
+    will show the expected bounds and annotate the graph with anomalies. You can also potentially
+     identify periods of increased latency across geographical regions.
+              </p>
+              <p>
+                Once a job is created, you can manage it and see more details in the 
+                <a
+                  class="euiLink euiLink--primary"
+                  href="/app/ml"
+                  rel="noreferrer"
+                >
+                  Machine Learning jobs management page
+                </a>
+                .
+              </p>
+              <p>
+                <em>
+                  Note: It might take a few minutes for the job to begin calculating results.
+                </em>
+              </p>
+            </div>
+            <div
+              class="euiSpacer euiSpacer--l"
+            />
+          </div>
+        </div>
+      </div>
+      <div
+        class="euiFlyoutFooter"
+      >
+        <div
+          class="euiFlexGroup euiFlexGroup--gutterLarge euiFlexGroup--alignItemsFlexEnd euiFlexGroup--justifyContentSpaceBetween euiFlexGroup--directionRow euiFlexGroup--responsive"
+        >
+          <div
+            class="euiFlexItem euiFlexItem--flexGrowZero"
+          >
+            <button
+              class="euiButton euiButton--primary euiButton--fill"
+              disabled=""
+              type="button"
+            >
+              <span
+                class="euiButton__content"
+              >
+                <span
+                  class="euiButton__text"
+                >
+                  Create new job
+                </span>
+              </span>
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <div
+    data-focus-guard="true"
+    style="width:1px;height:0px;padding:0;overflow:hidden;position:fixed;top:1px;left:1px"
+    tabindex="0"
+  />
+</div>
+`;
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_integerations.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_integerations.test.tsx.snap
new file mode 100644
index 0000000000000..ac4630f4e69a8
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_integerations.test.tsx.snap
@@ -0,0 +1,86 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`ML Integrations renders without errors 1`] = `
+<div
+  class="euiPopover euiPopover--anchorDownCenter"
+>
+  <div
+    class="euiPopover__anchor"
+  >
+    <button
+      class="euiButtonEmpty euiButtonEmpty--primary"
+      type="button"
+    >
+      <span
+        class="euiButtonEmpty__content"
+      >
+        <div
+          aria-hidden="true"
+          class="euiButtonEmpty__icon"
+          data-euiicon-type="machineLearningApp"
+        />
+        <span
+          class="euiButtonEmpty__text"
+        >
+          Enable anomaly detection
+        </span>
+      </span>
+    </button>
+  </div>
+</div>
+`;
+
+exports[`ML Integrations shallow renders without errors 1`] = `
+<ContextProvider
+  value={
+    Object {
+      "history": Object {
+        "action": "POP",
+        "block": [Function],
+        "canGo": [Function],
+        "createHref": [Function],
+        "entries": Array [
+          Object {
+            "hash": "",
+            "key": "TestKeyForTesting",
+            "pathname": "/",
+            "search": "",
+            "state": undefined,
+          },
+        ],
+        "go": [Function],
+        "goBack": [Function],
+        "goForward": [Function],
+        "index": 0,
+        "length": 1,
+        "listen": [Function],
+        "location": Object {
+          "hash": "",
+          "key": "TestKeyForTesting",
+          "pathname": "/",
+          "search": "",
+          "state": undefined,
+        },
+        "push": [Function],
+        "replace": [Function],
+      },
+      "location": Object {
+        "hash": "",
+        "key": "TestKeyForTesting",
+        "pathname": "/",
+        "search": "",
+        "state": undefined,
+      },
+      "match": Object {
+        "isExact": true,
+        "params": Object {},
+        "path": "/",
+        "url": "/",
+      },
+      "staticContext": undefined,
+    }
+  }
+>
+  <MLIntegrationComponent />
+</ContextProvider>
+`;
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_job_link.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_job_link.test.tsx.snap
new file mode 100644
index 0000000000000..85988af04a939
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_job_link.test.tsx.snap
@@ -0,0 +1,82 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`ML JobLink renders without errors 1`] = `
+<a
+  class="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--small"
+  href="/app/ml#/explorer?_g=(ml:(jobIds:!(testMonitor_high_latency_by_geo)),refreshInterval:(pause:!t,value:0),time:(from:'',to:''))&_a=(mlExplorerFilter:(filterActive:!t,filteredFields:!(monitor.id,testMonitor)),mlExplorerSwimlane:(viewByFieldName:observer.geo.name))"
+  rel="noopener noreferrer"
+  target="_blank"
+>
+  <span
+    class="euiButtonEmpty__content"
+  >
+    <span
+      class="euiButtonEmpty__text"
+    />
+  </span>
+</a>
+`;
+
+exports[`ML JobLink shallow renders without errors 1`] = `
+<ContextProvider
+  value={
+    Object {
+      "history": Object {
+        "action": "POP",
+        "block": [Function],
+        "canGo": [Function],
+        "createHref": [Function],
+        "entries": Array [
+          Object {
+            "hash": "",
+            "key": "TestKeyForTesting",
+            "pathname": "/",
+            "search": "",
+            "state": undefined,
+          },
+        ],
+        "go": [Function],
+        "goBack": [Function],
+        "goForward": [Function],
+        "index": 0,
+        "length": 1,
+        "listen": [Function],
+        "location": Object {
+          "hash": "",
+          "key": "TestKeyForTesting",
+          "pathname": "/",
+          "search": "",
+          "state": undefined,
+        },
+        "push": [Function],
+        "replace": [Function],
+      },
+      "location": Object {
+        "hash": "",
+        "key": "TestKeyForTesting",
+        "pathname": "/",
+        "search": "",
+        "state": undefined,
+      },
+      "match": Object {
+        "isExact": true,
+        "params": Object {},
+        "path": "/",
+        "url": "/",
+      },
+      "staticContext": undefined,
+    }
+  }
+>
+  <MLJobLink
+    basePath=""
+    dateRange={
+      Object {
+        "from": "",
+        "to": "",
+      }
+    }
+    monitorId="testMonitor"
+  />
+</ContextProvider>
+`;
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_manage_job.test.tsx.snap b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_manage_job.test.tsx.snap
new file mode 100644
index 0000000000000..6eb2930c4875a
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/__snapshots__/ml_manage_job.test.tsx.snap
@@ -0,0 +1,90 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Manage ML Job renders without errors 1`] = `
+<div
+  class="euiPopover euiPopover--anchorDownCenter"
+>
+  <div
+    class="euiPopover__anchor"
+  >
+    <button
+      class="euiButtonEmpty euiButtonEmpty--primary euiButtonEmpty--iconRight"
+      type="button"
+    >
+      <span
+        class="euiButtonEmpty__content"
+      >
+        <div
+          aria-hidden="true"
+          class="euiButtonEmpty__icon"
+          data-euiicon-type="arrowDown"
+        />
+        <span
+          class="euiButtonEmpty__text"
+        >
+          Anomaly detection
+        </span>
+      </span>
+    </button>
+  </div>
+</div>
+`;
+
+exports[`Manage ML Job shallow renders without errors 1`] = `
+<ContextProvider
+  value={
+    Object {
+      "history": Object {
+        "action": "POP",
+        "block": [Function],
+        "canGo": [Function],
+        "createHref": [Function],
+        "entries": Array [
+          Object {
+            "hash": "",
+            "key": "TestKeyForTesting",
+            "pathname": "/",
+            "search": "",
+            "state": undefined,
+          },
+        ],
+        "go": [Function],
+        "goBack": [Function],
+        "goForward": [Function],
+        "index": 0,
+        "length": 1,
+        "listen": [Function],
+        "location": Object {
+          "hash": "",
+          "key": "TestKeyForTesting",
+          "pathname": "/",
+          "search": "",
+          "state": undefined,
+        },
+        "push": [Function],
+        "replace": [Function],
+      },
+      "location": Object {
+        "hash": "",
+        "key": "TestKeyForTesting",
+        "pathname": "/",
+        "search": "",
+        "state": undefined,
+      },
+      "match": Object {
+        "isExact": true,
+        "params": Object {},
+        "path": "/",
+        "url": "/",
+      },
+      "staticContext": undefined,
+    }
+  }
+>
+  <ManageMLJobComponent
+    hasMLJob={true}
+    onEnableJob={[MockFunction]}
+    onJobDelete={[MockFunction]}
+  />
+</ContextProvider>
+`;
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/confirm_delete.test.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/confirm_delete.test.tsx
new file mode 100644
index 0000000000000..465369547d286
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/confirm_delete.test.tsx
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { shallowWithIntl } from 'test_utils/enzyme_helpers';
+import { ConfirmJobDeletion } from '../confirm_delete';
+
+describe('ML Confirm Job Delete', () => {
+  it('shallow renders without errors', () => {
+    const wrapper = shallowWithIntl(
+      <ConfirmJobDeletion loading={false} onConfirm={jest.fn()} onCancel={jest.fn()} />
+    );
+    expect(wrapper).toMatchSnapshot();
+  });
+
+  it('shallow renders without errors while loading', () => {
+    const wrapper = shallowWithIntl(
+      <ConfirmJobDeletion loading={true} onConfirm={jest.fn()} onCancel={jest.fn()} />
+    );
+    expect(wrapper).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/license_info.test.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/license_info.test.tsx
new file mode 100644
index 0000000000000..f3ac27c0569a3
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/license_info.test.tsx
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { renderWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
+import { ShowLicenseInfo } from '../license_info';
+
+describe('ShowLicenseInfo', () => {
+  it('shallow renders without errors', () => {
+    const wrapper = shallowWithIntl(<ShowLicenseInfo />);
+    expect(wrapper).toMatchSnapshot();
+  });
+
+  it('renders without errors', () => {
+    const wrapper = renderWithIntl(<ShowLicenseInfo />);
+    expect(wrapper).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_flyout.test.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_flyout.test.tsx
new file mode 100644
index 0000000000000..c0b02181dcce1
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_flyout.test.tsx
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { renderWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
+import { MLFlyoutView } from '../ml_flyout';
+import { UptimeSettingsContext } from '../../../../contexts';
+import { CLIENT_DEFAULTS } from '../../../../../common/constants';
+import { License } from '../../../../../../../../plugins/licensing/common/license';
+
+const expiredLicense = new License({
+  signature: 'test signature',
+  license: {
+    expiryDateInMillis: 0,
+    mode: 'platinum',
+    status: 'expired',
+    type: 'platinum',
+    uid: '1',
+  },
+  features: {
+    ml: {
+      isAvailable: false,
+      isEnabled: false,
+    },
+  },
+});
+
+const validLicense = new License({
+  signature: 'test signature',
+  license: {
+    expiryDateInMillis: 30000,
+    mode: 'platinum',
+    status: 'active',
+    type: 'platinum',
+    uid: '2',
+  },
+  features: {
+    ml: {
+      isAvailable: true,
+      isEnabled: true,
+    },
+  },
+});
+
+describe('ML Flyout component', () => {
+  const createJob = () => {};
+  const onClose = () => {};
+  const { DATE_RANGE_START, DATE_RANGE_END } = CLIENT_DEFAULTS;
+
+  it('renders without errors', () => {
+    const wrapper = shallowWithIntl(
+      <MLFlyoutView
+        isCreatingJob={false}
+        onClickCreate={createJob}
+        onClose={onClose}
+        canCreateMLJob={true}
+      />
+    );
+    expect(wrapper).toMatchSnapshot();
+  });
+  it('shows license info if no ml available', () => {
+    const value = {
+      license: expiredLicense,
+      basePath: '',
+      dateRangeStart: DATE_RANGE_START,
+      dateRangeEnd: DATE_RANGE_END,
+      isApmAvailable: true,
+      isInfraAvailable: true,
+      isLogsAvailable: true,
+    };
+    const wrapper = renderWithIntl(
+      <UptimeSettingsContext.Provider value={value}>
+        <MLFlyoutView
+          isCreatingJob={false}
+          onClickCreate={createJob}
+          onClose={onClose}
+          canCreateMLJob={true}
+        />
+      </UptimeSettingsContext.Provider>
+    );
+    const licenseComponent = wrapper.find('.license-info-trial');
+    expect(licenseComponent.length).toBe(1);
+    expect(wrapper).toMatchSnapshot();
+  });
+
+  it('able to create job if valid license is available', () => {
+    const value = {
+      license: validLicense,
+      basePath: '',
+      dateRangeStart: DATE_RANGE_START,
+      dateRangeEnd: DATE_RANGE_END,
+      isApmAvailable: true,
+      isInfraAvailable: true,
+      isLogsAvailable: true,
+    };
+    const wrapper = renderWithIntl(
+      <UptimeSettingsContext.Provider value={value}>
+        <MLFlyoutView
+          isCreatingJob={false}
+          onClickCreate={createJob}
+          onClose={onClose}
+          canCreateMLJob={true}
+        />
+      </UptimeSettingsContext.Provider>
+    );
+
+    const licenseComponent = wrapper.find('.license-info-trial');
+    expect(licenseComponent.length).toBe(0);
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_integerations.test.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_integerations.test.tsx
new file mode 100644
index 0000000000000..10b3a90414eb5
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_integerations.test.tsx
@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { MLIntegrationComponent } from '../ml_integeration';
+import { renderWithRouter, shallowWithRouter } from '../../../../lib';
+import * as redux from 'react-redux';
+
+describe('ML Integrations', () => {
+  beforeEach(() => {
+    const spy = jest.spyOn(redux, 'useDispatch');
+    spy.mockReturnValue(jest.fn());
+
+    const spy1 = jest.spyOn(redux, 'useSelector');
+    spy1.mockReturnValue(true);
+  });
+
+  it('shallow renders without errors', () => {
+    const wrapper = shallowWithRouter(<MLIntegrationComponent />);
+    expect(wrapper).toMatchSnapshot();
+  });
+
+  it('renders without errors', () => {
+    const wrapper = renderWithRouter(<MLIntegrationComponent />);
+    expect(wrapper).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_job_link.test.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_job_link.test.tsx
new file mode 100644
index 0000000000000..fbd66e7077a77
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_job_link.test.tsx
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { renderWithRouter, shallowWithRouter } from '../../../../lib';
+import { MLJobLink } from '../ml_job_link';
+
+describe('ML JobLink', () => {
+  it('shallow renders without errors', () => {
+    const wrapper = shallowWithRouter(
+      <MLJobLink dateRange={{ to: '', from: '' }} basePath="" monitorId="testMonitor" />
+    );
+    expect(wrapper).toMatchSnapshot();
+  });
+
+  it('renders without errors', () => {
+    const wrapper = renderWithRouter(
+      <MLJobLink dateRange={{ to: '', from: '' }} basePath="" monitorId="testMonitor" />
+    );
+    expect(wrapper).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_manage_job.test.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_manage_job.test.tsx
new file mode 100644
index 0000000000000..30038b030be56
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/__tests__/ml_manage_job.test.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { ManageMLJobComponent } from '../manage_ml_job';
+import * as redux from 'react-redux';
+import { renderWithRouter, shallowWithRouter } from '../../../../lib';
+
+describe('Manage ML Job', () => {
+  it('shallow renders without errors', () => {
+    const spy = jest.spyOn(redux, 'useSelector');
+    spy.mockReturnValue(true);
+
+    const wrapper = shallowWithRouter(
+      <ManageMLJobComponent hasMLJob={true} onEnableJob={jest.fn()} onJobDelete={jest.fn()} />
+    );
+    expect(wrapper).toMatchSnapshot();
+  });
+
+  it('renders without errors', () => {
+    const spy = jest.spyOn(redux, 'useSelector');
+    spy.mockReturnValue(true);
+
+    const wrapper = renderWithRouter(
+      <ManageMLJobComponent hasMLJob={true} onEnableJob={jest.fn()} onJobDelete={jest.fn()} />
+    );
+    expect(wrapper).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/confirm_delete.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/confirm_delete.tsx
new file mode 100644
index 0000000000000..6754676765fb6
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/confirm_delete.tsx
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { EuiOverlayMask, EuiConfirmModal, EuiLoadingSpinner } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import * as labels from './translations';
+
+interface Props {
+  loading: boolean;
+  onConfirm: () => void;
+  onCancel: () => void;
+}
+
+export const ConfirmJobDeletion: React.FC<Props> = ({ loading, onConfirm, onCancel }) => {
+  return (
+    <EuiOverlayMask>
+      <EuiConfirmModal
+        title={labels.JOB_DELETION_CONFIRMATION}
+        onCancel={onCancel}
+        onConfirm={onConfirm}
+        cancelButtonText="Cancel"
+        confirmButtonText="Delete"
+        buttonColor="danger"
+        defaultFocusedButton="confirm"
+      >
+        {!loading ? (
+          <p>
+            <FormattedMessage
+              id="xpack.uptime.monitorDetails.ml.confirmDeleteMessage"
+              defaultMessage="Are you sure you want to delete this job?"
+            />
+          </p>
+        ) : (
+          <p>
+            <FormattedMessage
+              id="xpack.uptime.monitorDetails.ml.deleteMessage"
+              defaultMessage="Deleting jobs..."
+            />
+            )
+          </p>
+        )}
+        {!loading ? (
+          <p>
+            <FormattedMessage
+              id="xpack.uptime.monitorDetails.ml.deleteJobWarning"
+              defaultMessage="Deleting a job can be time consuming.
+              It will be deleted in the background and data may not disappear instantly."
+            />
+          </p>
+        ) : (
+          <EuiLoadingSpinner size="xl" />
+        )}
+      </EuiConfirmModal>
+    </EuiOverlayMask>
+  );
+};
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/license_info.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/license_info.tsx
new file mode 100644
index 0000000000000..92badb4043ed6
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/license_info.tsx
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { useContext } from 'react';
+import { EuiCallOut, EuiButton, EuiSpacer } from '@elastic/eui';
+import { UptimeSettingsContext } from '../../../contexts';
+import * as labels from './translations';
+
+export const ShowLicenseInfo = () => {
+  const { basePath } = useContext(UptimeSettingsContext);
+  return (
+    <>
+      <EuiCallOut
+        className="license-info-trial"
+        title={labels.START_TRAIL}
+        color="primary"
+        iconType="help"
+      >
+        <p>{labels.START_TRAIL_DESC}</p>
+        <EuiButton
+          color="primary"
+          href={basePath + `/app/kibana#/management/elasticsearch/license_management/home`}
+          target="_blank"
+        >
+          {labels.START_TRAIL}
+        </EuiButton>
+      </EuiCallOut>
+      <EuiSpacer />
+    </>
+  );
+};
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/manage_ml_job.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/manage_ml_job.tsx
new file mode 100644
index 0000000000000..29f003437f7cb
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/manage_ml_job.tsx
@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useContext, useState } from 'react';
+
+import { EuiButtonEmpty, EuiContextMenu, EuiIcon, EuiPopover } from '@elastic/eui';
+import { useParams } from 'react-router-dom';
+import { useSelector } from 'react-redux';
+import { canDeleteMLJobSelector } from '../../../state/selectors';
+import { UptimeSettingsContext } from '../../../contexts';
+import * as labels from './translations';
+import { getMLJobLinkHref } from './ml_job_link';
+import { useUrlParams } from '../../../hooks';
+
+interface Props {
+  hasMLJob: boolean;
+  onEnableJob: () => void;
+  onJobDelete: () => void;
+}
+
+export const ManageMLJobComponent = ({ hasMLJob, onEnableJob, onJobDelete }: Props) => {
+  const [isPopOverOpen, setIsPopOverOpen] = useState(false);
+
+  const { basePath } = useContext(UptimeSettingsContext);
+
+  const canDeleteMLJob = useSelector(canDeleteMLJobSelector);
+
+  const [getUrlParams] = useUrlParams();
+  const { dateRangeStart, dateRangeEnd } = getUrlParams();
+
+  let { monitorId } = useParams();
+  monitorId = atob(monitorId || '');
+
+  const button = (
+    <EuiButtonEmpty
+      iconType={hasMLJob ? 'arrowDown' : 'machineLearningApp'}
+      iconSide={hasMLJob ? 'right' : 'left'}
+      onClick={hasMLJob ? () => setIsPopOverOpen(true) : onEnableJob}
+      disabled={hasMLJob && !canDeleteMLJob}
+    >
+      {hasMLJob ? labels.ANOMALY_DETECTION : labels.ENABLE_ANOMALY_DETECTION}
+    </EuiButtonEmpty>
+  );
+
+  const panels = [
+    {
+      id: 0,
+      title: labels.MANAGE_ANOMALY_DETECTION,
+      items: [
+        {
+          name: labels.EXPLORE_IN_ML_APP,
+          icon: <EuiIcon type="dataVisualizer" size="m" />,
+          href: getMLJobLinkHref({
+            basePath,
+            monitorId,
+            dateRange: { from: dateRangeStart, to: dateRangeEnd },
+          }),
+          target: '_blank',
+        },
+        {
+          name: labels.DISABLE_ANOMALY_DETECTION,
+          icon: <EuiIcon type="trash" size="m" />,
+          onClick: () => {
+            setIsPopOverOpen(false);
+            onJobDelete();
+          },
+        },
+      ],
+    },
+  ];
+
+  return (
+    <EuiPopover button={button} isOpen={isPopOverOpen} closePopover={() => setIsPopOverOpen(false)}>
+      <EuiContextMenu initialPanelId={0} panels={panels} />
+    </EuiPopover>
+  );
+};
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_flyout.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_flyout.tsx
new file mode 100644
index 0000000000000..917367f3e8dad
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_flyout.tsx
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useContext } from 'react';
+import {
+  EuiButton,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFlyout,
+  EuiFlyoutBody,
+  EuiFlyoutFooter,
+  EuiFlyoutHeader,
+  EuiLink,
+  EuiSpacer,
+  EuiText,
+  EuiTitle,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import * as labels from './translations';
+import { UptimeSettingsContext } from '../../../contexts';
+import { ShowLicenseInfo } from './license_info';
+
+interface Props {
+  isCreatingJob: boolean;
+  onClickCreate: () => void;
+  onClose: () => void;
+  canCreateMLJob: boolean;
+}
+
+export function MLFlyoutView({ isCreatingJob, onClickCreate, onClose, canCreateMLJob }: Props) {
+  const { basePath, license } = useContext(UptimeSettingsContext);
+
+  const isLoadingMLJob = false;
+
+  const hasPlatinumLicense = license?.getFeature('ml')?.isAvailable;
+
+  return (
+    <EuiFlyout onClose={onClose} size="s">
+      <EuiFlyoutHeader>
+        <EuiTitle>
+          <h2>{labels.ENABLE_ANOMALY_DETECTION}</h2>
+        </EuiTitle>
+        <EuiSpacer size="s" />
+      </EuiFlyoutHeader>
+      <EuiFlyoutBody>
+        {!hasPlatinumLicense && <ShowLicenseInfo />}
+        <EuiText>
+          <p>{labels.CREAT_ML_JOB_DESC}</p>
+          <p>
+            <FormattedMessage
+              id="xpack.uptime.ml.enableAnomalyDetectionPanel.manageMLJobDescription"
+              defaultMessage="Once a job is created, you can manage it and see more details in the {mlJobsPageLink}."
+              values={{
+                mlJobsPageLink: (
+                  <EuiLink href={basePath + '/app/ml'}>{labels.ML_MANAGEMENT_PAGE}</EuiLink>
+                ),
+              }}
+            />
+          </p>
+          <p>
+            <em>{labels.TAKE_SOME_TIME_TEXT}</em>
+          </p>
+        </EuiText>
+
+        <EuiSpacer />
+      </EuiFlyoutBody>
+      <EuiFlyoutFooter>
+        <EuiFlexGroup justifyContent="spaceBetween" alignItems="flexEnd">
+          <EuiFlexItem grow={false}>
+            <EuiButton
+              onClick={() => onClickCreate()}
+              fill
+              isLoading={isCreatingJob}
+              disabled={isCreatingJob || isLoadingMLJob || !hasPlatinumLicense || !canCreateMLJob}
+            >
+              {labels.CREATE_NEW_JOB}
+            </EuiButton>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlyoutFooter>
+    </EuiFlyout>
+  );
+}
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_flyout_container.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_flyout_container.tsx
new file mode 100644
index 0000000000000..fad12de94fd81
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_flyout_container.tsx
@@ -0,0 +1,154 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useContext, useEffect, useState } from 'react';
+import { useDispatch, useSelector } from 'react-redux';
+import { useParams } from 'react-router-dom';
+import {
+  canCreateMLJobSelector,
+  hasMLJobSelector,
+  hasNewMLJobSelector,
+  isMLJobCreatingSelector,
+} from '../../../state/selectors';
+import { createMLJobAction, getExistingMLJobAction } from '../../../state/actions';
+import { MLJobLink } from './ml_job_link';
+import * as labels from './translations';
+import {
+  useKibana,
+  KibanaReactNotifications,
+} from '../../../../../../../../src/plugins/kibana_react/public';
+import { MLFlyoutView } from './ml_flyout';
+import { ML_JOB_ID } from '../../../../common/constants';
+import { UptimeRefreshContext, UptimeSettingsContext } from '../../../contexts';
+import { useUrlParams } from '../../../hooks';
+
+interface Props {
+  onClose: () => void;
+}
+
+const showMLJobNotification = (
+  notifications: KibanaReactNotifications,
+  monitorId: string,
+  basePath: string,
+  range: { to: string; from: string },
+  success: boolean,
+  message = ''
+) => {
+  if (success) {
+    notifications.toasts.success({
+      title: <p>{labels.JOB_CREATED_SUCCESS_TITLE}</p>,
+      body: (
+        <p>
+          {labels.JOB_CREATED_SUCCESS_MESSAGE}
+          <MLJobLink monitorId={monitorId} basePath={basePath} dateRange={range}>
+            {labels.VIEW_JOB}
+          </MLJobLink>
+        </p>
+      ),
+      toastLifeTimeMs: 5000,
+    });
+  } else {
+    notifications.toasts.warning({
+      title: <p>{labels.JOB_CREATION_FAILED}</p>,
+      body: message ?? <p>{labels.JOB_CREATION_FAILED_MESSAGE}</p>,
+      toastLifeTimeMs: 5000,
+    });
+  }
+};
+
+export const MachineLearningFlyout: React.FC<Props> = ({ onClose }) => {
+  const { notifications } = useKibana();
+
+  const dispatch = useDispatch();
+  const { data: hasMLJob, error } = useSelector(hasNewMLJobSelector);
+  const isMLJobCreating = useSelector(isMLJobCreatingSelector);
+  const { basePath } = useContext(UptimeSettingsContext);
+
+  const { refreshApp } = useContext(UptimeRefreshContext);
+
+  let { monitorId } = useParams();
+  monitorId = atob(monitorId || '');
+
+  const createMLJob = () => dispatch(createMLJobAction.get({ monitorId: monitorId as string }));
+
+  const canCreateMLJob = useSelector(canCreateMLJobSelector);
+
+  const { data: uptimeJobs } = useSelector(hasMLJobSelector);
+
+  const hasExistingMLJob = !!uptimeJobs?.jobsExist;
+
+  const [isCreatingJob, setIsCreatingJob] = useState(false);
+
+  const [getUrlParams] = useUrlParams();
+  const { dateRangeStart, dateRangeEnd } = getUrlParams();
+
+  useEffect(() => {
+    if (isCreatingJob && !isMLJobCreating) {
+      if (hasMLJob) {
+        showMLJobNotification(
+          notifications,
+          monitorId as string,
+          basePath,
+          { to: dateRangeEnd, from: dateRangeStart },
+          true
+        );
+        const loadMLJob = (jobId: string) =>
+          dispatch(getExistingMLJobAction.get({ monitorId: monitorId as string }));
+
+        loadMLJob(ML_JOB_ID);
+
+        refreshApp();
+      } else {
+        showMLJobNotification(
+          notifications,
+          monitorId as string,
+          basePath,
+          { to: dateRangeEnd, from: dateRangeStart },
+          false,
+          error?.body?.message
+        );
+      }
+      setIsCreatingJob(false);
+      onClose();
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [
+    hasMLJob,
+    notifications,
+    onClose,
+    isCreatingJob,
+    error,
+    isMLJobCreating,
+    monitorId,
+    dispatch,
+    basePath,
+  ]);
+
+  useEffect(() => {
+    if (hasExistingMLJob) {
+      setIsCreatingJob(true);
+      dispatch(createMLJobAction.get({ monitorId: monitorId as string }));
+    }
+  }, [dispatch, hasExistingMLJob, monitorId]);
+
+  if (hasExistingMLJob) {
+    return null;
+  }
+
+  const createAnomalyJob = () => {
+    setIsCreatingJob(true);
+    createMLJob();
+  };
+
+  return (
+    <MLFlyoutView
+      canCreateMLJob={!!canCreateMLJob}
+      isCreatingJob={isMLJobCreating}
+      onClickCreate={createAnomalyJob}
+      onClose={onClose}
+    />
+  );
+};
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_integeration.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_integeration.tsx
new file mode 100644
index 0000000000000..a27796167091e
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_integeration.tsx
@@ -0,0 +1,111 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useContext, useEffect, useState } from 'react';
+
+import { useParams } from 'react-router-dom';
+import { useDispatch, useSelector } from 'react-redux';
+import { MachineLearningFlyout } from './ml_flyout_container';
+import {
+  hasMLFeatureAvailable,
+  hasMLJobSelector,
+  isMLJobDeletedSelector,
+  isMLJobDeletingSelector,
+} from '../../../state/selectors';
+import { deleteMLJobAction, getExistingMLJobAction, resetMLState } from '../../../state/actions';
+import { ConfirmJobDeletion } from './confirm_delete';
+import { UptimeRefreshContext } from '../../../contexts';
+import { getMLJobId } from '../../../state/api/ml_anomaly';
+import * as labels from './translations';
+import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
+import { ManageMLJobComponent } from './manage_ml_job';
+import { JobStat } from '../../../../../../../plugins/ml/common/types/data_recognizer';
+
+export const MLIntegrationComponent = () => {
+  const [isMlFlyoutOpen, setIsMlFlyoutOpen] = useState(false);
+  const [isConfirmDeleteJobOpen, setIsConfirmDeleteJobOpen] = useState(false);
+
+  const { lastRefresh, refreshApp } = useContext(UptimeRefreshContext);
+
+  const { notifications } = useKibana();
+
+  let { monitorId } = useParams();
+  monitorId = atob(monitorId || '');
+
+  const dispatch = useDispatch();
+
+  const isMLAvailable = useSelector(hasMLFeatureAvailable);
+
+  const deleteMLJob = () => dispatch(deleteMLJobAction.get({ monitorId: monitorId as string }));
+  const isMLJobDeleting = useSelector(isMLJobDeletingSelector);
+  const { data: jobDeletionSuccess } = useSelector(isMLJobDeletedSelector);
+
+  const { data: uptimeJobs } = useSelector(hasMLJobSelector);
+
+  const hasMLJob =
+    !!uptimeJobs?.jobsExist &&
+    !!uptimeJobs.jobs.find((job: JobStat) => job.id === getMLJobId(monitorId as string));
+
+  useEffect(() => {
+    if (isMLAvailable) {
+      dispatch(getExistingMLJobAction.get({ monitorId: monitorId as string }));
+    }
+  }, [dispatch, isMLAvailable, monitorId, lastRefresh]);
+
+  useEffect(() => {
+    if (isConfirmDeleteJobOpen && jobDeletionSuccess?.[getMLJobId(monitorId as string)]?.deleted) {
+      setIsConfirmDeleteJobOpen(false);
+      notifications.toasts.success({
+        title: <p>{labels.JOB_DELETION}</p>,
+        body: <p>{labels.JOB_DELETION_SUCCESS}</p>,
+        toastLifeTimeMs: 3000,
+      });
+      dispatch(resetMLState());
+
+      refreshApp();
+    }
+  }, [
+    isMLJobDeleting,
+    isConfirmDeleteJobOpen,
+    jobDeletionSuccess,
+    monitorId,
+    refreshApp,
+    notifications.toasts,
+    dispatch,
+  ]);
+
+  const onEnableJobClick = () => {
+    setIsMlFlyoutOpen(true);
+  };
+
+  const closeFlyout = () => {
+    setIsMlFlyoutOpen(false);
+  };
+
+  const confirmDeleteMLJob = () => {
+    setIsConfirmDeleteJobOpen(true);
+  };
+
+  return (
+    <>
+      <ManageMLJobComponent
+        hasMLJob={hasMLJob as boolean}
+        onEnableJob={onEnableJobClick}
+        onJobDelete={confirmDeleteMLJob}
+      />
+      {isMlFlyoutOpen && <MachineLearningFlyout onClose={closeFlyout} />}
+      {isConfirmDeleteJobOpen && (
+        <ConfirmJobDeletion
+          onConfirm={deleteMLJob}
+          loading={isMLJobDeleting}
+          onCancel={() => {
+            setIsConfirmDeleteJobOpen(false);
+          }}
+        />
+      )}
+    </>
+  );
+};
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_job_link.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_job_link.tsx
new file mode 100644
index 0000000000000..4b6f7e3ba061d
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/ml_job_link.tsx
@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import url from 'url';
+import { EuiButtonEmpty } from '@elastic/eui';
+import rison, { RisonValue } from 'rison-node';
+import { getMLJobId } from '../../../state/api/ml_anomaly';
+
+interface Props {
+  monitorId: string;
+  basePath: string;
+  dateRange: {
+    to: string;
+    from: string;
+  };
+}
+
+export const getMLJobLinkHref = ({ basePath, monitorId, dateRange }: Props) => {
+  const query = {
+    ml: { jobIds: [getMLJobId(monitorId)] },
+    refreshInterval: { pause: true, value: 0 },
+    time: dateRange,
+  };
+
+  const queryParams = {
+    mlExplorerFilter: {
+      filterActive: true,
+      filteredFields: ['monitor.id', monitorId],
+    },
+    mlExplorerSwimlane: {
+      viewByFieldName: 'observer.geo.name',
+    },
+  };
+
+  const path = '/explorer';
+
+  return url.format({
+    pathname: basePath + '/app/ml',
+    hash:
+      `${path}?_g=${rison.encode(query as RisonValue)}` +
+      (monitorId ? `&_a=${rison.encode(queryParams as RisonValue)}` : ''),
+  });
+};
+
+export const MLJobLink: React.FC<Props> = ({ basePath, monitorId, dateRange, children }) => {
+  const href = getMLJobLinkHref({ basePath, monitorId, dateRange });
+  return <EuiButtonEmpty children={children} size="s" href={href} target="_blank" />;
+};
diff --git a/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/translations.tsx b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/translations.tsx
new file mode 100644
index 0000000000000..570dd9d1bfa26
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/components/monitor_details/ml/translations.tsx
@@ -0,0 +1,150 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export const JOB_CREATED_SUCCESS_TITLE = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.jobCreatedNotificationTitle',
+  {
+    defaultMessage: 'Job successfully created',
+  }
+);
+
+export const JOB_CREATED_SUCCESS_MESSAGE = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.jobCreatedNotificationText',
+  {
+    defaultMessage:
+      'The analysis is now running for response duration chart. It might take a while before results are added to the response times graph.',
+  }
+);
+
+export const JOB_CREATION_FAILED = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.jobCreationFailedNotificationTitle',
+  {
+    defaultMessage: 'Job creation failed',
+  }
+);
+
+export const JOB_CREATION_FAILED_MESSAGE = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.jobCreationFailedNotificationText',
+  {
+    defaultMessage:
+      'Your current license may not allow for creating machine learning jobs, or this job may already exist.',
+  }
+);
+
+export const JOB_DELETION = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.jobDeletionNotificationTitle',
+  {
+    defaultMessage: 'Job deleted',
+  }
+);
+
+export const JOB_DELETION_SUCCESS = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.jobDeletionSuccessNotificationText',
+  {
+    defaultMessage: 'Job is successfully deleted',
+  }
+);
+
+export const JOB_DELETION_CONFIRMATION = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.jobDeletionConfirmLabel',
+  {
+    defaultMessage: 'Delete anomaly detection job?',
+  }
+);
+
+export const VIEW_JOB = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.jobCreatedNotificationText.viewJobLinkText',
+  {
+    defaultMessage: 'View job',
+  }
+);
+
+export const EXPLORE_IN_ML_APP = i18n.translate('xpack.uptime.ml.durationChart.exploreInMlApp', {
+  defaultMessage: 'Explore in ML App',
+});
+
+export const ENABLE_ANOMALY_DETECTION = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.enableAnomalyDetectionTitle',
+  {
+    defaultMessage: 'Enable anomaly detection',
+  }
+);
+
+export const ANOMALY_DETECTION = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.anomalyDetectionTitle',
+  {
+    defaultMessage: 'Anomaly detection',
+  }
+);
+
+export const DISABLE_ANOMALY_DETECTION = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.disableAnomalyDetectionTitle',
+  {
+    defaultMessage: 'Disable anomaly detection',
+  }
+);
+
+export const MANAGE_ANOMALY_DETECTION = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.manageAnomalyDetectionTitle',
+  {
+    defaultMessage: 'Manage anomaly detection',
+  }
+);
+
+export const VIEW_EXISTING_JOB = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.callout.jobExistsDescription.viewJobLinkText',
+  {
+    defaultMessage: 'View existing job',
+  }
+);
+
+export const ML_MANAGEMENT_PAGE = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.manageMLJobDescription.mlJobsPageLinkText',
+  {
+    defaultMessage: 'Machine Learning jobs management page',
+  }
+);
+
+export const TAKE_SOME_TIME_TEXT = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.manageMLJobDescription.noteText',
+  {
+    defaultMessage: 'Note: It might take a few minutes for the job to begin calculating results.',
+  }
+);
+
+export const CREATE_NEW_JOB = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.createNewJobButtonLabel',
+  {
+    defaultMessage: 'Create new job',
+  }
+);
+
+export const CREAT_ML_JOB_DESC = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.createMLJobDescription',
+  {
+    defaultMessage: `Here you can create a machine learning job to calculate anomaly scores on
+    response durations for Uptime Monitor. Once enabled, the monitor duration chart on the details page
+    will show the expected bounds and annotate the graph with anomalies. You can also potentially
+     identify periods of increased latency across geographical regions.`,
+  }
+);
+
+export const START_TRAIL = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.startTrial',
+  {
+    defaultMessage: 'Start free 14-day trial',
+  }
+);
+
+export const START_TRAIL_DESC = i18n.translate(
+  'xpack.uptime.ml.enableAnomalyDetectionPanel.startTrialDesc',
+  {
+    defaultMessage:
+      'In order to access duration anomaly detection, you have to be subscribed to an Elastic Platinum license.',
+  }
+);
diff --git a/x-pack/legacy/plugins/uptime/public/contexts/uptime_settings_context.tsx b/x-pack/legacy/plugins/uptime/public/contexts/uptime_settings_context.tsx
index 9f50849703562..44a87d310c9c7 100644
--- a/x-pack/legacy/plugins/uptime/public/contexts/uptime_settings_context.tsx
+++ b/x-pack/legacy/plugins/uptime/public/contexts/uptime_settings_context.tsx
@@ -9,9 +9,11 @@ import { UptimeAppProps } from '../uptime_app';
 import { CLIENT_DEFAULTS, CONTEXT_DEFAULTS } from '../../common/constants';
 import { CommonlyUsedRange } from '../components/functional/uptime_date_picker';
 import { useUrlParams } from '../hooks';
+import { ILicense } from '../../../../../plugins/licensing/common/types';
 
 export interface UptimeSettingsContextValues {
   basePath: string;
+  license?: ILicense | null;
   dateRangeStart: string;
   dateRangeEnd: string;
   isApmAvailable: boolean;
@@ -39,14 +41,29 @@ const defaultContext: UptimeSettingsContextValues = {
 export const UptimeSettingsContext = createContext(defaultContext);
 
 export const UptimeSettingsContextProvider: React.FC<UptimeAppProps> = ({ children, ...props }) => {
-  const { basePath, isApmAvailable, isInfraAvailable, isLogsAvailable, commonlyUsedRanges } = props;
+  const {
+    basePath,
+    isApmAvailable,
+    isInfraAvailable,
+    isLogsAvailable,
+    commonlyUsedRanges,
+    plugins,
+  } = props;
 
   const [getUrlParams] = useUrlParams();
 
   const { dateRangeStart, dateRangeEnd } = getUrlParams();
 
+  let license: ILicense | null = null;
+
+  // @ts-ignore
+  plugins.licensing.license$.subscribe((licenseItem: ILicense) => {
+    license = licenseItem;
+  });
+
   const value = useMemo(() => {
     return {
+      license,
       basePath,
       isApmAvailable,
       isInfraAvailable,
@@ -56,6 +73,7 @@ export const UptimeSettingsContextProvider: React.FC<UptimeAppProps> = ({ childr
       dateRangeEnd: dateRangeEnd ?? DATE_RANGE_END,
     };
   }, [
+    license,
     basePath,
     isApmAvailable,
     isInfraAvailable,
diff --git a/x-pack/legacy/plugins/uptime/public/hooks/index.ts b/x-pack/legacy/plugins/uptime/public/hooks/index.ts
index cfb8d71f783a6..e022248df407a 100644
--- a/x-pack/legacy/plugins/uptime/public/hooks/index.ts
+++ b/x-pack/legacy/plugins/uptime/public/hooks/index.ts
@@ -4,6 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { useUrlParams } from './use_url_params';
+export * from './use_url_params';
 export * from './use_telemetry';
 export * from './update_kuery_string';
diff --git a/x-pack/legacy/plugins/uptime/public/hooks/use_url_params.ts b/x-pack/legacy/plugins/uptime/public/hooks/use_url_params.ts
index dc309943d7cf9..20063b2c1bc93 100644
--- a/x-pack/legacy/plugins/uptime/public/hooks/use_url_params.ts
+++ b/x-pack/legacy/plugins/uptime/public/hooks/use_url_params.ts
@@ -8,8 +8,10 @@ import { parse, stringify } from 'query-string';
 import { useLocation, useHistory } from 'react-router-dom';
 import { UptimeUrlParams, getSupportedUrlParams } from '../lib/helper';
 
-type GetUrlParams = () => UptimeUrlParams;
-type UpdateUrlParams = (updatedParams: { [key: string]: string | number | boolean }) => void;
+export type GetUrlParams = () => UptimeUrlParams;
+export type UpdateUrlParams = (updatedParams: {
+  [key: string]: string | number | boolean | undefined;
+}) => void;
 
 export type UptimeUrlParamsHook = () => [GetUrlParams, UpdateUrlParams];
 
diff --git a/x-pack/legacy/plugins/uptime/public/pages/overview.tsx b/x-pack/legacy/plugins/uptime/public/pages/overview.tsx
index a8a35fd2681b6..943dbd6bd57ba 100644
--- a/x-pack/legacy/plugins/uptime/public/pages/overview.tsx
+++ b/x-pack/legacy/plugins/uptime/public/pages/overview.tsx
@@ -5,7 +5,7 @@
  */
 
 import { EuiFlexGroup, EuiFlexItem, EuiSpacer } from '@elastic/eui';
-import React, { useContext, useEffect } from 'react';
+import React, { useContext, useEffect, useState } from 'react';
 import styled from 'styled-components';
 import { i18n } from '@kbn/i18n';
 import {
@@ -40,9 +40,26 @@ const EuiFlexItemStyled = styled(EuiFlexItem)`
   }
 `;
 
+// TODO: these values belong deeper down in the monitor
+// list pagination control, but are here temporarily until we
+// are done removing GraphQL
+const DEFAULT_PAGE_SIZE = 10;
+const LOCAL_STORAGE_KEY = 'xpack.uptime.monitorList.pageSize';
+const getMonitorListPageSizeValue = () => {
+  const value = parseInt(localStorage.getItem(LOCAL_STORAGE_KEY) ?? '', 10);
+  if (isNaN(value)) {
+    return DEFAULT_PAGE_SIZE;
+  }
+  return value;
+};
+
 export const OverviewPageComponent = ({ autocomplete, indexPattern, setEsKueryFilters }: Props) => {
   const { colors } = useContext(UptimeThemeContext);
   const [getUrlParams] = useUrlParams();
+  // TODO: this is temporary until we migrate the monitor list to our Redux implementation
+  const [monitorListPageSize, setMonitorListPageSize] = useState<number>(
+    getMonitorListPageSizeValue()
+  );
   const { absoluteDateRangeStart, absoluteDateRangeEnd, ...params } = getUrlParams();
   const {
     dateRangeStart,
@@ -106,10 +123,13 @@ export const OverviewPageComponent = ({ autocomplete, indexPattern, setEsKueryFi
           hasActiveFilters={!!esFilters}
           implementsCustomErrorState={true}
           linkParameters={linkParameters}
+          pageSize={monitorListPageSize}
+          setPageSize={setMonitorListPageSize}
           successColor={colors.success}
           variables={{
             ...sharedProps,
             pagination,
+            pageSize: monitorListPageSize,
           }}
         />
       </EmptyState>
diff --git a/x-pack/legacy/plugins/uptime/public/queries/monitor_states_query.ts b/x-pack/legacy/plugins/uptime/public/queries/monitor_states_query.ts
index 9e609786094d5..676e638c239de 100644
--- a/x-pack/legacy/plugins/uptime/public/queries/monitor_states_query.ts
+++ b/x-pack/legacy/plugins/uptime/public/queries/monitor_states_query.ts
@@ -7,13 +7,14 @@
 import gql from 'graphql-tag';
 
 export const monitorStatesQueryString = `
-query MonitorStates($dateRangeStart: String!, $dateRangeEnd: String!, $pagination: String, $filters: String, $statusFilter: String) {
+query MonitorStates($dateRangeStart: String!, $dateRangeEnd: String!, $pagination: String, $filters: String, $statusFilter: String, $pageSize: Int) {
   monitorStates: getMonitorStates(
     dateRangeStart: $dateRangeStart
     dateRangeEnd: $dateRangeEnd
     pagination: $pagination
     filters: $filters
     statusFilter: $statusFilter
+    pageSize: $pageSize
   ) {
     prevPagePagination
     nextPagePagination
diff --git a/x-pack/legacy/plugins/uptime/public/state/actions/index.ts b/x-pack/legacy/plugins/uptime/public/state/actions/index.ts
index b2ab73879a4a7..4563e6bfc4f0e 100644
--- a/x-pack/legacy/plugins/uptime/public/state/actions/index.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/actions/index.ts
@@ -10,5 +10,6 @@ export * from './ui';
 export * from './monitor_status';
 export * from './index_patternts';
 export * from './ping';
+export * from './ml_anomaly';
 export * from './monitor_duration';
 export * from './index_status';
diff --git a/x-pack/legacy/plugins/uptime/public/state/actions/index_status.ts b/x-pack/legacy/plugins/uptime/public/state/actions/index_status.ts
index 336758a71ce60..5c964052bb3de 100644
--- a/x-pack/legacy/plugins/uptime/public/state/actions/index_status.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/actions/index_status.ts
@@ -7,4 +7,4 @@
 import { createAsyncAction } from './utils';
 import { StatesIndexStatus } from '../../../common/runtime_types';
 
-export const indexStatusAction = createAsyncAction<StatesIndexStatus & Error>('GET INDEX STATUS');
+export const indexStatusAction = createAsyncAction<any, StatesIndexStatus>('GET INDEX STATUS');
diff --git a/x-pack/legacy/plugins/uptime/public/state/actions/ml_anomaly.ts b/x-pack/legacy/plugins/uptime/public/state/actions/ml_anomaly.ts
new file mode 100644
index 0000000000000..9a8e4036f2cff
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/state/actions/ml_anomaly.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createAction } from 'redux-actions';
+import { createAsyncAction } from './utils';
+import { PrivilegesResponse } from '../../../../../../plugins/ml/common/types/privileges';
+import { AnomaliesTableRecord } from '../../../../../../plugins/ml/common/types/anomalies';
+import { CreateMLJobSuccess, DeleteJobResults, MonitorIdParam } from './types';
+import { JobExistResult } from '../../../../../../plugins/ml/common/types/data_recognizer';
+
+export const resetMLState = createAction('RESET_ML_STATE');
+
+export const getExistingMLJobAction = createAsyncAction<MonitorIdParam, JobExistResult>(
+  'GET_EXISTING_ML_JOB'
+);
+
+export const createMLJobAction = createAsyncAction<MonitorIdParam, CreateMLJobSuccess | null>(
+  'CREATE_ML_JOB'
+);
+
+export const getMLCapabilitiesAction = createAsyncAction<any, PrivilegesResponse>(
+  'GET_ML_CAPABILITIES'
+);
+
+export const deleteMLJobAction = createAsyncAction<MonitorIdParam, DeleteJobResults>(
+  'DELETE_ML_JOB'
+);
+
+export interface AnomalyRecordsParams {
+  dateStart: number;
+  dateEnd: number;
+  listOfMonitorIds: string[];
+  anomalyThreshold?: number;
+}
+
+export interface AnomalyRecords {
+  anomalies: AnomaliesTableRecord[];
+  interval: string;
+}
+
+export const getAnomalyRecordsAction = createAsyncAction<AnomalyRecordsParams, AnomalyRecords>(
+  'GET_ANOMALY_RECORDS'
+);
diff --git a/x-pack/legacy/plugins/uptime/public/state/actions/monitor_duration.ts b/x-pack/legacy/plugins/uptime/public/state/actions/monitor_duration.ts
index cd02ace7db24f..9a2db5be60b12 100644
--- a/x-pack/legacy/plugins/uptime/public/state/actions/monitor_duration.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/actions/monitor_duration.ts
@@ -7,6 +7,7 @@
 import { createAction } from 'redux-actions';
 import { QueryParams } from './types';
 import { MonitorDurationResult } from '../../../common/types';
+import { IHttpFetchError } from '../../../../../../../target/types/core/public/http';
 
 type MonitorQueryParams = QueryParams & { monitorId: string };
 
@@ -14,4 +15,6 @@ export const getMonitorDurationAction = createAction<MonitorQueryParams>('GET_MO
 export const getMonitorDurationActionSuccess = createAction<MonitorDurationResult>(
   'GET_MONITOR_DURATION_SUCCESS'
 );
-export const getMonitorDurationActionFail = createAction<Error>('GET_MONITOR_DURATION_FAIL');
+export const getMonitorDurationActionFail = createAction<IHttpFetchError>(
+  'GET_MONITOR_DURATION_FAIL'
+);
diff --git a/x-pack/legacy/plugins/uptime/public/state/actions/types.ts b/x-pack/legacy/plugins/uptime/public/state/actions/types.ts
index e9bf11256b0b8..236b263414a26 100644
--- a/x-pack/legacy/plugins/uptime/public/state/actions/types.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/actions/types.ts
@@ -5,11 +5,21 @@
  */
 
 import { Action } from 'redux-actions';
+import { IHttpFetchError } from '../../../../../../../target/types/core/public/http';
 
-export interface AsyncAction {
-  get: (payload?: any) => Action<any>;
-  success: (payload?: any) => Action<any>;
-  fail: (payload?: any) => Action<any>;
+export interface AsyncAction<Payload, SuccessPayload> {
+  get: (payload: Payload) => Action<Payload>;
+  success: (payload: SuccessPayload) => Action<SuccessPayload>;
+  fail: (payload: IHttpFetchError) => Action<IHttpFetchError>;
+}
+export interface AsyncAction1<Payload, SuccessPayload> {
+  get: (payload?: Payload) => Action<Payload>;
+  success: (payload: SuccessPayload) => Action<SuccessPayload>;
+  fail: (payload: IHttpFetchError) => Action<IHttpFetchError>;
+}
+
+export interface MonitorIdParam {
+  monitorId: string;
 }
 
 export interface QueryParams {
@@ -27,3 +37,15 @@ export interface MonitorDetailsActionPayload {
   dateEnd: string;
   location?: string;
 }
+
+export interface CreateMLJobSuccess {
+  count: number;
+  jobId: string;
+}
+
+export interface DeleteJobResults {
+  [id: string]: {
+    [status: string]: boolean;
+    error?: any;
+  };
+}
diff --git a/x-pack/legacy/plugins/uptime/public/state/actions/utils.ts b/x-pack/legacy/plugins/uptime/public/state/actions/utils.ts
index 337c4bfb2fa47..a5adb96731f33 100644
--- a/x-pack/legacy/plugins/uptime/public/state/actions/utils.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/actions/utils.ts
@@ -5,12 +5,18 @@
  */
 
 import { createAction } from 'redux-actions';
-import { AsyncAction } from './types';
+import { AsyncAction, AsyncAction1 } from './types';
+import { IHttpFetchError } from '../../../../../../../target/types/core/public/http';
 
-export function createAsyncAction<Payload>(actionStr: string): AsyncAction {
+export function createAsyncAction<Payload, SuccessPayload>(
+  actionStr: string
+): AsyncAction1<Payload, SuccessPayload>;
+export function createAsyncAction<Payload, SuccessPayload>(
+  actionStr: string
+): AsyncAction<Payload, SuccessPayload> {
   return {
     get: createAction<Payload>(actionStr),
-    success: createAction<Payload>(`${actionStr}_SUCCESS`),
-    fail: createAction<Payload>(`${actionStr}_FAIL`),
+    success: createAction<SuccessPayload>(`${actionStr}_SUCCESS`),
+    fail: createAction<IHttpFetchError>(`${actionStr}_FAIL`),
   };
 }
diff --git a/x-pack/legacy/plugins/uptime/public/state/api/ml_anomaly.ts b/x-pack/legacy/plugins/uptime/public/state/api/ml_anomaly.ts
new file mode 100644
index 0000000000000..80b97783769b5
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/state/api/ml_anomaly.ts
@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import moment from 'moment';
+import { apiService } from './utils';
+import { AnomalyRecords, AnomalyRecordsParams } from '../actions';
+import { API_URLS, INDEX_NAMES, ML_JOB_ID, ML_MODULE_ID } from '../../../common/constants';
+import { PrivilegesResponse } from '../../../../../../plugins/ml/common/types/privileges';
+import { CreateMLJobSuccess, DeleteJobResults, MonitorIdParam } from '../actions/types';
+import { DataRecognizerConfigResponse } from '../../../../../../plugins/ml/common/types/modules';
+import { JobExistResult } from '../../../../../../plugins/ml/common/types/data_recognizer';
+
+export const getMLJobId = (monitorId: string) => `${monitorId}_${ML_JOB_ID}`;
+
+export const getMLCapabilities = async (): Promise<PrivilegesResponse> => {
+  return await apiService.get(API_URLS.ML_CAPABILITIES);
+};
+
+export const getExistingJobs = async (): Promise<JobExistResult> => {
+  return await apiService.get(API_URLS.ML_MODULE_JOBS + ML_MODULE_ID);
+};
+
+export const createMLJob = async ({
+  monitorId,
+}: MonitorIdParam): Promise<CreateMLJobSuccess | null> => {
+  const url = API_URLS.ML_SETUP_MODULE + ML_MODULE_ID;
+
+  const data = {
+    prefix: `${monitorId}_`,
+    useDedicatedIndex: false,
+    startDatafeed: true,
+    start: moment()
+      .subtract(24, 'h')
+      .valueOf(),
+    indexPatternName: INDEX_NAMES.HEARTBEAT,
+    query: {
+      bool: {
+        filter: [
+          {
+            term: {
+              'monitor.id': monitorId,
+            },
+          },
+        ],
+      },
+    },
+  };
+
+  const response: DataRecognizerConfigResponse = await apiService.post(url, data);
+  if (response?.jobs?.[0]?.id === getMLJobId(monitorId) && response?.jobs?.[0]?.success) {
+    return {
+      count: 1,
+      jobId: response?.jobs?.[0]?.id,
+    };
+  } else {
+    return null;
+  }
+};
+
+export const deleteMLJob = async ({ monitorId }: MonitorIdParam): Promise<DeleteJobResults> => {
+  const data = { jobIds: [getMLJobId(monitorId)] };
+
+  return await apiService.post(API_URLS.ML_DELETE_JOB, data);
+};
+
+export const fetchAnomalyRecords = async ({
+  dateStart,
+  dateEnd,
+  listOfMonitorIds,
+  anomalyThreshold,
+}: AnomalyRecordsParams): Promise<AnomalyRecords> => {
+  const data = {
+    jobIds: listOfMonitorIds.map((monitorId: string) => getMLJobId(monitorId)),
+    criteriaFields: [],
+    influencers: [],
+    aggregationInterval: 'auto',
+    threshold: anomalyThreshold ?? 25,
+    earliestMs: dateStart,
+    latestMs: dateEnd,
+    dateFormatTz: Intl.DateTimeFormat().resolvedOptions().timeZone,
+    maxRecords: 500,
+    maxExamples: 10,
+  };
+  return apiService.post(API_URLS.ML_ANOMALIES_RESULT, data);
+};
diff --git a/x-pack/legacy/plugins/uptime/public/state/effects/__tests__/fecth_effect.test.ts b/x-pack/legacy/plugins/uptime/public/state/effects/__tests__/fetch_effect.test.ts
similarity index 67%
rename from x-pack/legacy/plugins/uptime/public/state/effects/__tests__/fecth_effect.test.ts
rename to x-pack/legacy/plugins/uptime/public/state/effects/__tests__/fetch_effect.test.ts
index 6520e1492bddc..0354cfeac7b07 100644
--- a/x-pack/legacy/plugins/uptime/public/state/effects/__tests__/fecth_effect.test.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/effects/__tests__/fetch_effect.test.ts
@@ -7,6 +7,9 @@
 import { call, put } from 'redux-saga/effects';
 import { fetchEffectFactory } from '../fetch_effect';
 import { indexStatusAction } from '../../actions';
+import { HttpFetchError } from '../../../../../../../../src/core/public/http/http_fetch_error';
+import { StatesIndexStatus } from '../../../../common/runtime_types';
+import { fetchIndexStatus } from '../../api';
 
 describe('fetch saga effect factory', () => {
   const asyncAction = indexStatusAction;
@@ -15,7 +18,7 @@ describe('fetch saga effect factory', () => {
 
   it('works with success workflow', () => {
     const indexStatusResult = { indexExists: true, docCount: 2712532 };
-    const fetchStatus = async () => {
+    const fetchStatus = async (): Promise<StatesIndexStatus> => {
       return { indexExists: true, docCount: 2712532 };
     };
     fetchEffect = fetchEffectFactory(
@@ -25,6 +28,7 @@ describe('fetch saga effect factory', () => {
     )(calledAction);
     let next = fetchEffect.next();
 
+    // @ts-ignore TODO, dig deeper for TS issues here
     expect(next.value).toEqual(call(fetchStatus, calledAction.payload));
 
     const successResult = put(asyncAction.success(indexStatusResult));
@@ -35,18 +39,21 @@ describe('fetch saga effect factory', () => {
   });
 
   it('works with error workflow', () => {
-    const indexStatusResultError = new Error('no heartbeat index found');
-    const fetchStatus = async () => {
-      return indexStatusResultError;
-    };
+    const indexStatusResultError = new HttpFetchError(
+      'No heartbeat index found.',
+      'error',
+      {} as any
+    );
+
     fetchEffect = fetchEffectFactory(
-      fetchStatus,
+      fetchIndexStatus,
       asyncAction.success,
       asyncAction.fail
     )(calledAction);
     let next = fetchEffect.next();
 
-    expect(next.value).toEqual(call(fetchStatus, calledAction.payload));
+    // @ts-ignore TODO, dig deeper for TS issues here
+    expect(next.value).toEqual(call(fetchIndexStatus, calledAction.payload));
 
     const errorResult = put(asyncAction.fail(indexStatusResultError));
 
@@ -56,18 +63,21 @@ describe('fetch saga effect factory', () => {
   });
 
   it('works with throw error workflow', () => {
-    const unExpectedError = new Error('no url found, so throw error');
-    const fetchStatus = async () => {
-      return await fetch('/some/url');
-    };
+    const unExpectedError = new HttpFetchError(
+      'No url found for the call, so throw error.',
+      'error',
+      {} as any
+    );
+
     fetchEffect = fetchEffectFactory(
-      fetchStatus,
+      fetchIndexStatus,
       asyncAction.success,
       asyncAction.fail
     )(calledAction);
     let next = fetchEffect.next();
 
-    expect(next.value).toEqual(call(fetchStatus, calledAction.payload));
+    // @ts-ignore TODO, dig deeper for TS issues here
+    expect(next.value).toEqual(call(fetchIndexStatus, calledAction.payload));
 
     const unexpectedErrorResult = put(asyncAction.fail(unExpectedError));
 
diff --git a/x-pack/legacy/plugins/uptime/public/state/effects/fetch_effect.ts b/x-pack/legacy/plugins/uptime/public/state/effects/fetch_effect.ts
index 943275d21e51e..49e497952ea44 100644
--- a/x-pack/legacy/plugins/uptime/public/state/effects/fetch_effect.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/effects/fetch_effect.ts
@@ -6,6 +6,7 @@
 
 import { call, put } from 'redux-saga/effects';
 import { Action } from 'redux-actions';
+import { IHttpFetchError } from '../../../../../../../target/types/core/public/http';
 
 /**
  * Factory function for a fetch effect. It expects three action creators,
@@ -21,24 +22,23 @@ import { Action } from 'redux-actions';
 export function fetchEffectFactory<T, R, S, F>(
   fetch: (request: T) => Promise<R>,
   success: (response: R) => Action<S>,
-  fail: (error: Error) => Action<F>
+  fail: (error: IHttpFetchError) => Action<F>
 ) {
   return function*(action: Action<T>) {
     try {
       const response = yield call(fetch, action.payload);
-
       if (response instanceof Error) {
         // eslint-disable-next-line no-console
         console.error(response);
 
-        yield put(fail(response));
+        yield put(fail(response as IHttpFetchError));
       } else {
         yield put(success(response));
       }
     } catch (error) {
       // eslint-disable-next-line no-console
       console.error(error);
-      yield put(fail(error));
+      yield put(fail(error as IHttpFetchError));
     }
   };
 }
diff --git a/x-pack/legacy/plugins/uptime/public/state/effects/index.ts b/x-pack/legacy/plugins/uptime/public/state/effects/index.ts
index d11b79d60d154..8d457be1d1c78 100644
--- a/x-pack/legacy/plugins/uptime/public/state/effects/index.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/effects/index.ts
@@ -13,6 +13,7 @@ import { fetchDynamicSettingsEffect, setDynamicSettingsEffect } from './dynamic_
 import { fetchIndexPatternEffect } from './index_pattern';
 import { fetchPingHistogramEffect } from './ping';
 import { fetchMonitorDurationEffect } from './monitor_duration';
+import { fetchMLJobEffect } from './ml_anomaly';
 import { fetchIndexStatusEffect } from './index_status';
 
 export function* rootEffect() {
@@ -24,6 +25,7 @@ export function* rootEffect() {
   yield fork(setDynamicSettingsEffect);
   yield fork(fetchIndexPatternEffect);
   yield fork(fetchPingHistogramEffect);
+  yield fork(fetchMLJobEffect);
   yield fork(fetchMonitorDurationEffect);
   yield fork(fetchIndexStatusEffect);
 }
diff --git a/x-pack/legacy/plugins/uptime/public/state/effects/ml_anomaly.ts b/x-pack/legacy/plugins/uptime/public/state/effects/ml_anomaly.ts
new file mode 100644
index 0000000000000..a6a376b546ab8
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/state/effects/ml_anomaly.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { takeLatest } from 'redux-saga/effects';
+import {
+  getMLCapabilitiesAction,
+  getExistingMLJobAction,
+  createMLJobAction,
+  getAnomalyRecordsAction,
+  deleteMLJobAction,
+} from '../actions';
+import { fetchEffectFactory } from './fetch_effect';
+import {
+  getExistingJobs,
+  createMLJob,
+  fetchAnomalyRecords,
+  deleteMLJob,
+  getMLCapabilities,
+} from '../api/ml_anomaly';
+
+export function* fetchMLJobEffect() {
+  yield takeLatest(
+    getExistingMLJobAction.get,
+    fetchEffectFactory(getExistingJobs, getExistingMLJobAction.success, getExistingMLJobAction.fail)
+  );
+  yield takeLatest(
+    createMLJobAction.get,
+    fetchEffectFactory(createMLJob, createMLJobAction.success, createMLJobAction.fail)
+  );
+  yield takeLatest(
+    getAnomalyRecordsAction.get,
+    fetchEffectFactory(
+      fetchAnomalyRecords,
+      getAnomalyRecordsAction.success,
+      getAnomalyRecordsAction.fail
+    )
+  );
+  yield takeLatest(
+    deleteMLJobAction.get,
+    fetchEffectFactory(deleteMLJob, deleteMLJobAction.success, deleteMLJobAction.fail)
+  );
+  yield takeLatest(
+    getMLCapabilitiesAction.get,
+    fetchEffectFactory(
+      getMLCapabilities,
+      getMLCapabilitiesAction.success,
+      getMLCapabilitiesAction.fail
+    )
+  );
+}
diff --git a/x-pack/legacy/plugins/uptime/public/state/reducers/index.ts b/x-pack/legacy/plugins/uptime/public/state/reducers/index.ts
index 6617627aadaf3..7bf8af5dd4d03 100644
--- a/x-pack/legacy/plugins/uptime/public/state/reducers/index.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/reducers/index.ts
@@ -15,6 +15,7 @@ import { indexPatternReducer } from './index_pattern';
 import { pingReducer } from './ping';
 import { monitorDurationReducer } from './monitor_duration';
 import { indexStatusReducer } from './index_status';
+import { mlJobsReducer } from './ml_anomaly';
 
 export const rootReducer = combineReducers({
   monitor: monitorReducer,
@@ -25,6 +26,7 @@ export const rootReducer = combineReducers({
   dynamicSettings: dynamicSettingsReducer,
   indexPattern: indexPatternReducer,
   ping: pingReducer,
+  ml: mlJobsReducer,
   monitorDuration: monitorDurationReducer,
   indexStatus: indexStatusReducer,
 });
diff --git a/x-pack/legacy/plugins/uptime/public/state/reducers/index_status.ts b/x-pack/legacy/plugins/uptime/public/state/reducers/index_status.ts
index 50a02210fb5d3..1a93eb43775f3 100644
--- a/x-pack/legacy/plugins/uptime/public/state/reducers/index_status.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/reducers/index_status.ts
@@ -6,25 +6,23 @@
 
 import { handleActions } from 'redux-actions';
 import { indexStatusAction } from '../actions';
-import { handleAsyncAction } from './utils';
-import { IReducerState } from './types';
+import { getAsyncInitialState, handleAsyncAction } from './utils';
+import { AsyncInitialState } from './types';
 import { StatesIndexStatus } from '../../../common/runtime_types';
 
-export interface IndexStatusState extends IReducerState {
-  data: StatesIndexStatus | null;
+export interface IndexStatusState {
+  indexStatus: AsyncInitialState<StatesIndexStatus | null>;
 }
 
 const initialState: IndexStatusState = {
-  data: null,
-  loading: false,
-  errors: [],
+  indexStatus: getAsyncInitialState(),
 };
 
 type PayLoad = StatesIndexStatus & Error;
 
 export const indexStatusReducer = handleActions<IndexStatusState, PayLoad>(
   {
-    ...handleAsyncAction('data', indexStatusAction),
+    ...handleAsyncAction('indexStatus', indexStatusAction),
   },
   initialState
 );
diff --git a/x-pack/legacy/plugins/uptime/public/state/reducers/ml_anomaly.ts b/x-pack/legacy/plugins/uptime/public/state/reducers/ml_anomaly.ts
new file mode 100644
index 0000000000000..9d59d39634327
--- /dev/null
+++ b/x-pack/legacy/plugins/uptime/public/state/reducers/ml_anomaly.ts
@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { handleActions } from 'redux-actions';
+import {
+  getExistingMLJobAction,
+  createMLJobAction,
+  getAnomalyRecordsAction,
+  deleteMLJobAction,
+  resetMLState,
+  AnomalyRecords,
+  getMLCapabilitiesAction,
+} from '../actions';
+import { getAsyncInitialState, handleAsyncAction } from './utils';
+import { IHttpFetchError } from '../../../../../../../target/types/core/public/http';
+import { AsyncInitialState } from './types';
+import { PrivilegesResponse } from '../../../../../../plugins/ml/common/types/privileges';
+import { CreateMLJobSuccess, DeleteJobResults } from '../actions/types';
+import { JobExistResult } from '../../../../../../plugins/ml/common/types/data_recognizer';
+
+export interface MLJobState {
+  mlJob: AsyncInitialState<JobExistResult>;
+  createJob: AsyncInitialState<CreateMLJobSuccess>;
+  deleteJob: AsyncInitialState<DeleteJobResults>;
+  anomalies: AsyncInitialState<AnomalyRecords>;
+  mlCapabilities: AsyncInitialState<PrivilegesResponse>;
+}
+
+const initialState: MLJobState = {
+  mlJob: getAsyncInitialState(),
+  createJob: getAsyncInitialState(),
+  deleteJob: getAsyncInitialState(),
+  anomalies: getAsyncInitialState(),
+  mlCapabilities: getAsyncInitialState(),
+};
+
+type Payload = IHttpFetchError;
+
+export const mlJobsReducer = handleActions<MLJobState>(
+  {
+    ...handleAsyncAction<MLJobState, Payload>('mlJob', getExistingMLJobAction),
+    ...handleAsyncAction<MLJobState, Payload>('mlCapabilities', getMLCapabilitiesAction),
+    ...handleAsyncAction<MLJobState, Payload>('createJob', createMLJobAction),
+    ...handleAsyncAction<MLJobState, Payload>('deleteJob', deleteMLJobAction),
+    ...handleAsyncAction<MLJobState, Payload>('anomalies', getAnomalyRecordsAction),
+    ...{
+      [String(resetMLState)]: state => ({
+        ...state,
+        mlJob: {
+          loading: false,
+          data: null,
+          error: null,
+        },
+        createJob: {
+          data: null,
+          error: null,
+          loading: false,
+        },
+        deleteJob: {
+          data: null,
+          error: null,
+          loading: false,
+        },
+      }),
+    },
+  },
+  initialState
+);
diff --git a/x-pack/legacy/plugins/uptime/public/state/reducers/monitor_duration.ts b/x-pack/legacy/plugins/uptime/public/state/reducers/monitor_duration.ts
index a222764bd5d24..0e1771c393e50 100644
--- a/x-pack/legacy/plugins/uptime/public/state/reducers/monitor_duration.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/reducers/monitor_duration.ts
@@ -13,13 +13,13 @@ import {
 import { MonitorDurationResult } from '../../../common/types';
 
 export interface MonitorDuration {
-  monitor_duration: MonitorDurationResult | null;
+  durationLines: MonitorDurationResult | null;
   errors: any[];
   loading: boolean;
 }
 
 const initialState: MonitorDuration = {
-  monitor_duration: null,
+  durationLines: null,
   loading: false,
   errors: [],
 };
@@ -39,7 +39,7 @@ export const monitorDurationReducer = handleActions<MonitorDuration, PayLoad>(
     ) => ({
       ...state,
       loading: false,
-      monitor_duration: { ...action.payload },
+      durationLines: { ...action.payload },
     }),
 
     [String(getMonitorDurationActionFail)]: (state: MonitorDuration, action: Action<Error>) => ({
diff --git a/x-pack/legacy/plugins/uptime/public/state/reducers/types.ts b/x-pack/legacy/plugins/uptime/public/state/reducers/types.ts
index 40fe4bddbf172..88995a2f5dd70 100644
--- a/x-pack/legacy/plugins/uptime/public/state/reducers/types.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/reducers/types.ts
@@ -4,7 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export interface IReducerState {
-  errors: Error[];
+import { IHttpFetchError } from '../../../../../../../target/types/core/public/http';
+
+export interface AsyncInitialState<ReduceStateType> {
+  data: ReduceStateType | null;
   loading: boolean;
+  error?: IHttpFetchError | null;
 }
diff --git a/x-pack/legacy/plugins/uptime/public/state/reducers/utils.ts b/x-pack/legacy/plugins/uptime/public/state/reducers/utils.ts
index 773ec10686943..d7a7f237c1154 100644
--- a/x-pack/legacy/plugins/uptime/public/state/reducers/utils.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/reducers/utils.ts
@@ -6,28 +6,45 @@
 
 import { Action } from 'redux-actions';
 import { AsyncAction } from '../actions/types';
-import { IReducerState } from './types';
 
-export function handleAsyncAction<ReducerState extends IReducerState, Payload>(
+export function handleAsyncAction<ReducerState, Payload>(
   storeKey: string,
-  asyncAction: AsyncAction
+  asyncAction: AsyncAction<any, any>
 ) {
   return {
     [String(asyncAction.get)]: (state: ReducerState) => ({
       ...state,
-      loading: true,
+      [storeKey]: {
+        ...(state as any)[storeKey],
+        loading: true,
+      },
     }),
 
     [String(asyncAction.success)]: (state: ReducerState, action: Action<any>) => ({
       ...state,
-      loading: false,
-      [storeKey]: action.payload === null ? action.payload : { ...action.payload },
+      [storeKey]: {
+        ...(state as any)[storeKey],
+        data: action.payload === null ? action.payload : { ...action.payload },
+        loading: false,
+      },
     }),
 
     [String(asyncAction.fail)]: (state: ReducerState, action: Action<any>) => ({
       ...state,
-      errors: [...state.errors, action.payload],
-      loading: false,
+      [storeKey]: {
+        ...(state as any)[storeKey],
+        data: null,
+        error: action.payload,
+        loading: false,
+      },
     }),
   };
 }
+
+export function getAsyncInitialState(initialData = null) {
+  return {
+    data: initialData,
+    loading: false,
+    error: null,
+  };
+}
diff --git a/x-pack/legacy/plugins/uptime/public/state/selectors/__tests__/index.test.ts b/x-pack/legacy/plugins/uptime/public/state/selectors/__tests__/index.test.ts
index 1aea90c70cd0e..573d5b1906082 100644
--- a/x-pack/legacy/plugins/uptime/public/state/selectors/__tests__/index.test.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/selectors/__tests__/index.test.ts
@@ -60,14 +60,28 @@ describe('state selectors', () => {
       errors: [],
     },
     monitorDuration: {
-      monitor_duration: null,
+      durationLines: null,
       loading: false,
       errors: [],
     },
+    ml: {
+      mlJob: {
+        data: null,
+        loading: false,
+      },
+      createJob: { data: null, loading: false },
+      deleteJob: { data: null, loading: false },
+      mlCapabilities: { data: null, loading: false },
+      anomalies: {
+        data: null,
+        loading: false,
+      },
+    },
     indexStatus: {
-      loading: false,
-      data: null,
-      errors: [],
+      indexStatus: {
+        data: null,
+        loading: false,
+      },
     },
   };
 
diff --git a/x-pack/legacy/plugins/uptime/public/state/selectors/index.ts b/x-pack/legacy/plugins/uptime/public/state/selectors/index.ts
index 6844b31d4973c..21e01bd7d8279 100644
--- a/x-pack/legacy/plugins/uptime/public/state/selectors/index.ts
+++ b/x-pack/legacy/plugins/uptime/public/state/selectors/index.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { createSelector } from 'reselect';
 import { AppState } from '../../state';
 
 // UI Selectors
@@ -21,13 +22,9 @@ export const monitorLocationsSelector = (state: AppState, monitorId: string) =>
   return state.monitor.monitorLocationsList?.get(monitorId);
 };
 
-export const selectSelectedMonitor = (state: AppState) => {
-  return state.monitorStatus.monitor;
-};
+export const selectSelectedMonitor = (state: AppState) => state.monitorStatus.monitor;
 
-export const selectMonitorStatus = (state: AppState) => {
-  return state.monitorStatus.status;
-};
+export const selectMonitorStatus = (state: AppState) => state.monitorStatus.status;
 
 export const selectDynamicSettings = (state: AppState) => {
   return state.dynamicSettings;
@@ -46,6 +43,36 @@ export const selectPingHistogram = ({ ping, ui }: AppState) => {
   };
 };
 
+const mlCapabilitiesSelector = (state: AppState) => state.ml.mlCapabilities.data;
+
+export const hasMLFeatureAvailable = createSelector(
+  mlCapabilitiesSelector,
+  mlCapabilities =>
+    mlCapabilities?.isPlatinumOrTrialLicense && mlCapabilities?.mlFeatureEnabledInSpace
+);
+
+export const canCreateMLJobSelector = createSelector(
+  mlCapabilitiesSelector,
+  mlCapabilities => mlCapabilities?.capabilities.canCreateJob
+);
+
+export const canDeleteMLJobSelector = createSelector(
+  mlCapabilitiesSelector,
+  mlCapabilities => mlCapabilities?.capabilities.canDeleteJob
+);
+
+export const hasMLJobSelector = ({ ml }: AppState) => ml.mlJob;
+
+export const hasNewMLJobSelector = ({ ml }: AppState) => ml.createJob;
+
+export const isMLJobCreatingSelector = ({ ml }: AppState) => ml.createJob.loading;
+
+export const isMLJobDeletingSelector = ({ ml }: AppState) => ml.deleteJob.loading;
+
+export const isMLJobDeletedSelector = ({ ml }: AppState) => ml.deleteJob;
+
+export const anomaliesSelector = ({ ml }: AppState) => ml.anomalies.data;
+
 export const selectDurationLines = ({ monitorDuration }: AppState) => {
   return monitorDuration;
 };
@@ -60,5 +87,5 @@ export const selectMonitorStatusAlert = ({ indexPattern, overviewFilters, ui }:
 });
 
 export const indexStatusSelector = ({ indexStatus }: AppState) => {
-  return indexStatus;
+  return indexStatus.indexStatus;
 };
diff --git a/x-pack/legacy/plugins/xpack_main/index.js b/x-pack/legacy/plugins/xpack_main/index.js
index 1fec2d2add60e..a4e255495fc86 100644
--- a/x-pack/legacy/plugins/xpack_main/index.js
+++ b/x-pack/legacy/plugins/xpack_main/index.js
@@ -14,7 +14,6 @@ import { xpackInfoRoute, settingsRoute } from './server/routes/api/v1';
 import { i18n } from '@kbn/i18n';
 
 export { callClusterFactory } from './server/lib/call_cluster_factory';
-import { registerMonitoringCollection } from './server/telemetry_collection';
 
 export const xpackMain = kibana => {
   return new kibana.Plugin({
@@ -85,7 +84,6 @@ export const xpackMain = kibana => {
       }
 
       mirrorPluginStatus(server.plugins.elasticsearch, this, 'yellow', 'red');
-      registerMonitoringCollection();
 
       featuresPlugin.registerLegacyAPI({
         xpackInfo: setupXPackMain(server),
diff --git a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/register_xpack_collection.ts b/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/register_xpack_collection.ts
deleted file mode 100644
index 04445d7bde7d7..0000000000000
--- a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/register_xpack_collection.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { getLocalLicense } from '../../../../../../src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_license';
-import { telemetryCollectionManager } from '../../../../../../src/legacy/core_plugins/telemetry/server';
-import { getClusterUuids } from '../../../../../../src/legacy/core_plugins/telemetry/server/telemetry_collection';
-import { getStatsWithXpack } from './get_stats_with_xpack';
-
-export function registerMonitoringCollection() {
-  telemetryCollectionManager.setCollection({
-    esCluster: 'data',
-    title: 'local_xpack',
-    priority: 1,
-    statsGetter: getStatsWithXpack,
-    clusterDetailsGetter: getClusterUuids,
-    licenseGetter: getLocalLicense,
-  });
-}
diff --git a/x-pack/legacy/plugins/xpack_main/server/xpack_main.d.ts b/x-pack/legacy/plugins/xpack_main/server/xpack_main.d.ts
index a9abc733775d2..7b5dc19760627 100644
--- a/x-pack/legacy/plugins/xpack_main/server/xpack_main.d.ts
+++ b/x-pack/legacy/plugins/xpack_main/server/xpack_main.d.ts
@@ -5,12 +5,12 @@
  */
 
 import KbnServer from 'src/legacy/server/kbn_server';
-import { Feature, FeatureWithAllOrReadPrivileges } from '../../../../plugins/features/server';
+import { Feature, FeatureConfig } from '../../../../plugins/features/server';
 import { XPackInfo, XPackInfoOptions } from './lib/xpack_info';
 export { XPackFeature } from './lib/xpack_info';
 
 export interface XPackMainPlugin {
   info: XPackInfo;
   getFeatures(): Feature[];
-  registerFeature(feature: FeatureWithAllOrReadPrivileges): void;
+  registerFeature(feature: FeatureConfig): void;
 }
diff --git a/x-pack/package.json b/x-pack/package.json
index cc6663811f619..254240b461f66 100644
--- a/x-pack/package.json
+++ b/x-pack/package.json
@@ -78,7 +78,7 @@
     "@types/mapbox-gl": "^0.54.1",
     "@types/memoize-one": "^4.1.0",
     "@types/mime": "^2.0.1",
-    "@types/mocha": "^5.2.7",
+    "@types/mocha": "^7.0.2",
     "@types/nock": "^10.0.3",
     "@types/node": ">=10.17.17 <10.20.0",
     "@types/node-fetch": "^2.5.0",
@@ -145,7 +145,7 @@
     "loader-utils": "^1.2.3",
     "madge": "3.4.4",
     "marge": "^1.0.1",
-    "mocha": "^6.2.2",
+    "mocha": "^7.1.1",
     "mocha-junit-reporter": "^1.23.1",
     "mochawesome": "^4.1.0",
     "mochawesome-merge": "^2.0.1",
@@ -326,7 +326,7 @@
     "redux": "^4.0.5",
     "redux-actions": "^2.6.5",
     "redux-observable": "^1.2.0",
-    "redux-saga": "^0.16.0",
+    "redux-saga": "^1.1.3",
     "redux-thunk": "^2.3.0",
     "redux-thunks": "^1.0.0",
     "request": "^2.88.0",
diff --git a/x-pack/plugins/actions/server/builtin_action_types/email.test.ts b/x-pack/plugins/actions/server/builtin_action_types/email.test.ts
index 0bd3992de30e6..469df4fd86e2c 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/email.test.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/email.test.ts
@@ -184,12 +184,14 @@ describe('secrets validation', () => {
     expect(validateSecrets(actionType, secrets)).toEqual(secrets);
   });
 
-  test('secrets validation fails when secrets is not valid', () => {
-    expect(() => {
-      validateSecrets(actionType, {});
-    }).toThrowErrorMatchingInlineSnapshot(
-      `"error validating action type secrets: [user]: expected value of type [string] but got [undefined]"`
-    );
+  test('secrets validation succeeds when secrets props are null/undefined', () => {
+    const secrets: Record<string, any> = {
+      user: null,
+      password: null,
+    };
+    expect(validateSecrets(actionType, {})).toEqual(secrets);
+    expect(validateSecrets(actionType, { user: null })).toEqual(secrets);
+    expect(validateSecrets(actionType, { password: null })).toEqual(secrets);
   });
 });
 
diff --git a/x-pack/plugins/actions/server/builtin_action_types/email.ts b/x-pack/plugins/actions/server/builtin_action_types/email.ts
index 16e0168a7deb9..7992920fdfcb4 100644
--- a/x-pack/plugins/actions/server/builtin_action_types/email.ts
+++ b/x-pack/plugins/actions/server/builtin_action_types/email.ts
@@ -10,7 +10,6 @@ import { schema, TypeOf } from '@kbn/config-schema';
 import nodemailerGetService from 'nodemailer/lib/well-known';
 
 import { sendEmail, JSON_TRANSPORT_SERVICE } from './lib/send_email';
-import { nullableType } from './lib/nullable';
 import { portSchema } from './lib/schemas';
 import { Logger } from '../../../../../src/core/server';
 import { ActionType, ActionTypeExecutorOptions, ActionTypeExecutorResult } from '../types';
@@ -20,10 +19,10 @@ import { ActionsConfigurationUtilities } from '../actions_config';
 export type ActionTypeConfigType = TypeOf<typeof ConfigSchema>;
 
 const ConfigSchemaProps = {
-  service: nullableType(schema.string()),
-  host: nullableType(schema.string()),
-  port: nullableType(portSchema()),
-  secure: nullableType(schema.boolean()),
+  service: schema.nullable(schema.string()),
+  host: schema.nullable(schema.string()),
+  port: schema.nullable(portSchema()),
+  secure: schema.nullable(schema.boolean()),
   from: schema.string(),
 };
 
@@ -75,8 +74,8 @@ function validateConfig(
 export type ActionTypeSecretsType = TypeOf<typeof SecretsSchema>;
 
 const SecretsSchema = schema.object({
-  user: schema.string(),
-  password: schema.string(),
+  user: schema.nullable(schema.string()),
+  password: schema.nullable(schema.string()),
 });
 
 // params definition
@@ -144,10 +143,14 @@ async function executor(
   const secrets = execOptions.secrets as ActionTypeSecretsType;
   const params = execOptions.params as ActionParamsType;
 
-  const transport: any = {
-    user: secrets.user,
-    password: secrets.password,
-  };
+  const transport: any = {};
+
+  if (secrets.user != null) {
+    transport.user = secrets.user;
+  }
+  if (secrets.password != null) {
+    transport.password = secrets.password;
+  }
 
   if (config.service !== null) {
     transport.service = config.service;
diff --git a/x-pack/plugins/alerting/public/alert_navigation_registry/alert_navigation_registry.ts b/x-pack/plugins/alerting/public/alert_navigation_registry/alert_navigation_registry.ts
index 7f1919fbea684..f30629789b4ed 100644
--- a/x-pack/plugins/alerting/public/alert_navigation_registry/alert_navigation_registry.ts
+++ b/x-pack/plugins/alerting/public/alert_navigation_registry/alert_navigation_registry.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import Boom from 'boom';
 import { i18n } from '@kbn/i18n';
 import { AlertType } from '../../common';
 import { AlertNavigationHandler } from './types';
@@ -36,7 +35,7 @@ export class AlertNavigationRegistry {
 
   public registerDefault(consumer: string, handler: AlertNavigationHandler) {
     if (this.hasDefaultHandler(consumer)) {
-      throw Boom.badRequest(
+      throw new Error(
         i18n.translate('xpack.alerting.alertNavigationRegistry.register.duplicateDefaultError', {
           defaultMessage: 'Default Navigation within "{consumer}" is already registered.',
           values: {
@@ -54,7 +53,7 @@ export class AlertNavigationRegistry {
 
   public register(consumer: string, alertType: AlertType, handler: AlertNavigationHandler) {
     if (this.hasTypedHandler(consumer, alertType)) {
-      throw Boom.badRequest(
+      throw new Error(
         i18n.translate('xpack.alerting.alertNavigationRegistry.register.duplicateNavigationError', {
           defaultMessage:
             'Navigation for Alert type "{alertType}" within "{consumer}" is already registered.',
@@ -78,7 +77,7 @@ export class AlertNavigationRegistry {
       return (consumerHandlers.get(alertType.id) ?? consumerHandlers.get(DEFAULT_HANDLER))!;
     }
 
-    throw Boom.badRequest(
+    throw new Error(
       i18n.translate('xpack.alerting.alertNavigationRegistry.get.missingNavigationError', {
         defaultMessage:
           'Navigation for Alert type "{alertType}" within "{consumer}" is not registered.',
diff --git a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
index 9a557532aae93..5de82a9ee8788 100644
--- a/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
+++ b/x-pack/plugins/apm/common/__snapshots__/elasticsearch_fieldnames.test.ts.snap
@@ -2,6 +2,8 @@
 
 exports[`Error AGENT_NAME 1`] = `"java"`;
 
+exports[`Error AGENT_VERSION 1`] = `"agent version"`;
+
 exports[`Error CLIENT_GEO_COUNTRY_ISO_CODE 1`] = `undefined`;
 
 exports[`Error CONTAINER_ID 1`] = `undefined`;
@@ -56,7 +58,7 @@ exports[`Error METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
 exports[`Error OBSERVER_LISTENING 1`] = `undefined`;
 
-exports[`Error OBSERVER_VERSION_MAJOR 1`] = `undefined`;
+exports[`Error OBSERVER_VERSION_MAJOR 1`] = `8`;
 
 exports[`Error PARENT_ID 1`] = `"parentId"`;
 
@@ -68,14 +70,26 @@ exports[`Error SERVICE_ENVIRONMENT 1`] = `undefined`;
 
 exports[`Error SERVICE_FRAMEWORK_NAME 1`] = `undefined`;
 
+exports[`Error SERVICE_FRAMEWORK_VERSION 1`] = `undefined`;
+
+exports[`Error SERVICE_LANGUAGE_NAME 1`] = `"nodejs"`;
+
+exports[`Error SERVICE_LANGUAGE_VERSION 1`] = `"v1337"`;
+
 exports[`Error SERVICE_NAME 1`] = `"service name"`;
 
 exports[`Error SERVICE_NODE_NAME 1`] = `undefined`;
 
+exports[`Error SERVICE_RUNTIME_NAME 1`] = `undefined`;
+
+exports[`Error SERVICE_RUNTIME_VERSION 1`] = `undefined`;
+
 exports[`Error SERVICE_VERSION 1`] = `undefined`;
 
 exports[`Error SPAN_ACTION 1`] = `undefined`;
 
+exports[`Error SPAN_DESTINATION_SERVICE_RESOURCE 1`] = `undefined`;
+
 exports[`Error SPAN_DURATION 1`] = `undefined`;
 
 exports[`Error SPAN_ID 1`] = `undefined`;
@@ -110,10 +124,14 @@ exports[`Error URL_FULL 1`] = `undefined`;
 
 exports[`Error USER_AGENT_NAME 1`] = `undefined`;
 
+exports[`Error USER_AGENT_ORIGINAL 1`] = `undefined`;
+
 exports[`Error USER_ID 1`] = `undefined`;
 
 exports[`Span AGENT_NAME 1`] = `"java"`;
 
+exports[`Span AGENT_VERSION 1`] = `"agent version"`;
+
 exports[`Span CLIENT_GEO_COUNTRY_ISO_CODE 1`] = `undefined`;
 
 exports[`Span CONTAINER_ID 1`] = `undefined`;
@@ -168,7 +186,7 @@ exports[`Span METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
 exports[`Span OBSERVER_LISTENING 1`] = `undefined`;
 
-exports[`Span OBSERVER_VERSION_MAJOR 1`] = `undefined`;
+exports[`Span OBSERVER_VERSION_MAJOR 1`] = `8`;
 
 exports[`Span PARENT_ID 1`] = `"parentId"`;
 
@@ -180,14 +198,26 @@ exports[`Span SERVICE_ENVIRONMENT 1`] = `undefined`;
 
 exports[`Span SERVICE_FRAMEWORK_NAME 1`] = `undefined`;
 
+exports[`Span SERVICE_FRAMEWORK_VERSION 1`] = `undefined`;
+
+exports[`Span SERVICE_LANGUAGE_NAME 1`] = `undefined`;
+
+exports[`Span SERVICE_LANGUAGE_VERSION 1`] = `undefined`;
+
 exports[`Span SERVICE_NAME 1`] = `"service name"`;
 
 exports[`Span SERVICE_NODE_NAME 1`] = `undefined`;
 
+exports[`Span SERVICE_RUNTIME_NAME 1`] = `undefined`;
+
+exports[`Span SERVICE_RUNTIME_VERSION 1`] = `undefined`;
+
 exports[`Span SERVICE_VERSION 1`] = `undefined`;
 
 exports[`Span SPAN_ACTION 1`] = `"my action"`;
 
+exports[`Span SPAN_DESTINATION_SERVICE_RESOURCE 1`] = `undefined`;
+
 exports[`Span SPAN_DURATION 1`] = `1337`;
 
 exports[`Span SPAN_ID 1`] = `"span id"`;
@@ -222,10 +252,14 @@ exports[`Span URL_FULL 1`] = `undefined`;
 
 exports[`Span USER_AGENT_NAME 1`] = `undefined`;
 
+exports[`Span USER_AGENT_ORIGINAL 1`] = `undefined`;
+
 exports[`Span USER_ID 1`] = `undefined`;
 
 exports[`Transaction AGENT_NAME 1`] = `"java"`;
 
+exports[`Transaction AGENT_VERSION 1`] = `"agent version"`;
+
 exports[`Transaction CLIENT_GEO_COUNTRY_ISO_CODE 1`] = `undefined`;
 
 exports[`Transaction CONTAINER_ID 1`] = `"container1234567890abcdef"`;
@@ -280,7 +314,7 @@ exports[`Transaction METRIC_SYSTEM_TOTAL_MEMORY 1`] = `undefined`;
 
 exports[`Transaction OBSERVER_LISTENING 1`] = `undefined`;
 
-exports[`Transaction OBSERVER_VERSION_MAJOR 1`] = `undefined`;
+exports[`Transaction OBSERVER_VERSION_MAJOR 1`] = `8`;
 
 exports[`Transaction PARENT_ID 1`] = `"parentId"`;
 
@@ -292,14 +326,26 @@ exports[`Transaction SERVICE_ENVIRONMENT 1`] = `undefined`;
 
 exports[`Transaction SERVICE_FRAMEWORK_NAME 1`] = `undefined`;
 
+exports[`Transaction SERVICE_FRAMEWORK_VERSION 1`] = `undefined`;
+
+exports[`Transaction SERVICE_LANGUAGE_NAME 1`] = `"nodejs"`;
+
+exports[`Transaction SERVICE_LANGUAGE_VERSION 1`] = `"v1337"`;
+
 exports[`Transaction SERVICE_NAME 1`] = `"service name"`;
 
 exports[`Transaction SERVICE_NODE_NAME 1`] = `undefined`;
 
+exports[`Transaction SERVICE_RUNTIME_NAME 1`] = `undefined`;
+
+exports[`Transaction SERVICE_RUNTIME_VERSION 1`] = `undefined`;
+
 exports[`Transaction SERVICE_VERSION 1`] = `undefined`;
 
 exports[`Transaction SPAN_ACTION 1`] = `undefined`;
 
+exports[`Transaction SPAN_DESTINATION_SERVICE_RESOURCE 1`] = `undefined`;
+
 exports[`Transaction SPAN_DURATION 1`] = `undefined`;
 
 exports[`Transaction SPAN_ID 1`] = `undefined`;
@@ -334,4 +380,6 @@ exports[`Transaction URL_FULL 1`] = `"http://www.elastic.co"`;
 
 exports[`Transaction USER_AGENT_NAME 1`] = `"Other"`;
 
+exports[`Transaction USER_AGENT_ORIGINAL 1`] = `"test original"`;
+
 exports[`Transaction USER_ID 1`] = `"1337"`;
diff --git a/x-pack/plugins/apm/common/agent_configuration_constants.ts b/x-pack/plugins/apm/common/agent_configuration/all_option.ts
similarity index 74%
rename from x-pack/plugins/apm/common/agent_configuration_constants.ts
rename to x-pack/plugins/apm/common/agent_configuration/all_option.ts
index 4ddc65c14a134..7b1c7bdda97a7 100644
--- a/x-pack/plugins/apm/common/agent_configuration_constants.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/all_option.ts
@@ -8,11 +8,11 @@ import { i18n } from '@kbn/i18n';
 
 export const ALL_OPTION_VALUE = 'ALL_OPTION_VALUE';
 
-// human-readable label for the option. The "All" option should be translated.
+// human-readable label for service and environment. The "All" option should be translated.
 // Everything else should be returned verbatim
 export function getOptionLabel(value: string | undefined) {
   if (value === undefined || value === ALL_OPTION_VALUE) {
-    return i18n.translate('xpack.apm.settings.agentConf.allOptionLabel', {
+    return i18n.translate('xpack.apm.agentConfig.allOptionLabel', {
       defaultMessage: 'All'
     });
   }
@@ -20,6 +20,6 @@ export function getOptionLabel(value: string | undefined) {
   return value;
 }
 
-export function omitAllOption(value: string) {
+export function omitAllOption(value?: string) {
   return value === ALL_OPTION_VALUE ? undefined : value;
 }
diff --git a/x-pack/plugins/apm/common/agent_configuration/amount_and_unit.ts b/x-pack/plugins/apm/common/agent_configuration/amount_and_unit.ts
new file mode 100644
index 0000000000000..447e529c9c199
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/amount_and_unit.ts
@@ -0,0 +1,19 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+interface AmountAndUnit {
+  amount: string;
+  unit: string;
+}
+
+export function amountAndUnitToObject(value: string): AmountAndUnit {
+  const [, amount = '', unit = ''] = value.match(/(\d+)?(\w+)?/) || [];
+  return { amount, unit };
+}
+
+export function amountAndUnitToString({ amount, unit }: AmountAndUnit) {
+  return `${amount}${unit}`;
+}
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/configuration_types.d.ts b/x-pack/plugins/apm/common/agent_configuration/configuration_types.d.ts
similarity index 82%
rename from x-pack/plugins/apm/server/lib/settings/agent_configuration/configuration_types.d.ts
rename to x-pack/plugins/apm/common/agent_configuration/configuration_types.d.ts
index ddbe6892c5441..675298c3719f2 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/configuration_types.d.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/configuration_types.d.ts
@@ -5,11 +5,12 @@
  */
 
 import t from 'io-ts';
-import { agentConfigurationIntakeRt } from '../../../../common/runtime_types/agent_configuration_intake_rt';
+import { agentConfigurationIntakeRt } from './runtime_types/agent_configuration_intake_rt';
 
 export type AgentConfigurationIntake = t.TypeOf<
   typeof agentConfigurationIntakeRt
 >;
+
 export type AgentConfiguration = {
   '@timestamp': number;
   applied_by_agent?: boolean;
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/agent_configuration_intake_rt.test.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/agent_configuration_intake_rt.test.ts
new file mode 100644
index 0000000000000..c2a3be784f661
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/agent_configuration_intake_rt.test.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { agentConfigurationIntakeRt } from './agent_configuration_intake_rt';
+import { isRight } from 'fp-ts/lib/Either';
+
+describe('agentConfigurationIntakeRt', () => {
+  it('is valid when "transaction_sample_rate" is string', () => {
+    const config = {
+      service: { name: 'my-service', environment: 'my-environment' },
+      settings: {
+        transaction_sample_rate: '0.5'
+      }
+    };
+
+    expect(isConfigValid(config)).toBe(true);
+  });
+
+  it('is invalid when "transaction_sample_rate" is number', () => {
+    const config = {
+      service: {},
+      settings: {
+        transaction_sample_rate: 0.5
+      }
+    };
+
+    expect(isConfigValid(config)).toBe(false);
+  });
+
+  it('is valid when unknown setting is string', () => {
+    const config = {
+      service: { name: 'my-service', environment: 'my-environment' },
+      settings: {
+        my_unknown_setting: '0.5'
+      }
+    };
+
+    expect(isConfigValid(config)).toBe(true);
+  });
+
+  it('is invalid when unknown setting is boolean', () => {
+    const config = {
+      service: { name: 'my-service', environment: 'my-environment' },
+      settings: {
+        my_unknown_setting: false
+      }
+    };
+
+    expect(isConfigValid(config)).toBe(false);
+  });
+});
+
+function isConfigValid(config: any) {
+  return isRight(agentConfigurationIntakeRt.decode(config));
+}
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/agent_configuration_intake_rt.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/agent_configuration_intake_rt.ts
new file mode 100644
index 0000000000000..a0b1d5015b9ef
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/agent_configuration_intake_rt.ts
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { settingDefinitions } from '../setting_definitions';
+
+// retrieve validation from config definitions settings and validate on the server
+const knownSettings = settingDefinitions.reduce<
+  // TODO: is it possible to get rid of any?
+  Record<string, t.Type<any, string, unknown>>
+>((acc, { key, validation }) => {
+  acc[key] = validation;
+  return acc;
+}, {});
+
+export const serviceRt = t.partial({
+  name: t.string,
+  environment: t.string
+});
+
+export const settingsRt = t.intersection([
+  t.record(t.string, t.string),
+  t.partial(knownSettings)
+]);
+
+export const agentConfigurationIntakeRt = t.intersection([
+  t.partial({ agent_name: t.string }),
+  t.type({
+    service: serviceRt,
+    settings: settingsRt
+  })
+]);
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/boolean_rt.test.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/boolean_rt.test.ts
new file mode 100644
index 0000000000000..d4dfbec2344fe
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/boolean_rt.test.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { booleanRt } from './boolean_rt';
+import { isRight } from 'fp-ts/lib/Either';
+
+describe('booleanRt', () => {
+  describe('it should not accept', () => {
+    [undefined, null, '', 0, 'foo', true, false].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(booleanRt.decode(input))).toBe(false);
+      });
+    });
+  });
+
+  describe('it should accept', () => {
+    ['true', 'false'].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(booleanRt.decode(input))).toBe(true);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/boolean_rt.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/boolean_rt.ts
new file mode 100644
index 0000000000000..0cd3ac9d6939c
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/boolean_rt.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+
+export const booleanRt = t.union([t.literal('true'), t.literal('false')]);
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/bytes_rt.test.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/bytes_rt.test.ts
new file mode 100644
index 0000000000000..596037645c002
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/bytes_rt.test.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { bytesRt } from './bytes_rt';
+import { isRight } from 'fp-ts/lib/Either';
+
+describe('bytesRt', () => {
+  describe('it should not accept', () => {
+    [
+      undefined,
+      null,
+      '',
+      0,
+      'foo',
+      true,
+      false,
+      '100',
+      'mb',
+      '0kb',
+      '5gb',
+      '6tb'
+    ].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(bytesRt.decode(input))).toBe(false);
+      });
+    });
+  });
+
+  describe('it should accept', () => {
+    ['1b', '2kb', '3mb'].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(bytesRt.decode(input))).toBe(true);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/bytes_rt.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/bytes_rt.ts
new file mode 100644
index 0000000000000..d189fab89ae5d
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/bytes_rt.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { either } from 'fp-ts/lib/Either';
+import { amountAndUnitToObject } from '../amount_and_unit';
+
+export const BYTE_UNITS = ['b', 'kb', 'mb'];
+
+export const bytesRt = new t.Type<string, string, unknown>(
+  'bytesRt',
+  t.string.is,
+  (input, context) => {
+    return either.chain(t.string.validate(input, context), inputAsString => {
+      const { amount, unit } = amountAndUnitToObject(inputAsString);
+      const amountAsInt = parseInt(amount, 10);
+      const isValidUnit = BYTE_UNITS.includes(unit);
+      const isValid = amountAsInt > 0 && isValidUnit;
+
+      return isValid
+        ? t.success(inputAsString)
+        : t.failure(
+            input,
+            context,
+            `Must have numeric amount and a valid unit (${BYTE_UNITS})`
+          );
+    });
+  },
+  t.identity
+);
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/capture_body_rt.test.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/capture_body_rt.test.ts
new file mode 100644
index 0000000000000..ba522e6b8ea68
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/capture_body_rt.test.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { captureBodyRt } from './capture_body_rt';
+import { isRight } from 'fp-ts/lib/Either';
+
+describe('captureBodyRt', () => {
+  describe('it should not accept', () => {
+    [undefined, null, '', 0, 'foo', true, false].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(captureBodyRt.decode(input))).toBe(false);
+      });
+    });
+  });
+
+  describe('it should accept', () => {
+    ['off', 'errors', 'transactions', 'all'].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(captureBodyRt.decode(input))).toBe(true);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/index.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/capture_body_rt.ts
similarity index 59%
rename from x-pack/plugins/endpoint/public/applications/endpoint/store/managing/index.ts
rename to x-pack/plugins/apm/common/agent_configuration/runtime_types/capture_body_rt.ts
index f0bfe27c9e30f..8f38a8976beb0 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/index.ts
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/capture_body_rt.ts
@@ -4,6 +4,11 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { managementListReducer } from './reducer';
-export { ManagementAction } from './action';
-export { managementMiddlewareFactory } from './middleware';
+import * as t from 'io-ts';
+
+export const captureBodyRt = t.union([
+  t.literal('off'),
+  t.literal('errors'),
+  t.literal('transactions'),
+  t.literal('all')
+]);
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.test.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.test.ts
new file mode 100644
index 0000000000000..6b81031542c34
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.test.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { durationRt } from './duration_rt';
+import { isRight } from 'fp-ts/lib/Either';
+
+describe('durationRt', () => {
+  describe('it should not accept', () => {
+    [undefined, null, '', 0, 'foo', true, false, '100', 's', 'm', '0h'].map(
+      input => {
+        it(`${JSON.stringify(input)}`, () => {
+          expect(isRight(durationRt.decode(input))).toBe(false);
+        });
+      }
+    );
+  });
+
+  describe('It should accept', () => {
+    ['1s', '2m', '3h'].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(durationRt.decode(input))).toBe(true);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.ts
new file mode 100644
index 0000000000000..99e6a57089dee
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/duration_rt.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { either } from 'fp-ts/lib/Either';
+import { amountAndUnitToObject } from '../amount_and_unit';
+
+export const DURATION_UNITS = ['s', 'm', 'h'];
+
+export const durationRt = new t.Type<string, string, unknown>(
+  'durationRt',
+  t.string.is,
+  (input, context) => {
+    return either.chain(t.string.validate(input, context), inputAsString => {
+      const { amount, unit } = amountAndUnitToObject(inputAsString);
+      const amountAsInt = parseInt(amount, 10);
+      const isValidUnit = DURATION_UNITS.includes(unit);
+      const isValid = amountAsInt > 0 && isValidUnit;
+
+      return isValid
+        ? t.success(inputAsString)
+        : t.failure(
+            input,
+            context,
+            `Must have numeric amount and a valid unit (${DURATION_UNITS})`
+          );
+    });
+  },
+  t.identity
+);
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/integer_rt.test.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/integer_rt.test.ts
new file mode 100644
index 0000000000000..ef7fbeed4331e
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/integer_rt.test.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { integerRt, getIntegerRt } from './integer_rt';
+import { isRight } from 'fp-ts/lib/Either';
+
+describe('integerRt', () => {
+  describe('it should not accept', () => {
+    [undefined, null, '', 'foo', 0, 55, NaN].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(integerRt.decode(input))).toBe(false);
+      });
+    });
+  });
+
+  describe('it should accept', () => {
+    ['-1234', '-1', '0', '1000', '32000', '100000'].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(integerRt.decode(input))).toBe(true);
+      });
+    });
+  });
+});
+
+describe('getIntegerRt', () => {
+  const customIntegerRt = getIntegerRt({ min: 0, max: 32000 });
+  describe('it should not accept', () => {
+    [undefined, null, '', 'foo', 0, 55, '-1', '-55', '33000', NaN].map(
+      input => {
+        it(`${JSON.stringify(input)}`, () => {
+          expect(isRight(customIntegerRt.decode(input))).toBe(false);
+        });
+      }
+    );
+  });
+
+  describe('it should accept', () => {
+    ['0', '1000', '32000'].map(input => {
+      it(`${JSON.stringify(input)}`, () => {
+        expect(isRight(customIntegerRt.decode(input))).toBe(true);
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/integer_rt.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/integer_rt.ts
new file mode 100644
index 0000000000000..6dbf175c8b4ce
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/integer_rt.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { either } from 'fp-ts/lib/Either';
+
+export function getIntegerRt({ min, max }: { min: number; max: number }) {
+  return new t.Type<string, string, unknown>(
+    'integerRt',
+    t.string.is,
+    (input, context) => {
+      return either.chain(t.string.validate(input, context), inputAsString => {
+        const inputAsInt = parseInt(inputAsString, 10);
+        const isValid = inputAsInt >= min && inputAsInt <= max;
+        return isValid
+          ? t.success(inputAsString)
+          : t.failure(
+              input,
+              context,
+              `Number must be a valid number between ${min} and ${max}`
+            );
+      });
+    },
+    t.identity
+  );
+}
+
+export const integerRt = getIntegerRt({ min: -Infinity, max: Infinity });
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/number_float_rt.test.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/number_float_rt.test.ts
new file mode 100644
index 0000000000000..ece229ca162fb
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/number_float_rt.test.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { numberFloatRt } from './number_float_rt';
+import { isRight } from 'fp-ts/lib/Either';
+
+describe('numberFloatRt', () => {
+  it('does not accept empty values', () => {
+    expect(isRight(numberFloatRt.decode(undefined))).toBe(false);
+    expect(isRight(numberFloatRt.decode(null))).toBe(false);
+    expect(isRight(numberFloatRt.decode(''))).toBe(false);
+  });
+
+  it('should only accept stringified numbers', () => {
+    expect(isRight(numberFloatRt.decode('0.5'))).toBe(true);
+    expect(isRight(numberFloatRt.decode(0.5))).toBe(false);
+  });
+
+  it('checks if the number falls within 0, 1', () => {
+    expect(isRight(numberFloatRt.decode('0'))).toBe(true);
+    expect(isRight(numberFloatRt.decode('0.5'))).toBe(true);
+    expect(isRight(numberFloatRt.decode('-0.1'))).toBe(false);
+    expect(isRight(numberFloatRt.decode('1.1'))).toBe(false);
+    expect(isRight(numberFloatRt.decode(NaN))).toBe(false);
+  });
+
+  it('checks whether the number of decimals is 3', () => {
+    expect(isRight(numberFloatRt.decode('1'))).toBe(true);
+    expect(isRight(numberFloatRt.decode('0.9'))).toBe(true);
+    expect(isRight(numberFloatRt.decode('0.99'))).toBe(true);
+    expect(isRight(numberFloatRt.decode('0.999'))).toBe(true);
+    expect(isRight(numberFloatRt.decode('0.9999'))).toBe(false);
+  });
+});
diff --git a/x-pack/plugins/apm/common/agent_configuration/runtime_types/number_float_rt.ts b/x-pack/plugins/apm/common/agent_configuration/runtime_types/number_float_rt.ts
new file mode 100644
index 0000000000000..f1890c9851a3d
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/runtime_types/number_float_rt.ts
@@ -0,0 +1,36 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { either } from 'fp-ts/lib/Either';
+
+export function getNumberFloatRt({ min, max }: { min: number; max: number }) {
+  return new t.Type<string, string, unknown>(
+    'numberFloatRt',
+    t.string.is,
+    (input, context) => {
+      return either.chain(t.string.validate(input, context), inputAsString => {
+        const inputAsFloat = parseFloat(inputAsString);
+        const maxThreeDecimals =
+          parseFloat(inputAsFloat.toFixed(3)) === inputAsFloat;
+
+        const isValid =
+          inputAsFloat >= min && inputAsFloat <= max && maxThreeDecimals;
+
+        return isValid
+          ? t.success(inputAsString)
+          : t.failure(
+              input,
+              context,
+              `Number must be between ${min} and ${max}`
+            );
+      });
+    },
+    t.identity
+  );
+}
+
+export const numberFloatRt = getNumberFloatRt({ min: 0, max: 1 });
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap
new file mode 100644
index 0000000000000..365d8838a24a6
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/__snapshots__/index.test.ts.snap
@@ -0,0 +1,191 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`settingDefinitions should have correct default values 1`] = `
+Array [
+  Object {
+    "key": "active",
+    "type": "boolean",
+    "validationName": "(\\"true\\" | \\"false\\")",
+  },
+  Object {
+    "key": "api_request_size",
+    "type": "bytes",
+    "units": Array [
+      "b",
+      "kb",
+      "mb",
+    ],
+    "validationError": "Please specify an integer and a unit",
+    "validationName": "bytesRt",
+  },
+  Object {
+    "key": "api_request_time",
+    "type": "duration",
+    "units": Array [
+      "s",
+      "m",
+      "h",
+    ],
+    "validationError": "Please specify an integer and a unit",
+    "validationName": "durationRt",
+  },
+  Object {
+    "key": "capture_body",
+    "options": Array [
+      Object {
+        "text": "off",
+      },
+      Object {
+        "text": "errors",
+      },
+      Object {
+        "text": "transactions",
+      },
+      Object {
+        "text": "all",
+      },
+    ],
+    "type": "select",
+    "validationName": "(\\"off\\" | \\"errors\\" | \\"transactions\\" | \\"all\\")",
+  },
+  Object {
+    "key": "capture_headers",
+    "type": "boolean",
+    "validationName": "(\\"true\\" | \\"false\\")",
+  },
+  Object {
+    "key": "circuit_breaker_enabled",
+    "type": "boolean",
+    "validationName": "(\\"true\\" | \\"false\\")",
+  },
+  Object {
+    "key": "enable_log_correlation",
+    "type": "boolean",
+    "validationName": "(\\"true\\" | \\"false\\")",
+  },
+  Object {
+    "key": "log_level",
+    "type": "text",
+    "validationName": "string",
+  },
+  Object {
+    "key": "profiling_inferred_spans_enabled",
+    "type": "boolean",
+    "validationName": "(\\"true\\" | \\"false\\")",
+  },
+  Object {
+    "key": "profiling_inferred_spans_excluded_classes",
+    "type": "text",
+    "validationName": "string",
+  },
+  Object {
+    "key": "profiling_inferred_spans_included_classes",
+    "type": "text",
+    "validationName": "string",
+  },
+  Object {
+    "key": "profiling_inferred_spans_min_duration",
+    "type": "duration",
+    "units": Array [
+      "s",
+      "m",
+      "h",
+    ],
+    "validationError": "Please specify an integer and a unit",
+    "validationName": "durationRt",
+  },
+  Object {
+    "key": "profiling_inferred_spans_sampling_interval",
+    "type": "duration",
+    "units": Array [
+      "s",
+      "m",
+      "h",
+    ],
+    "validationError": "Please specify an integer and a unit",
+    "validationName": "durationRt",
+  },
+  Object {
+    "key": "server_timeout",
+    "type": "duration",
+    "units": Array [
+      "s",
+      "m",
+      "h",
+    ],
+    "validationError": "Please specify an integer and a unit",
+    "validationName": "durationRt",
+  },
+  Object {
+    "key": "span_frames_min_duration",
+    "type": "duration",
+    "units": Array [
+      "s",
+      "m",
+      "h",
+    ],
+    "validationError": "Please specify an integer and a unit",
+    "validationName": "durationRt",
+  },
+  Object {
+    "key": "stack_trace_limit",
+    "type": "integer",
+    "validationError": "Must be an integer",
+    "validationName": "integerRt",
+  },
+  Object {
+    "key": "stress_monitor_cpu_duration_threshold",
+    "type": "duration",
+    "units": Array [
+      "s",
+      "m",
+      "h",
+    ],
+    "validationError": "Please specify an integer and a unit",
+    "validationName": "durationRt",
+  },
+  Object {
+    "key": "stress_monitor_gc_relief_threshold",
+    "type": "float",
+    "validationError": "Must be a number between 0.000 and 1",
+    "validationName": "numberFloatRt",
+  },
+  Object {
+    "key": "stress_monitor_gc_stress_threshold",
+    "type": "boolean",
+    "validationName": "(\\"true\\" | \\"false\\")",
+  },
+  Object {
+    "key": "stress_monitor_system_cpu_relief_threshold",
+    "type": "float",
+    "validationError": "Must be a number between 0.000 and 1",
+    "validationName": "numberFloatRt",
+  },
+  Object {
+    "key": "stress_monitor_system_cpu_stress_threshold",
+    "type": "float",
+    "validationError": "Must be a number between 0.000 and 1",
+    "validationName": "numberFloatRt",
+  },
+  Object {
+    "key": "trace_methods_duration_threshold",
+    "type": "integer",
+    "validationError": "Must be an integer",
+    "validationName": "integerRt",
+  },
+  Object {
+    "key": "transaction_max_spans",
+    "max": 32000,
+    "min": 0,
+    "type": "integer",
+    "validationError": "Must be between 0 and 32000",
+    "validationName": "integerRt",
+  },
+  Object {
+    "key": "transaction_sample_rate",
+    "type": "float",
+    "validationError": "Must be a number between 0.000 and 1",
+    "validationName": "numberFloatRt",
+  },
+]
+`;
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts
new file mode 100644
index 0000000000000..b6eb40305dae7
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/general_settings.ts
@@ -0,0 +1,219 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { getIntegerRt } from '../runtime_types/integer_rt';
+import { captureBodyRt } from '../runtime_types/capture_body_rt';
+import { RawSettingDefinition } from './types';
+
+/*
+ * Settings added here will show up in the UI and will be validated on the client and server
+ */
+export const generalSettings: RawSettingDefinition[] = [
+  // Active
+  {
+    key: 'active',
+    type: 'boolean',
+    defaultValue: 'true',
+    label: i18n.translate('xpack.apm.agentConfig.active.label', {
+      defaultMessage: 'Active'
+    }),
+    description: i18n.translate('xpack.apm.agentConfig.active.description', {
+      defaultMessage:
+        'A boolean specifying if the agent should be active or not.\nWhen active, the agent instruments incoming HTTP requests, tracks errors and collects and sends metrics.\nWhen inactive, the agent works as a noop, not collecting data and not communicating with the APM Server.\nAs this is a reversible switch, agent threads are not being killed when inactivated, but they will be \nmostly idle in this state, so the overhead should be negligible.\n\nYou can use this setting to dynamically disable Elastic APM at runtime.'
+    }),
+    excludeAgents: ['js-base', 'rum-js', 'python', 'dotnet']
+  },
+
+  // API Request Size
+  {
+    key: 'api_request_size',
+    type: 'bytes',
+    defaultValue: '768kb',
+    label: i18n.translate('xpack.apm.agentConfig.apiRequestSize.label', {
+      defaultMessage: 'API Request Size'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.apiRequestSize.description',
+      {
+        defaultMessage:
+          'The maximum total compressed size of the request body which is sent to the APM server intake api via a chunked encoding (HTTP streaming).\nNote that a small overshoot is possible.\n\nAllowed byte units are `b`, `kb` and `mb`. `1kb` is equal to `1024b`.'
+      }
+    ),
+    excludeAgents: ['js-base', 'rum-js', 'dotnet']
+  },
+
+  // API Request Time
+  {
+    key: 'api_request_time',
+    type: 'duration',
+    defaultValue: '10s',
+    label: i18n.translate('xpack.apm.agentConfig.apiRequestTime.label', {
+      defaultMessage: 'API Request Time'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.apiRequestTime.description',
+      {
+        defaultMessage:
+          "Maximum time to keep an HTTP request to the APM Server open for.\n\nNOTE: This value has to be lower than the APM Server's `read_timeout` setting."
+      }
+    ),
+    excludeAgents: ['js-base', 'rum-js', 'dotnet']
+  },
+
+  // Capture headers
+  {
+    key: 'capture_headers',
+    type: 'boolean',
+    defaultValue: 'true',
+    label: i18n.translate('xpack.apm.agentConfig.captureHeaders.label', {
+      defaultMessage: 'Capture Headers'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.captureHeaders.description',
+      {
+        defaultMessage:
+          'If set to `true`, the agent will capture request and response headers, including cookies.\n\nNOTE: Setting this to `false` reduces network bandwidth, disk space and object allocations.'
+      }
+    ),
+    excludeAgents: ['js-base', 'rum-js']
+  },
+
+  // Capture body
+  {
+    key: 'capture_body',
+    validation: captureBodyRt,
+    type: 'select',
+    defaultValue: 'off',
+    label: i18n.translate('xpack.apm.agentConfig.captureBody.label', {
+      defaultMessage: 'Capture body'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.captureBody.description',
+      {
+        defaultMessage:
+          'For transactions that are HTTP requests, the agent can optionally capture the request body (e.g. POST variables). Default is "off".'
+      }
+    ),
+    options: [
+      { text: 'off' },
+      { text: 'errors' },
+      { text: 'transactions' },
+      { text: 'all' }
+    ],
+    excludeAgents: ['js-base', 'rum-js', 'dotnet']
+  },
+
+  // LOG_LEVEL
+  {
+    key: 'log_level',
+    type: 'text',
+    defaultValue: 'info',
+    label: i18n.translate('xpack.apm.agentConfig.logLevel.label', {
+      defaultMessage: 'Log level'
+    }),
+    description: i18n.translate('xpack.apm.agentConfig.logLevel.description', {
+      defaultMessage: 'Sets the logging level for the agent'
+    }),
+    excludeAgents: ['js-base', 'rum-js', 'python']
+  },
+
+  // SERVER_TIMEOUT
+  {
+    key: 'server_timeout',
+    type: 'duration',
+    defaultValue: '5s',
+    label: i18n.translate('xpack.apm.agentConfig.serverTimeout.label', {
+      defaultMessage: 'Server Timeout'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.serverTimeout.description',
+      {
+        defaultMessage:
+          'If a request to the APM server takes longer than the configured timeout,\nthe request is cancelled and the event (exception or transaction) is discarded.\nSet to 0 to disable timeouts.\n\nWARNING: If timeouts are disabled or set to a high value, your app could experience memory issues if the APM server times out.'
+      }
+    ),
+    includeAgents: ['nodejs', 'java', 'go']
+  },
+
+  // SPAN_FRAMES_MIN_DURATION
+  {
+    key: 'span_frames_min_duration',
+    type: 'duration',
+    defaultValue: '5ms',
+    label: i18n.translate('xpack.apm.agentConfig.spanFramesMinDuration.label', {
+      defaultMessage: 'Span frames minimum duration'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.spanFramesMinDuration.description',
+      {
+        defaultMessage:
+          'In its default settings, the APM agent will collect a stack trace with every recorded span.\nWhile this is very helpful to find the exact place in your code that causes the span, collecting this stack trace does have some overhead. \nWhen setting this option to a negative value, like `-1ms`, stack traces will be collected for all spans. Setting it to a positive value, e.g. `5ms`, will limit stack trace collection to spans with durations equal to or longer than the given value, e.g. 5 milliseconds.\n\nTo disable stack trace collection for spans completely, set the value to `0ms`.'
+      }
+    ),
+    excludeAgents: ['js-base', 'rum-js', 'nodejs']
+  },
+
+  // STACK_TRACE_LIMIT
+  {
+    key: 'stack_trace_limit',
+    type: 'integer',
+    defaultValue: '50',
+    label: i18n.translate('xpack.apm.agentConfig.stackTraceLimit.label', {
+      defaultMessage: 'Stack trace limit'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.stackTraceLimit.description',
+      {
+        defaultMessage:
+          'Setting it to 0 will disable stack trace collection. Any positive integer value will be used as the maximum number of frames to collect. Setting it -1 means that all frames will be collected.'
+      }
+    ),
+    includeAgents: ['nodejs', 'java', 'dotnet', 'go']
+  },
+
+  // Transaction sample rate
+  {
+    key: 'transaction_sample_rate',
+    type: 'float',
+    defaultValue: '1.0',
+    label: i18n.translate('xpack.apm.agentConfig.transactionSampleRate.label', {
+      defaultMessage: 'Transaction sample rate'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.transactionSampleRate.description',
+      {
+        defaultMessage:
+          'By default, the agent will sample every transaction (e.g. request to your service). To reduce overhead and storage requirements, you can set the sample rate to a value between 0.0 and 1.0. We still record overall time and the result for unsampled transactions, but no context information, labels, or spans.'
+      }
+    )
+  },
+
+  // Transaction max spans
+  {
+    key: 'transaction_max_spans',
+    type: 'integer',
+    validation: getIntegerRt({ min: 0, max: 32000 }),
+    validationError: i18n.translate(
+      'xpack.apm.agentConfig.transactionMaxSpans.errorText',
+      { defaultMessage: 'Must be between 0 and 32000' }
+    ),
+    defaultValue: '500',
+    label: i18n.translate('xpack.apm.agentConfig.transactionMaxSpans.label', {
+      defaultMessage: 'Transaction max spans'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.transactionMaxSpans.description',
+      {
+        defaultMessage:
+          'Limits the amount of spans that are recorded per transaction. Default is 500.'
+      }
+    ),
+    min: 0,
+    max: 32000,
+    excludeAgents: ['js-base', 'rum-js']
+  }
+];
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.test.ts b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.test.ts
new file mode 100644
index 0000000000000..0d1113d74c98b
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.test.ts
@@ -0,0 +1,187 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { omit } from 'lodash';
+import { filterByAgent, settingDefinitions } from '../setting_definitions';
+import { AgentName } from '../../../typings/es_schemas/ui/fields/agent';
+import { SettingDefinition } from './types';
+
+describe('filterByAgent', () => {
+  describe('when `excludeAgents` is dotnet and nodejs', () => {
+    const setting = {
+      key: 'my-setting',
+      excludeAgents: ['dotnet', 'nodejs']
+    } as SettingDefinition;
+
+    it('should not include dotnet', () => {
+      expect(filterByAgent('dotnet')(setting)).toBe(false);
+    });
+
+    it('should include go', () => {
+      expect(filterByAgent('go')(setting)).toBe(true);
+    });
+  });
+
+  describe('when `includeAgents` is dotnet and nodejs', () => {
+    const setting = {
+      key: 'my-setting',
+      includeAgents: ['dotnet', 'nodejs']
+    } as SettingDefinition;
+
+    it('should not include go', () => {
+      expect(filterByAgent('go')(setting)).toBe(false);
+    });
+
+    it('should include dotnet', () => {
+      expect(filterByAgent('dotnet')(setting)).toBe(true);
+    });
+  });
+
+  describe('options per agent', () => {
+    it('go', () => {
+      expect(getSettingKeysForAgent('go')).toEqual([
+        'active',
+        'api_request_size',
+        'api_request_time',
+        'capture_body',
+        'capture_headers',
+        'log_level',
+        'server_timeout',
+        'span_frames_min_duration',
+        'stack_trace_limit',
+        'transaction_max_spans',
+        'transaction_sample_rate'
+      ]);
+    });
+
+    it('java', () => {
+      expect(getSettingKeysForAgent('java')).toEqual([
+        'active',
+        'api_request_size',
+        'api_request_time',
+        'capture_body',
+        'capture_headers',
+        'circuit_breaker_enabled',
+        'enable_log_correlation',
+        'log_level',
+        'profiling_inferred_spans_enabled',
+        'profiling_inferred_spans_excluded_classes',
+        'profiling_inferred_spans_included_classes',
+        'profiling_inferred_spans_min_duration',
+        'profiling_inferred_spans_sampling_interval',
+        'server_timeout',
+        'span_frames_min_duration',
+        'stack_trace_limit',
+        'stress_monitor_cpu_duration_threshold',
+        'stress_monitor_gc_relief_threshold',
+        'stress_monitor_gc_stress_threshold',
+        'stress_monitor_system_cpu_relief_threshold',
+        'stress_monitor_system_cpu_stress_threshold',
+        'trace_methods_duration_threshold',
+        'transaction_max_spans',
+        'transaction_sample_rate'
+      ]);
+    });
+
+    it('js-base', () => {
+      expect(getSettingKeysForAgent('js-base')).toEqual([
+        'transaction_sample_rate'
+      ]);
+    });
+
+    it('rum-js', () => {
+      expect(getSettingKeysForAgent('rum-js')).toEqual([
+        'transaction_sample_rate'
+      ]);
+    });
+
+    it('nodejs', () => {
+      expect(getSettingKeysForAgent('nodejs')).toEqual([
+        'active',
+        'api_request_size',
+        'api_request_time',
+        'capture_body',
+        'capture_headers',
+        'log_level',
+        'server_timeout',
+        'stack_trace_limit',
+        'transaction_max_spans',
+        'transaction_sample_rate'
+      ]);
+    });
+
+    it('python', () => {
+      expect(getSettingKeysForAgent('python')).toEqual([
+        'api_request_size',
+        'api_request_time',
+        'capture_body',
+        'capture_headers',
+        'span_frames_min_duration',
+        'transaction_max_spans',
+        'transaction_sample_rate'
+      ]);
+    });
+
+    it('dotnet', () => {
+      expect(getSettingKeysForAgent('dotnet')).toEqual([
+        'capture_headers',
+        'log_level',
+        'span_frames_min_duration',
+        'stack_trace_limit',
+        'transaction_max_spans',
+        'transaction_sample_rate'
+      ]);
+    });
+
+    it('ruby', () => {
+      expect(getSettingKeysForAgent('ruby')).toEqual([
+        'active',
+        'api_request_size',
+        'api_request_time',
+        'capture_body',
+        'capture_headers',
+        'log_level',
+        'span_frames_min_duration',
+        'transaction_max_spans',
+        'transaction_sample_rate'
+      ]);
+    });
+
+    it('"All" services (no agent name)', () => {
+      expect(getSettingKeysForAgent(undefined)).toEqual([
+        'capture_headers',
+        'transaction_max_spans',
+        'transaction_sample_rate'
+      ]);
+    });
+  });
+});
+
+describe('settingDefinitions', () => {
+  it('should have correct default values', () => {
+    expect(
+      settingDefinitions.map(def => {
+        return {
+          ...omit(def, [
+            'category',
+            'defaultValue',
+            'description',
+            'excludeAgents',
+            'includeAgents',
+            'label',
+            'validation'
+          ]),
+          validationName: def.validation.name
+        };
+      })
+    ).toMatchSnapshot();
+  });
+});
+
+function getSettingKeysForAgent(agentName: AgentName | undefined) {
+  const definitions = settingDefinitions.filter(filterByAgent(agentName));
+  return definitions.map(def => def.key);
+}
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.ts b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.ts
new file mode 100644
index 0000000000000..8786a94be096d
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/index.ts
@@ -0,0 +1,113 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { sortBy } from 'lodash';
+import { isRight } from 'fp-ts/lib/Either';
+import { i18n } from '@kbn/i18n';
+import { AgentName } from '../../../typings/es_schemas/ui/fields/agent';
+import { booleanRt } from '../runtime_types/boolean_rt';
+import { integerRt } from '../runtime_types/integer_rt';
+import { isRumAgentName } from '../../agent_name';
+import { numberFloatRt } from '../runtime_types/number_float_rt';
+import { bytesRt, BYTE_UNITS } from '../runtime_types/bytes_rt';
+import { durationRt, DURATION_UNITS } from '../runtime_types/duration_rt';
+import { RawSettingDefinition, SettingDefinition } from './types';
+import { generalSettings } from './general_settings';
+import { javaSettings } from './java_settings';
+
+function getDefaultsByType(settingDefinition: RawSettingDefinition) {
+  switch (settingDefinition.type) {
+    case 'boolean':
+      return { validation: booleanRt };
+    case 'text':
+      return { validation: t.string };
+    case 'integer':
+      return {
+        validation: integerRt,
+        validationError: i18n.translate(
+          'xpack.apm.agentConfig.integer.errorText',
+          { defaultMessage: 'Must be an integer' }
+        )
+      };
+    case 'float':
+      return {
+        validation: numberFloatRt,
+        validationError: i18n.translate(
+          'xpack.apm.agentConfig.float.errorText',
+          { defaultMessage: 'Must be a number between 0.000 and 1' }
+        )
+      };
+    case 'bytes':
+      return {
+        validation: bytesRt,
+        units: BYTE_UNITS,
+        validationError: i18n.translate(
+          'xpack.apm.agentConfig.bytes.errorText',
+          { defaultMessage: 'Please specify an integer and a unit' }
+        )
+      };
+    case 'duration':
+      return {
+        validation: durationRt,
+        units: DURATION_UNITS,
+        validationError: i18n.translate(
+          'xpack.apm.agentConfig.bytes.errorText',
+          { defaultMessage: 'Please specify an integer and a unit' }
+        )
+      };
+  }
+}
+
+export function filterByAgent(agentName?: AgentName) {
+  return (setting: SettingDefinition) => {
+    // agentName is missing if "All" was selected
+    if (!agentName) {
+      // options that only apply to certain agents will be filtered out
+      if (setting.includeAgents) {
+        return false;
+      }
+
+      // only options that apply to every agent (ignoring RUM) should be returned
+      if (setting.excludeAgents) {
+        return setting.excludeAgents.every(isRumAgentName);
+      }
+
+      return true;
+    }
+
+    if (setting.includeAgents) {
+      return setting.includeAgents.includes(agentName);
+    }
+
+    if (setting.excludeAgents) {
+      return !setting.excludeAgents.includes(agentName);
+    }
+
+    return true;
+  };
+}
+
+export function isValid(setting: SettingDefinition, value: unknown) {
+  return isRight(setting.validation.decode(value));
+}
+
+export const settingDefinitions = sortBy(
+  [...generalSettings, ...javaSettings].map(def => {
+    const defWithDefaults = {
+      ...getDefaultsByType(def),
+      ...def
+    };
+
+    // ensure every option has validation
+    if (!defWithDefaults.validation) {
+      throw new Error(`Missing validation for ${def.key}`);
+    }
+
+    return defWithDefaults as SettingDefinition;
+  }),
+  'key'
+);
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/java_settings.ts b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/java_settings.ts
new file mode 100644
index 0000000000000..1a480c131e853
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/java_settings.ts
@@ -0,0 +1,256 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { RawSettingDefinition } from './types';
+
+export const javaSettings: RawSettingDefinition[] = [
+  // ENABLE_LOG_CORRELATION
+  {
+    key: 'enable_log_correlation',
+    type: 'boolean',
+    defaultValue: 'false',
+    label: i18n.translate('xpack.apm.agentConfig.enableLogCorrelation.label', {
+      defaultMessage: 'Enable log correlation'
+    }),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.enableLogCorrelation.description',
+      {
+        defaultMessage:
+          "A boolean specifying if the agent should integrate into SLF4J's https://www.slf4j.org/api/org/slf4j/MDC.html[MDC] to enable trace-log correlation.\nIf set to `true`, the agent will set the `trace.id` and `transaction.id` for the currently active spans and transactions to the MDC.\nSee <<log-correlation>> for more details.\n\nNOTE: While it's allowed to enable this setting at runtime, you can't disable it without a restart."
+      }
+    ),
+    includeAgents: ['java']
+  },
+
+  // TRACE_METHODS_DURATION_THRESHOLD
+  {
+    key: 'trace_methods_duration_threshold',
+    type: 'integer',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.traceMethodsDurationThreshold.label',
+      {
+        defaultMessage: 'Trace methods duration threshold'
+      }
+    ),
+    description: i18n.translate(
+      'xpack.apm.agentConfig.traceMethodsDurationThreshold.description',
+      {
+        defaultMessage:
+          'If trace_methods config option is set, provides a threshold to limit spans based on duration. When set to a value greater than 0, spans representing methods traced based on trace_methods will be discarded by default.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+
+  /*
+   * Circuit-Breaker
+   **/
+  {
+    key: 'circuit_breaker_enabled',
+    label: i18n.translate('xpack.apm.agentConfig.circuitBreakerEnabled.label', {
+      defaultMessage: 'Cirtcuit breaker enabled'
+    }),
+    type: 'boolean',
+    category: 'Circuit-Breaker',
+    defaultValue: 'false',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.circuitBreakerEnabled.description',
+      {
+        defaultMessage:
+          'A boolean specifying whether the circuit breaker should be enabled or not. \nWhen enabled, the agent periodically polls stress monitors to detect system/process/JVM stress state. \nIf ANY of the monitors detects a stress indication, the agent will become inactive, as if the \n<<config-active>> configuration option has been set to `false`, thus reducing resource consumption to a minimum. \nWhen inactive, the agent continues polling the same monitors in order to detect whether the stress state \nhas been relieved. If ALL monitors approve that the system/process/JVM is not under stress anymore, the \nagent will resume and become fully functional.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+  {
+    key: 'stress_monitor_gc_stress_threshold',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorGcStressThreshold.label',
+      { defaultMessage: 'Stress monitor gc stress threshold' }
+    ),
+    type: 'boolean',
+    category: 'Circuit-Breaker',
+    defaultValue: '0.95',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorGcStressThreshold.description',
+      {
+        defaultMessage:
+          'The threshold used by the GC monitor to rely on for identifying heap stress.\nThe same threshold will be used for all heap pools, so that if ANY has a usage percentage that crosses it, \nthe agent will consider it as a heap stress. The GC monitor relies only on memory consumption measured \nafter a recent GC.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+  {
+    key: 'stress_monitor_gc_relief_threshold',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorGcReliefThreshold.label',
+      { defaultMessage: 'Stress monitor gc relief threshold' }
+    ),
+
+    type: 'float',
+    category: 'Circuit-Breaker',
+    defaultValue: '0.75',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorGcReliefThreshold.description',
+      {
+        defaultMessage:
+          'The threshold used by the GC monitor to rely on for identifying when the heap is not under stress .\nIf `stress_monitor_gc_stress_threshold` has been crossed, the agent will consider it a heap-stress state. \nIn order to determine that the stress state is over, percentage of occupied memory in ALL heap pools should \nbe lower than this threshold. The GC monitor relies only on memory consumption measured after a recent GC.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+  {
+    key: 'stress_monitor_cpu_duration_threshold',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorCpuDurationThreshold.label',
+      { defaultMessage: 'Stress monitor cpu duration threshold' }
+    ),
+    type: 'duration',
+    category: 'Circuit-Breaker',
+    defaultValue: '1m',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorCpuDurationThreshold.description',
+      {
+        defaultMessage:
+          'The minimal time required in order to determine whether the system is \neither currently under stress, or that the stress detected previously has been relieved. \nAll measurements during this time must be consistent in comparison to the relevant threshold in \norder to detect a change of stress state. Must be at least `1m`.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+  {
+    key: 'stress_monitor_system_cpu_stress_threshold',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorSystemCpuStressThreshold.label',
+      { defaultMessage: 'Stress monitor system cpu stress threshold' }
+    ),
+    type: 'float',
+    category: 'Circuit-Breaker',
+    defaultValue: '0.95',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorSystemCpuStressThreshold.description',
+      {
+        defaultMessage:
+          'The threshold used by the system CPU monitor to detect system CPU stress. \nIf the system CPU crosses this threshold for a duration of at least `stress_monitor_cpu_duration_threshold`, \nthe monitor considers this as a stress state.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+  {
+    key: 'stress_monitor_system_cpu_relief_threshold',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorSystemCpuReliefThreshold.label',
+      { defaultMessage: 'Stress monitor system cpu relief threshold' }
+    ),
+    type: 'float',
+    category: 'Circuit-Breaker',
+    defaultValue: '0.8',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.stressMonitorSystemCpuReliefThreshold.description',
+      {
+        defaultMessage:
+          'The threshold used by the system CPU monitor to determine that the system is \nnot under CPU stress. If the monitor detected a CPU stress, the measured system CPU needs to be below \nthis threshold for a duration of at least `stress_monitor_cpu_duration_threshold` in order for the \nmonitor to decide that the CPU stress has been relieved.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+
+  /*
+   * Profiling
+   **/
+
+  {
+    key: 'profiling_inferred_spans_enabled',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansEnabled.label',
+      { defaultMessage: 'Profiling inferred spans enabled' }
+    ),
+    type: 'boolean',
+    category: 'Profiling',
+    defaultValue: 'false',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansEnabled.description',
+      {
+        defaultMessage:
+          'Set to `true` to make the agent create spans for method executions based on\nhttps://github.com/jvm-profiling-tools/async-profiler[async-profiler], a sampling aka statistical profiler.\n\nDue to the nature of how sampling profilers work,\nthe duration of the inferred spans are not exact, but only estimations.\nThe <<config-profiling-inferred-spans-sampling-interval, `profiling_inferred_spans_sampling_interval`>> lets you fine tune the trade-off between accuracy and overhead.\n\nThe inferred spans are created after a profiling session has ended.\nThis means there is a delay between the regular and the inferred spans being visible in the UI.\n\nNOTE: This feature is not available on Windows'
+      }
+    ),
+    includeAgents: ['java']
+  },
+  {
+    key: 'profiling_inferred_spans_sampling_interval',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansSamplingInterval.label',
+      { defaultMessage: 'Profiling inferred spans sampling interval' }
+    ),
+    type: 'duration',
+    category: 'Profiling',
+    defaultValue: '50ms',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansSamplingInterval.description',
+      {
+        defaultMessage:
+          'The frequency at which stack traces are gathered within a profiling session.\nThe lower you set it, the more accurate the durations will be.\nThis comes at the expense of higher overhead and more spans for potentially irrelevant operations.\nThe minimal duration of a profiling-inferred span is the same as the value of this setting.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+  {
+    key: 'profiling_inferred_spans_min_duration',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansMinDuration.label',
+      { defaultMessage: 'Profiling inferred spans min duration' }
+    ),
+    type: 'duration',
+    category: 'Profiling',
+    defaultValue: '0ms',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansMinDuration.description',
+      {
+        defaultMessage:
+          'The minimum duration of an inferred span.\nNote that the min duration is also implicitly set by the sampling interval.\nHowever, increasing the sampling interval also decreases the accuracy of the duration of inferred spans.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+  {
+    key: 'profiling_inferred_spans_included_classes',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansIncludedClasses.label',
+      { defaultMessage: 'Profiling inferred spans included classes' }
+    ),
+    type: 'text',
+    category: 'Profiling',
+    defaultValue: '*',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansIncludedClasses.description',
+      {
+        defaultMessage:
+          'If set, the agent will only create inferred spans for methods which match this list.\nSetting a value may slightly increase performance and can reduce clutter by only creating spans for the classes you are interested in.\nExample: `org.example.myapp.*`\n\nThis option supports the wildcard `*`, which matches zero or more characters.\nExamples: `/foo/*/bar/*/baz*`, `*foo*`.\nMatching is case insensitive by default.\nPrepending an element with `(?-i)` makes the matching case sensitive.'
+      }
+    ),
+    includeAgents: ['java']
+  },
+  {
+    key: 'profiling_inferred_spans_excluded_classes',
+    label: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansExcludedClasses.label',
+      { defaultMessage: 'Profiling inferred spans excluded classes' }
+    ),
+    type: 'text',
+    category: 'Profiling',
+    defaultValue:
+      '(?-i)java.*,(?-i)javax.*,(?-i)sun.*,(?-i)com.sun.*,(?-i)jdk.*,(?-i)org.apache.tomcat.*,(?-i)org.apache.catalina.*,(?-i)org.apache.coyote.*,(?-i)org.jboss.as.*,(?-i)org.glassfish.*,(?-i)org.eclipse.jetty.*,(?-i)com.ibm.websphere.*,(?-i)io.undertow.*',
+    description: i18n.translate(
+      'xpack.apm.agentConfig.profilingInferredSpansExcludedClasses.description',
+      {
+        defaultMessage:
+          'Excludes classes for which no profiler-inferred spans should be created.\n\nThis option supports the wildcard `*`, which matches zero or more characters.\nExamples: `/foo/*/bar/*/baz*`, `*foo*`.\nMatching is case insensitive by default.\nPrepending an element with `(?-i)` makes the matching case sensitive.'
+      }
+    ),
+    includeAgents: ['java']
+  }
+];
diff --git a/x-pack/plugins/apm/common/agent_configuration/setting_definitions/types.d.ts b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/types.d.ts
new file mode 100644
index 0000000000000..6b584fc7e2048
--- /dev/null
+++ b/x-pack/plugins/apm/common/agent_configuration/setting_definitions/types.d.ts
@@ -0,0 +1,107 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as t from 'io-ts';
+import { AgentName } from '../../../typings/es_schemas/ui/fields/agent';
+
+interface BaseSetting {
+  /**
+   * UI: unique key to identify setting
+   */
+  key: string;
+
+  /**
+   * UI: Human readable name of setting
+   */
+  label: string;
+
+  /**
+   * UI: Human readable name of setting
+   * Not used yet
+   */
+  category?: string;
+
+  /**
+   * UI:
+   */
+  defaultValue?: string;
+
+  /**
+   * UI: description of setting
+   */
+  description: string;
+
+  /**
+   * UI: placeholder to show in input field
+   */
+  placeholder?: string;
+
+  /**
+   * runtime validation of the input
+   */
+  validation?: t.Type<any, string, unknown>;
+
+  /**
+   * UI: error shown when the runtime validation fails
+   */
+  validationError?: string;
+
+  /**
+   * Limits the setting to no agents, except those specified in `includeAgents`
+   */
+  includeAgents?: AgentName[];
+
+  /**
+   * Limits the setting to all agents, except those specified in `excludeAgents`
+   */
+  excludeAgents?: AgentName[];
+}
+
+interface TextSetting extends BaseSetting {
+  type: 'text';
+}
+
+interface IntegerSetting extends BaseSetting {
+  type: 'integer';
+  min?: number;
+  max?: number;
+}
+
+interface FloatSetting extends BaseSetting {
+  type: 'float';
+}
+
+interface SelectSetting extends BaseSetting {
+  type: 'select';
+  options: Array<{ text: string }>;
+}
+
+interface BooleanSetting extends BaseSetting {
+  type: 'boolean';
+}
+
+interface BytesSetting extends BaseSetting {
+  type: 'bytes';
+  units?: string[];
+}
+
+interface DurationSetting extends BaseSetting {
+  type: 'duration';
+  units?: string[];
+}
+
+export type RawSettingDefinition =
+  | TextSetting
+  | FloatSetting
+  | IntegerSetting
+  | SelectSetting
+  | BooleanSetting
+  | BytesSetting
+  | DurationSetting;
+
+export type SettingDefinition = RawSettingDefinition & {
+  validation: NonNullable<RawSettingDefinition['validation']>;
+};
diff --git a/x-pack/plugins/apm/common/agent_name.ts b/x-pack/plugins/apm/common/agent_name.ts
index bb68eb88b8e18..085828b729ea5 100644
--- a/x-pack/plugins/apm/common/agent_name.ts
+++ b/x-pack/plugins/apm/common/agent_name.ts
@@ -4,36 +4,40 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { AgentName } from '../typings/es_schemas/ui/fields/agent';
+
 /*
  * Agent names can be any string. This list only defines the official agents
  * that we might want to target specifically eg. linking to their documentation
  * & telemetry reporting. Support additional agent types by appending
  * definitions in mappings.json (for telemetry), the AgentName type, and the
- * agentNames object.
+ * AGENT_NAMES array.
  */
-import { AgentName } from '../typings/es_schemas/ui/fields/agent';
 
-const agentNames: { [agentName in AgentName]: agentName } = {
-  python: 'python',
-  java: 'java',
-  nodejs: 'nodejs',
-  'js-base': 'js-base',
-  'rum-js': 'rum-js',
-  dotnet: 'dotnet',
-  ruby: 'ruby',
-  go: 'go'
-};
+export const AGENT_NAMES: AgentName[] = [
+  'java',
+  'js-base',
+  'rum-js',
+  'dotnet',
+  'go',
+  'java',
+  'nodejs',
+  'python',
+  'ruby'
+];
 
-export function isAgentName(agentName: string): boolean {
-  return Object.values(agentNames).includes(agentName as AgentName);
+export function isAgentName(agentName: string): agentName is AgentName {
+  return AGENT_NAMES.includes(agentName as AgentName);
 }
 
-export function isRumAgentName(agentName: string | undefined) {
-  return (
-    agentName === agentNames['js-base'] || agentName === agentNames['rum-js']
-  );
+export function isRumAgentName(
+  agentName: string | undefined
+): agentName is 'js-base' | 'rum-js' {
+  return agentName === 'js-base' || agentName === 'rum-js';
 }
 
-export function isJavaAgentName(agentName: string | undefined) {
-  return agentName === agentNames.java;
+export function isJavaAgentName(
+  agentName: string | undefined
+): agentName is 'java' {
+  return agentName === 'java';
 }
diff --git a/x-pack/plugins/apm/common/alert_types.ts b/x-pack/plugins/apm/common/alert_types.ts
new file mode 100644
index 0000000000000..51e1f88512965
--- /dev/null
+++ b/x-pack/plugins/apm/common/alert_types.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+
+export enum AlertType {
+  ErrorRate = 'apm.error_rate',
+  TransactionDuration = 'apm.transaction_duration'
+}
+
+export const ALERT_TYPES_CONFIG = {
+  [AlertType.ErrorRate]: {
+    name: i18n.translate('xpack.apm.errorRateAlert.name', {
+      defaultMessage: 'Error rate threshold'
+    }),
+    actionGroups: [
+      {
+        id: 'threshold_met',
+        name: i18n.translate('xpack.apm.errorRateAlert.thresholdMet', {
+          defaultMessage: 'Threshold met'
+        })
+      }
+    ],
+    defaultActionGroupId: 'threshold_met'
+  },
+  [AlertType.TransactionDuration]: {
+    name: i18n.translate('xpack.apm.transactionDurationAlert.name', {
+      defaultMessage: 'Transaction duration threshold'
+    }),
+    actionGroups: [
+      {
+        id: 'threshold_met',
+        name: i18n.translate(
+          'xpack.apm.transactionDurationAlert.thresholdMet',
+          {
+            defaultMessage: 'Threshold met'
+          }
+        )
+      }
+    ],
+    defaultActionGroupId: 'threshold_met'
+  }
+};
+
+export const TRANSACTION_ALERT_AGGREGATION_TYPES = {
+  avg: i18n.translate(
+    'xpack.apm.transactionDurationAlert.aggregationType.avg',
+    {
+      defaultMessage: 'Average'
+    }
+  ),
+  '95th': i18n.translate(
+    'xpack.apm.transactionDurationAlert.aggregationType.95th',
+    {
+      defaultMessage: '95th percentile'
+    }
+  ),
+  '99th': i18n.translate(
+    'xpack.apm.transactionDurationAlert.aggregationType.99th',
+    {
+      defaultMessage: '99th percentile'
+    }
+  )
+};
diff --git a/x-pack/plugins/apm/common/apm_saved_object_constants.ts b/x-pack/plugins/apm/common/apm_saved_object_constants.ts
index ac43b700117c6..0529d90fe940a 100644
--- a/x-pack/plugins/apm/common/apm_saved_object_constants.ts
+++ b/x-pack/plugins/apm/common/apm_saved_object_constants.ts
@@ -4,11 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-// APM Services telemetry
-export const APM_SERVICES_TELEMETRY_SAVED_OBJECT_TYPE =
-  'apm-services-telemetry';
-export const APM_SERVICES_TELEMETRY_SAVED_OBJECT_ID = 'apm-services-telemetry';
+// the types have to match the names of the saved object mappings
+// in /x-pack/legacy/plugins/apm/mappings.json
 
 // APM indices
 export const APM_INDICES_SAVED_OBJECT_TYPE = 'apm-indices';
 export const APM_INDICES_SAVED_OBJECT_ID = 'apm-indices';
+
+// APM telemetry
+export const APM_TELEMETRY_SAVED_OBJECT_TYPE = 'apm-telemetry';
+export const APM_TELEMETRY_SAVED_OBJECT_ID = 'apm-telemetry';
diff --git a/x-pack/plugins/apm/common/custom_link_filter_options.ts b/x-pack/plugins/apm/common/custom_link_filter_options.ts
new file mode 100644
index 0000000000000..32b19ad60a646
--- /dev/null
+++ b/x-pack/plugins/apm/common/custom_link_filter_options.ts
@@ -0,0 +1,28 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import * as t from 'io-ts';
+import {
+  SERVICE_NAME,
+  SERVICE_ENVIRONMENT,
+  TRANSACTION_TYPE,
+  TRANSACTION_NAME
+} from './elasticsearch_fieldnames';
+
+export const FilterOptionsRt = t.partial({
+  [SERVICE_NAME]: t.union([t.string, t.array(t.string)]),
+  [SERVICE_ENVIRONMENT]: t.union([t.string, t.array(t.string)]),
+  [TRANSACTION_NAME]: t.union([t.string, t.array(t.string)]),
+  [TRANSACTION_TYPE]: t.union([t.string, t.array(t.string)])
+});
+
+export type FilterOptions = t.TypeOf<typeof FilterOptionsRt>;
+
+export const FILTER_OPTIONS: ReadonlyArray<keyof FilterOptions> = [
+  SERVICE_NAME,
+  SERVICE_ENVIRONMENT,
+  TRANSACTION_TYPE,
+  TRANSACTION_NAME
+] as const;
diff --git a/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts b/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts
index 8516344794730..085662eec1efb 100644
--- a/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts
+++ b/x-pack/plugins/apm/common/elasticsearch_fieldnames.test.ts
@@ -14,7 +14,10 @@ describe('Transaction', () => {
   const transaction: Transaction = {
     '@timestamp': new Date().toString(),
     '@metadata': 'whatever',
-    observer: 'whatever',
+    observer: {
+      version: 'whatever',
+      version_major: 8
+    },
     agent: {
       name: 'java',
       version: 'agent version'
@@ -62,7 +65,10 @@ describe('Span', () => {
   const span: Span = {
     '@timestamp': new Date().toString(),
     '@metadata': 'whatever',
-    observer: 'whatever',
+    observer: {
+      version: 'whatever',
+      version_major: 8
+    },
     agent: {
       name: 'java',
       version: 'agent version'
@@ -106,7 +112,10 @@ describe('Span', () => {
 describe('Error', () => {
   const errorDoc: APMError = {
     '@metadata': 'whatever',
-    observer: 'whatever',
+    observer: {
+      version: 'whatever',
+      version_major: 8
+    },
     agent: {
       name: 'java',
       version: 'agent version'
diff --git a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
index 8f1b306a34eb0..bc1b346f50da7 100644
--- a/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
+++ b/x-pack/plugins/apm/common/elasticsearch_fieldnames.ts
@@ -4,15 +4,24 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export const AGENT_NAME = 'agent.name';
 export const SERVICE_NAME = 'service.name';
 export const SERVICE_ENVIRONMENT = 'service.environment';
 export const SERVICE_FRAMEWORK_NAME = 'service.framework.name';
+export const SERVICE_FRAMEWORK_VERSION = 'service.framework.version';
+export const SERVICE_LANGUAGE_NAME = 'service.language.name';
+export const SERVICE_LANGUAGE_VERSION = 'service.language.version';
+export const SERVICE_RUNTIME_NAME = 'service.runtime.name';
+export const SERVICE_RUNTIME_VERSION = 'service.runtime.version';
 export const SERVICE_NODE_NAME = 'service.node.name';
 export const SERVICE_VERSION = 'service.version';
+
+export const AGENT_NAME = 'agent.name';
+export const AGENT_VERSION = 'agent.version';
+
 export const URL_FULL = 'url.full';
 export const HTTP_REQUEST_METHOD = 'http.request.method';
 export const USER_ID = 'user.id';
+export const USER_AGENT_ORIGINAL = 'user_agent.original';
 export const USER_AGENT_NAME = 'user_agent.name';
 
 export const DESTINATION_ADDRESS = 'destination.address';
@@ -39,6 +48,8 @@ export const SPAN_SELF_TIME_SUM = 'span.self_time.sum.us';
 export const SPAN_ACTION = 'span.action';
 export const SPAN_NAME = 'span.name';
 export const SPAN_ID = 'span.id';
+export const SPAN_DESTINATION_SERVICE_RESOURCE =
+  'span.destination.service.resource';
 
 // Parent ID for a transaction or span
 export const PARENT_ID = 'parent.id';
diff --git a/x-pack/plugins/apm/common/runtime_types/agent_configuration_intake_rt/index.test.ts b/x-pack/plugins/apm/common/runtime_types/agent_configuration_intake_rt/index.test.ts
deleted file mode 100644
index 4c9dc78eb41e9..0000000000000
--- a/x-pack/plugins/apm/common/runtime_types/agent_configuration_intake_rt/index.test.ts
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { agentConfigurationIntakeRt } from './index';
-import { isRight } from 'fp-ts/lib/Either';
-
-describe('agentConfigurationIntakeRt', () => {
-  it('is valid when required parameters are given', () => {
-    const config = {
-      service: {},
-      settings: {}
-    };
-
-    expect(isConfigValid(config)).toBe(true);
-  });
-
-  it('is valid when required and optional parameters are given', () => {
-    const config = {
-      service: { name: 'my-service', environment: 'my-environment' },
-      settings: {
-        transaction_sample_rate: 0.5,
-        capture_body: 'foo',
-        transaction_max_spans: 10
-      }
-    };
-
-    expect(isConfigValid(config)).toBe(true);
-  });
-
-  it('is invalid when required parameters are not given', () => {
-    const config = {};
-    expect(isConfigValid(config)).toBe(false);
-  });
-});
-
-function isConfigValid(config: any) {
-  return isRight(agentConfigurationIntakeRt.decode(config));
-}
diff --git a/x-pack/plugins/apm/common/runtime_types/agent_configuration_intake_rt/index.ts b/x-pack/plugins/apm/common/runtime_types/agent_configuration_intake_rt/index.ts
deleted file mode 100644
index 32a2832b5eaf3..0000000000000
--- a/x-pack/plugins/apm/common/runtime_types/agent_configuration_intake_rt/index.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import * as t from 'io-ts';
-import { transactionSampleRateRt } from '../transaction_sample_rate_rt';
-import { transactionMaxSpansRt } from '../transaction_max_spans_rt';
-
-export const serviceRt = t.partial({
-  name: t.string,
-  environment: t.string
-});
-
-export const agentConfigurationIntakeRt = t.intersection([
-  t.partial({ agent_name: t.string }),
-  t.type({
-    service: serviceRt,
-    settings: t.partial({
-      transaction_sample_rate: transactionSampleRateRt,
-      capture_body: t.string,
-      transaction_max_spans: transactionMaxSpansRt
-    })
-  })
-]);
diff --git a/x-pack/plugins/apm/common/runtime_types/transaction_max_spans_rt/index.test.ts b/x-pack/plugins/apm/common/runtime_types/transaction_max_spans_rt/index.test.ts
deleted file mode 100644
index b62251b6974d9..0000000000000
--- a/x-pack/plugins/apm/common/runtime_types/transaction_max_spans_rt/index.test.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { transactionMaxSpansRt } from './index';
-import { isRight } from 'fp-ts/lib/Either';
-
-describe('transactionMaxSpans', () => {
-  it('does not accept empty values', () => {
-    expect(isRight(transactionMaxSpansRt.decode(undefined))).toBe(false);
-    expect(isRight(transactionMaxSpansRt.decode(null))).toBe(false);
-    expect(isRight(transactionMaxSpansRt.decode(''))).toBe(false);
-  });
-
-  it('accepts both strings and numbers as values', () => {
-    expect(isRight(transactionMaxSpansRt.decode('55'))).toBe(true);
-    expect(isRight(transactionMaxSpansRt.decode(55))).toBe(true);
-  });
-
-  it('checks if the number falls within 0, 32000', () => {
-    expect(isRight(transactionMaxSpansRt.decode(0))).toBe(true);
-    expect(isRight(transactionMaxSpansRt.decode(32000))).toBe(true);
-    expect(isRight(transactionMaxSpansRt.decode(-55))).toBe(false);
-    expect(isRight(transactionMaxSpansRt.decode(NaN))).toBe(false);
-  });
-});
diff --git a/x-pack/plugins/apm/common/runtime_types/transaction_max_spans_rt/index.ts b/x-pack/plugins/apm/common/runtime_types/transaction_max_spans_rt/index.ts
deleted file mode 100644
index 251161c21babe..0000000000000
--- a/x-pack/plugins/apm/common/runtime_types/transaction_max_spans_rt/index.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import * as t from 'io-ts';
-
-export const transactionMaxSpansRt = new t.Type<number, number, unknown>(
-  'transactionMaxSpans',
-  t.number.is,
-  (input, context) => {
-    const value = parseInt(input as string, 10);
-    return value >= 0 && value <= 32000
-      ? t.success(value)
-      : t.failure(input, context);
-  },
-  t.identity
-);
diff --git a/x-pack/plugins/apm/common/runtime_types/transaction_sample_rate_rt/index.test.ts b/x-pack/plugins/apm/common/runtime_types/transaction_sample_rate_rt/index.test.ts
deleted file mode 100644
index 6930a69f0870a..0000000000000
--- a/x-pack/plugins/apm/common/runtime_types/transaction_sample_rate_rt/index.test.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { transactionSampleRateRt } from './index';
-import { isRight } from 'fp-ts/lib/Either';
-
-describe('transactionSampleRateRt', () => {
-  it('does not accept empty values', () => {
-    expect(isRight(transactionSampleRateRt.decode(undefined))).toBe(false);
-    expect(isRight(transactionSampleRateRt.decode(null))).toBe(false);
-    expect(isRight(transactionSampleRateRt.decode(''))).toBe(false);
-  });
-
-  it('accepts both strings and numbers as values', () => {
-    expect(isRight(transactionSampleRateRt.decode('0.5'))).toBe(true);
-    expect(isRight(transactionSampleRateRt.decode(0.5))).toBe(true);
-  });
-
-  it('checks if the number falls within 0, 1', () => {
-    expect(isRight(transactionSampleRateRt.decode(0))).toBe(true);
-
-    expect(isRight(transactionSampleRateRt.decode(0.5))).toBe(true);
-
-    expect(isRight(transactionSampleRateRt.decode(-0.1))).toBe(false);
-    expect(isRight(transactionSampleRateRt.decode(1.1))).toBe(false);
-
-    expect(isRight(transactionSampleRateRt.decode(NaN))).toBe(false);
-  });
-
-  it('checks whether the number of decimals is 3', () => {
-    expect(isRight(transactionSampleRateRt.decode(1))).toBe(true);
-    expect(isRight(transactionSampleRateRt.decode(0.99))).toBe(true);
-    expect(isRight(transactionSampleRateRt.decode(0.999))).toBe(true);
-    expect(isRight(transactionSampleRateRt.decode(0.998))).toBe(true);
-  });
-});
diff --git a/x-pack/plugins/apm/common/runtime_types/transaction_sample_rate_rt/index.ts b/x-pack/plugins/apm/common/runtime_types/transaction_sample_rate_rt/index.ts
deleted file mode 100644
index 90c60d16f7b59..0000000000000
--- a/x-pack/plugins/apm/common/runtime_types/transaction_sample_rate_rt/index.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import * as t from 'io-ts';
-
-export const transactionSampleRateRt = new t.Type<number, number, unknown>(
-  'TransactionSampleRate',
-  t.number.is,
-  (input, context) => {
-    const value = parseFloat(input as string);
-    return value >= 0 && value <= 1 && parseFloat(value.toFixed(3)) === value
-      ? t.success(value)
-      : t.failure(input, context);
-  },
-  t.identity
-);
diff --git a/x-pack/plugins/apm/common/service_map.ts b/x-pack/plugins/apm/common/service_map.ts
index 8c749cd00bd32..4a8608199c037 100644
--- a/x-pack/plugins/apm/common/service_map.ts
+++ b/x-pack/plugins/apm/common/service_map.ts
@@ -8,12 +8,12 @@ import { i18n } from '@kbn/i18n';
 import { ILicense } from '../../licensing/public';
 import {
   AGENT_NAME,
-  DESTINATION_ADDRESS,
   SERVICE_ENVIRONMENT,
   SERVICE_FRAMEWORK_NAME,
   SERVICE_NAME,
   SPAN_SUBTYPE,
-  SPAN_TYPE
+  SPAN_TYPE,
+  SPAN_DESTINATION_SERVICE_RESOURCE
 } from './elasticsearch_fieldnames';
 
 export interface ServiceConnectionNode {
@@ -23,7 +23,7 @@ export interface ServiceConnectionNode {
   [AGENT_NAME]: string;
 }
 export interface ExternalConnectionNode {
-  [DESTINATION_ADDRESS]: string;
+  [SPAN_DESTINATION_SERVICE_RESOURCE]: string;
   [SPAN_TYPE]: string;
   [SPAN_SUBTYPE]: string;
 }
diff --git a/x-pack/plugins/apm/kibana.json b/x-pack/plugins/apm/kibana.json
index 96579377c95e8..7ffdb676c740f 100644
--- a/x-pack/plugins/apm/kibana.json
+++ b/x-pack/plugins/apm/kibana.json
@@ -3,8 +3,11 @@
   "server": true,
   "version": "8.0.0",
   "kibanaVersion": "kibana",
-  "configPath": ["xpack", "apm"],
+  "configPath": [
+    "xpack",
+    "apm"
+  ],
   "ui": false,
   "requiredPlugins": ["apm_oss", "data", "home", "licensing"],
-  "optionalPlugins": ["cloud", "usageCollection"]
+  "optionalPlugins": ["cloud", "usageCollection", "taskManager","actions", "alerting"]
 }
diff --git a/x-pack/plugins/apm/server/index.ts b/x-pack/plugins/apm/server/index.ts
index 8afdb9e99c1a3..77655568a7e9c 100644
--- a/x-pack/plugins/apm/server/index.ts
+++ b/x-pack/plugins/apm/server/index.ts
@@ -29,7 +29,8 @@ export const config = {
       enabled: schema.boolean({ defaultValue: true }),
       transactionGroupBucketSize: schema.number({ defaultValue: 100 }),
       maxTraceItems: schema.number({ defaultValue: 1000 })
-    })
+    }),
+    telemetryCollectionEnabled: schema.boolean({ defaultValue: true })
   })
 };
 
@@ -62,7 +63,8 @@ export function mergeConfigs(
     'xpack.apm.ui.maxTraceItems': apmConfig.ui.maxTraceItems,
     'xpack.apm.ui.transactionGroupBucketSize':
       apmConfig.ui.transactionGroupBucketSize,
-    'xpack.apm.autocreateApmIndexPattern': apmConfig.autocreateApmIndexPattern
+    'xpack.apm.autocreateApmIndexPattern': apmConfig.autocreateApmIndexPattern,
+    'xpack.apm.telemetryCollectionEnabled': apmConfig.telemetryCollectionEnabled
   };
 }
 
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts b/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts
new file mode 100644
index 0000000000000..cb3dd761040da
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/alerts/register_apm_alerts.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Observable } from 'rxjs';
+import { AlertingPlugin } from '../../../../alerting/server';
+import { ActionsPlugin } from '../../../../actions/server';
+import { registerTransactionDurationAlertType } from './register_transaction_duration_alert_type';
+import { registerErrorRateAlertType } from './register_error_rate_alert_type';
+import { APMConfig } from '../..';
+
+interface Params {
+  alerting: AlertingPlugin['setup'];
+  actions: ActionsPlugin['setup'];
+  config$: Observable<APMConfig>;
+}
+
+export function registerApmAlerts(params: Params) {
+  registerTransactionDurationAlertType({
+    alerting: params.alerting,
+    config$: params.config$
+  });
+  registerErrorRateAlertType({
+    alerting: params.alerting,
+    config$: params.config$
+  });
+}
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_error_rate_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_error_rate_alert_type.ts
new file mode 100644
index 0000000000000..187a75d0b61f2
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/alerts/register_error_rate_alert_type.ts
@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema, TypeOf } from '@kbn/config-schema';
+import { Observable } from 'rxjs';
+import { take } from 'rxjs/operators';
+import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
+import {
+  ESSearchResponse,
+  ESSearchRequest
+} from '../../../typings/elasticsearch';
+import {
+  PROCESSOR_EVENT,
+  SERVICE_NAME
+} from '../../../common/elasticsearch_fieldnames';
+import { AlertingPlugin } from '../../../../alerting/server';
+import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
+import { APMConfig } from '../..';
+
+interface RegisterAlertParams {
+  alerting: AlertingPlugin['setup'];
+  config$: Observable<APMConfig>;
+}
+
+const paramsSchema = schema.object({
+  serviceName: schema.string(),
+  windowSize: schema.number(),
+  windowUnit: schema.string(),
+  threshold: schema.number()
+});
+
+const alertTypeConfig = ALERT_TYPES_CONFIG[AlertType.ErrorRate];
+
+export function registerErrorRateAlertType({
+  alerting,
+  config$
+}: RegisterAlertParams) {
+  alerting.registerType({
+    id: AlertType.ErrorRate,
+    name: alertTypeConfig.name,
+    actionGroups: alertTypeConfig.actionGroups,
+    defaultActionGroupId: alertTypeConfig.defaultActionGroupId,
+    validate: {
+      params: paramsSchema
+    },
+
+    executor: async ({ services, params }) => {
+      const config = await config$.pipe(take(1)).toPromise();
+
+      const alertParams = params as TypeOf<typeof paramsSchema>;
+
+      const indices = await getApmIndices({
+        config,
+        savedObjectsClient: services.savedObjectsClient
+      });
+
+      const searchParams = {
+        index: indices['apm_oss.errorIndices'],
+        size: 0,
+        body: {
+          query: {
+            bool: {
+              filter: [
+                {
+                  range: {
+                    '@timestamp': {
+                      gte: `now-${alertParams.windowSize}${alertParams.windowUnit}`
+                    }
+                  }
+                },
+                {
+                  term: {
+                    [PROCESSOR_EVENT]: 'error'
+                  }
+                },
+                {
+                  term: {
+                    [SERVICE_NAME]: alertParams.serviceName
+                  }
+                }
+              ]
+            }
+          },
+          track_total_hits: true
+        }
+      };
+
+      const response: ESSearchResponse<
+        unknown,
+        ESSearchRequest
+      > = await services.callCluster('search', searchParams);
+
+      const value = response.hits.total.value;
+
+      if (value && value > alertParams.threshold) {
+        const alertInstance = services.alertInstanceFactory(
+          AlertType.ErrorRate
+        );
+        alertInstance.scheduleActions(alertTypeConfig.defaultActionGroupId);
+      }
+
+      return {};
+    }
+  });
+}
diff --git a/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
new file mode 100644
index 0000000000000..7575a8268bc26
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_alert_type.ts
@@ -0,0 +1,140 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema, TypeOf } from '@kbn/config-schema';
+import { Observable } from 'rxjs';
+import { take } from 'rxjs/operators';
+import { AlertType, ALERT_TYPES_CONFIG } from '../../../common/alert_types';
+import { ESSearchResponse } from '../../../typings/elasticsearch';
+import {
+  PROCESSOR_EVENT,
+  SERVICE_NAME,
+  TRANSACTION_TYPE,
+  TRANSACTION_DURATION
+} from '../../../common/elasticsearch_fieldnames';
+import { AlertingPlugin } from '../../../../alerting/server';
+import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
+import { APMConfig } from '../..';
+
+interface RegisterAlertParams {
+  alerting: AlertingPlugin['setup'];
+  config$: Observable<APMConfig>;
+}
+
+const paramsSchema = schema.object({
+  serviceName: schema.string(),
+  transactionType: schema.string(),
+  windowSize: schema.number(),
+  windowUnit: schema.string(),
+  threshold: schema.number(),
+  aggregationType: schema.oneOf([
+    schema.literal('avg'),
+    schema.literal('95th'),
+    schema.literal('99th')
+  ])
+});
+
+const alertTypeConfig = ALERT_TYPES_CONFIG[AlertType.TransactionDuration];
+
+export function registerTransactionDurationAlertType({
+  alerting,
+  config$
+}: RegisterAlertParams) {
+  alerting.registerType({
+    id: AlertType.TransactionDuration,
+    name: alertTypeConfig.name,
+    actionGroups: alertTypeConfig.actionGroups,
+    defaultActionGroupId: alertTypeConfig.defaultActionGroupId,
+    validate: {
+      params: paramsSchema
+    },
+
+    executor: async ({ services, params }) => {
+      const config = await config$.pipe(take(1)).toPromise();
+
+      const alertParams = params as TypeOf<typeof paramsSchema>;
+
+      const indices = await getApmIndices({
+        config,
+        savedObjectsClient: services.savedObjectsClient
+      });
+
+      const searchParams = {
+        index: indices['apm_oss.transactionIndices'],
+        size: 0,
+        body: {
+          query: {
+            bool: {
+              filter: [
+                {
+                  range: {
+                    '@timestamp': {
+                      gte: `now-${alertParams.windowSize}${alertParams.windowUnit}`
+                    }
+                  }
+                },
+                {
+                  term: {
+                    [PROCESSOR_EVENT]: 'transaction'
+                  }
+                },
+                {
+                  term: {
+                    [SERVICE_NAME]: alertParams.serviceName
+                  }
+                },
+                {
+                  term: {
+                    [TRANSACTION_TYPE]: alertParams.transactionType
+                  }
+                }
+              ]
+            }
+          },
+          aggs: {
+            agg:
+              alertParams.aggregationType === 'avg'
+                ? {
+                    avg: {
+                      field: TRANSACTION_DURATION
+                    }
+                  }
+                : {
+                    percentiles: {
+                      field: TRANSACTION_DURATION,
+                      percents: [
+                        alertParams.aggregationType === '95th' ? 95 : 99
+                      ]
+                    }
+                  }
+          }
+        }
+      };
+
+      const response: ESSearchResponse<
+        unknown,
+        typeof searchParams
+      > = await services.callCluster('search', searchParams);
+
+      if (!response.aggregations) {
+        return;
+      }
+
+      const { agg } = response.aggregations;
+
+      const value = 'values' in agg ? agg.values[0] : agg.value;
+
+      if (value && value > alertParams.threshold * 1000) {
+        const alertInstance = services.alertInstanceFactory(
+          AlertType.TransactionDuration
+        );
+        alertInstance.scheduleActions(alertTypeConfig.defaultActionGroupId);
+      }
+
+      return {};
+    }
+  });
+}
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/__test__/index.test.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/__test__/index.test.ts
deleted file mode 100644
index c45c74a791aee..0000000000000
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/__test__/index.test.ts
+++ /dev/null
@@ -1,83 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { SavedObjectAttributes } from '../../../../../../../src/core/server';
-import { createApmTelementry, storeApmServicesTelemetry } from '../index';
-import {
-  APM_SERVICES_TELEMETRY_SAVED_OBJECT_TYPE,
-  APM_SERVICES_TELEMETRY_SAVED_OBJECT_ID
-} from '../../../../common/apm_saved_object_constants';
-
-describe('apm_telemetry', () => {
-  describe('createApmTelementry', () => {
-    it('should create a ApmTelemetry object with boolean flag and frequency map of the given list of AgentNames', () => {
-      const apmTelemetry = createApmTelementry([
-        'go',
-        'nodejs',
-        'go',
-        'js-base'
-      ]);
-      expect(apmTelemetry.has_any_services).toBe(true);
-      expect(apmTelemetry.services_per_agent).toMatchObject({
-        go: 2,
-        nodejs: 1,
-        'js-base': 1
-      });
-    });
-    it('should ignore undefined or unknown AgentName values', () => {
-      const apmTelemetry = createApmTelementry([
-        'go',
-        'nodejs',
-        'go',
-        'js-base',
-        'example-platform' as any,
-        undefined as any
-      ]);
-      expect(apmTelemetry.services_per_agent).toMatchObject({
-        go: 2,
-        nodejs: 1,
-        'js-base': 1
-      });
-    });
-  });
-
-  describe('storeApmServicesTelemetry', () => {
-    let apmTelemetry: SavedObjectAttributes;
-    let savedObjectsClient: any;
-
-    beforeEach(() => {
-      apmTelemetry = {
-        has_any_services: true,
-        services_per_agent: {
-          go: 2,
-          nodejs: 1,
-          'js-base': 1
-        }
-      };
-      savedObjectsClient = { create: jest.fn() };
-    });
-
-    it('should call savedObjectsClient create with the given ApmTelemetry object', () => {
-      storeApmServicesTelemetry(savedObjectsClient, apmTelemetry);
-      expect(savedObjectsClient.create.mock.calls[0][1]).toBe(apmTelemetry);
-    });
-
-    it('should call savedObjectsClient create with the apm-telemetry document type and ID', () => {
-      storeApmServicesTelemetry(savedObjectsClient, apmTelemetry);
-      expect(savedObjectsClient.create.mock.calls[0][0]).toBe(
-        APM_SERVICES_TELEMETRY_SAVED_OBJECT_TYPE
-      );
-      expect(savedObjectsClient.create.mock.calls[0][2].id).toBe(
-        APM_SERVICES_TELEMETRY_SAVED_OBJECT_ID
-      );
-    });
-
-    it('should call savedObjectsClient create with overwrite: true', () => {
-      storeApmServicesTelemetry(savedObjectsClient, apmTelemetry);
-      expect(savedObjectsClient.create.mock.calls[0][2].overwrite).toBe(true);
-    });
-  });
-});
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/index.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/index.ts
new file mode 100644
index 0000000000000..729ccb73d73f3
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/index.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { merge } from 'lodash';
+import { Logger, CallAPIOptions } from 'kibana/server';
+import { IndicesStatsParams, Client } from 'elasticsearch';
+import {
+  ESSearchRequest,
+  ESSearchResponse
+} from '../../../../typings/elasticsearch';
+import { ApmIndicesConfig } from '../../settings/apm_indices/get_apm_indices';
+import { tasks } from './tasks';
+import { APMDataTelemetry } from '../types';
+
+type TelemetryTaskExecutor = (params: {
+  indices: ApmIndicesConfig;
+  search<TSearchRequest extends ESSearchRequest>(
+    params: TSearchRequest
+  ): Promise<ESSearchResponse<unknown, TSearchRequest>>;
+  indicesStats(
+    params: IndicesStatsParams,
+    options?: CallAPIOptions
+  ): ReturnType<Client['indices']['stats']>;
+  transportRequest: (params: {
+    path: string;
+    method: 'get';
+  }) => Promise<unknown>;
+}) => Promise<APMDataTelemetry>;
+
+export interface TelemetryTask {
+  name: string;
+  executor: TelemetryTaskExecutor;
+}
+
+export type CollectTelemetryParams = Parameters<TelemetryTaskExecutor>[0] & {
+  logger: Logger;
+};
+
+export function collectDataTelemetry({
+  search,
+  indices,
+  logger,
+  indicesStats,
+  transportRequest
+}: CollectTelemetryParams) {
+  return tasks.reduce((prev, task) => {
+    return prev.then(async data => {
+      logger.debug(`Executing APM telemetry task ${task.name}`);
+      try {
+        const time = process.hrtime();
+        const next = await task.executor({
+          search,
+          indices,
+          indicesStats,
+          transportRequest
+        });
+        const took = process.hrtime(time);
+
+        return merge({}, data, next, {
+          tasks: {
+            [task.name]: {
+              took: {
+                ms: Math.round(took[0] * 1000 + took[1] / 1e6)
+              }
+            }
+          }
+        });
+      } catch (err) {
+        logger.warn(`Failed executing APM telemetry task ${task.name}`);
+        logger.warn(err);
+        return data;
+      }
+    });
+  }, Promise.resolve({} as APMDataTelemetry));
+}
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
new file mode 100644
index 0000000000000..415076b6ae116
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/collect_data_telemetry/tasks.ts
@@ -0,0 +1,725 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { flatten, merge, sortBy, sum } from 'lodash';
+import { AgentName } from '../../../../typings/es_schemas/ui/fields/agent';
+import { AGENT_NAMES } from '../../../../common/agent_name';
+import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
+import {
+  PROCESSOR_EVENT,
+  SERVICE_NAME,
+  AGENT_NAME,
+  AGENT_VERSION,
+  ERROR_GROUP_ID,
+  TRANSACTION_NAME,
+  PARENT_ID,
+  SERVICE_FRAMEWORK_NAME,
+  SERVICE_FRAMEWORK_VERSION,
+  SERVICE_LANGUAGE_NAME,
+  SERVICE_LANGUAGE_VERSION,
+  SERVICE_RUNTIME_NAME,
+  SERVICE_RUNTIME_VERSION,
+  USER_AGENT_ORIGINAL
+} from '../../../../common/elasticsearch_fieldnames';
+import { Span } from '../../../../typings/es_schemas/ui/span';
+import { APMError } from '../../../../typings/es_schemas/ui/apm_error';
+import { TelemetryTask } from '.';
+import { APMTelemetry } from '../types';
+
+const TIME_RANGES = ['1d', 'all'] as const;
+type TimeRange = typeof TIME_RANGES[number];
+
+export const tasks: TelemetryTask[] = [
+  {
+    name: 'processor_events',
+    executor: async ({ indices, search }) => {
+      const indicesByProcessorEvent = {
+        error: indices['apm_oss.errorIndices'],
+        metric: indices['apm_oss.metricsIndices'],
+        span: indices['apm_oss.spanIndices'],
+        transaction: indices['apm_oss.transactionIndices'],
+        onboarding: indices['apm_oss.onboardingIndices'],
+        sourcemap: indices['apm_oss.sourcemapIndices']
+      };
+
+      type ProcessorEvent = keyof typeof indicesByProcessorEvent;
+
+      const jobs: Array<{
+        processorEvent: ProcessorEvent;
+        timeRange: TimeRange;
+      }> = flatten(
+        (Object.keys(
+          indicesByProcessorEvent
+        ) as ProcessorEvent[]).map(processorEvent =>
+          TIME_RANGES.map(timeRange => ({ processorEvent, timeRange }))
+        )
+      );
+
+      const allData = await jobs.reduce((prevJob, current) => {
+        return prevJob.then(async data => {
+          const { processorEvent, timeRange } = current;
+
+          const response = await search({
+            index: indicesByProcessorEvent[processorEvent],
+            body: {
+              size: 1,
+              query: {
+                bool: {
+                  filter: [
+                    { term: { [PROCESSOR_EVENT]: processorEvent } },
+                    ...(timeRange !== 'all'
+                      ? [
+                          {
+                            range: {
+                              '@timestamp': {
+                                gte: `now-${timeRange}`
+                              }
+                            }
+                          }
+                        ]
+                      : [])
+                  ]
+                }
+              },
+              sort: {
+                '@timestamp': 'asc'
+              },
+              _source: ['@timestamp'],
+              track_total_hits: true
+            }
+          });
+
+          const event = response.hits.hits[0]?._source as {
+            '@timestamp': number;
+          };
+
+          return merge({}, data, {
+            counts: {
+              [processorEvent]: {
+                [timeRange]: response.hits.total.value
+              }
+            },
+            ...(timeRange === 'all' && event
+              ? {
+                  retainment: {
+                    [processorEvent]: {
+                      ms:
+                        new Date().getTime() -
+                        new Date(event['@timestamp']).getTime()
+                    }
+                  }
+                }
+              : {})
+          });
+        });
+      }, Promise.resolve({} as Record<string, { counts: Record<ProcessorEvent, Record<TimeRange, number>> }>));
+
+      return allData;
+    }
+  },
+  {
+    name: 'agent_configuration',
+    executor: async ({ indices, search }) => {
+      const agentConfigurationCount = (
+        await search({
+          index: indices.apmAgentConfigurationIndex,
+          body: {
+            size: 0,
+            track_total_hits: true
+          }
+        })
+      ).hits.total.value;
+
+      return {
+        counts: {
+          agent_configuration: {
+            all: agentConfigurationCount
+          }
+        }
+      };
+    }
+  },
+  {
+    name: 'services',
+    executor: async ({ indices, search }) => {
+      const servicesPerAgent = await AGENT_NAMES.reduce(
+        (prevJob, agentName) => {
+          return prevJob.then(async data => {
+            const response = await search({
+              index: [
+                indices['apm_oss.errorIndices'],
+                indices['apm_oss.spanIndices'],
+                indices['apm_oss.metricsIndices'],
+                indices['apm_oss.transactionIndices']
+              ],
+              body: {
+                size: 0,
+                query: {
+                  bool: {
+                    filter: [
+                      {
+                        term: {
+                          [AGENT_NAME]: agentName
+                        }
+                      },
+                      {
+                        range: {
+                          '@timestamp': {
+                            gte: 'now-1d'
+                          }
+                        }
+                      }
+                    ]
+                  }
+                },
+                aggs: {
+                  services: {
+                    cardinality: {
+                      field: SERVICE_NAME
+                    }
+                  }
+                }
+              }
+            });
+
+            return {
+              ...data,
+              [agentName]: response.aggregations?.services.value || 0
+            };
+          });
+        },
+        Promise.resolve({} as Record<AgentName, number>)
+      );
+
+      return {
+        has_any_services: sum(Object.values(servicesPerAgent)) > 0,
+        services_per_agent: servicesPerAgent
+      };
+    }
+  },
+  {
+    name: 'versions',
+    executor: async ({ search, indices }) => {
+      const response = await search({
+        index: [
+          indices['apm_oss.transactionIndices'],
+          indices['apm_oss.spanIndices'],
+          indices['apm_oss.errorIndices']
+        ],
+        terminateAfter: 1,
+        body: {
+          query: {
+            exists: {
+              field: 'observer.version'
+            }
+          },
+          size: 1,
+          sort: {
+            '@timestamp': 'desc'
+          }
+        }
+      });
+
+      const hit = response.hits.hits[0]?._source as Pick<
+        Transaction | Span | APMError,
+        'observer'
+      >;
+
+      if (!hit || !hit.observer?.version) {
+        return {};
+      }
+
+      const [major, minor, patch] = hit.observer.version
+        .split('.')
+        .map(part => Number(part));
+
+      return {
+        versions: {
+          apm_server: {
+            major,
+            minor,
+            patch
+          }
+        }
+      };
+    }
+  },
+  {
+    name: 'groupings',
+    executor: async ({ search, indices }) => {
+      const range1d = { range: { '@timestamp': { gte: 'now-1d' } } };
+      const errorGroupsCount = (
+        await search({
+          index: indices['apm_oss.errorIndices'],
+          body: {
+            size: 0,
+            query: {
+              bool: {
+                filter: [{ term: { [PROCESSOR_EVENT]: 'error' } }, range1d]
+              }
+            },
+            aggs: {
+              top_service: {
+                terms: {
+                  field: SERVICE_NAME,
+                  order: {
+                    error_groups: 'desc'
+                  },
+                  size: 1
+                },
+                aggs: {
+                  error_groups: {
+                    cardinality: {
+                      field: ERROR_GROUP_ID
+                    }
+                  }
+                }
+              }
+            }
+          }
+        })
+      ).aggregations?.top_service.buckets[0]?.error_groups.value;
+
+      const transactionGroupsCount = (
+        await search({
+          index: indices['apm_oss.transactionIndices'],
+          body: {
+            size: 0,
+            query: {
+              bool: {
+                filter: [
+                  { term: { [PROCESSOR_EVENT]: 'transaction' } },
+                  range1d
+                ]
+              }
+            },
+            aggs: {
+              top_service: {
+                terms: {
+                  field: SERVICE_NAME,
+                  order: {
+                    transaction_groups: 'desc'
+                  },
+                  size: 1
+                },
+                aggs: {
+                  transaction_groups: {
+                    cardinality: {
+                      field: TRANSACTION_NAME
+                    }
+                  }
+                }
+              }
+            }
+          }
+        })
+      ).aggregations?.top_service.buckets[0]?.transaction_groups.value;
+
+      const tracesPerDayCount = (
+        await search({
+          index: indices['apm_oss.transactionIndices'],
+          body: {
+            query: {
+              bool: {
+                filter: [
+                  { term: { [PROCESSOR_EVENT]: 'transaction' } },
+                  range1d
+                ],
+                must_not: {
+                  exists: { field: PARENT_ID }
+                }
+              }
+            },
+            track_total_hits: true,
+            size: 0
+          }
+        })
+      ).hits.total.value;
+
+      const servicesCount = (
+        await search({
+          index: [
+            indices['apm_oss.transactionIndices'],
+            indices['apm_oss.errorIndices'],
+            indices['apm_oss.metricsIndices']
+          ],
+          body: {
+            size: 0,
+            query: {
+              bool: {
+                filter: [range1d]
+              }
+            },
+            aggs: {
+              service_name: {
+                cardinality: {
+                  field: SERVICE_NAME
+                }
+              }
+            }
+          }
+        })
+      ).aggregations?.service_name.value;
+
+      return {
+        counts: {
+          max_error_groups_per_service: {
+            '1d': errorGroupsCount || 0
+          },
+          max_transaction_groups_per_service: {
+            '1d': transactionGroupsCount || 0
+          },
+          traces: {
+            '1d': tracesPerDayCount || 0
+          },
+          services: {
+            '1d': servicesCount || 0
+          }
+        }
+      };
+    }
+  },
+  {
+    name: 'integrations',
+    executor: async ({ transportRequest }) => {
+      const apmJobs = ['*-high_mean_response_time'];
+
+      const response = (await transportRequest({
+        method: 'get',
+        path: `/_ml/anomaly_detectors/${apmJobs.join(',')}`
+      })) as { data?: { count: number } };
+
+      return {
+        integrations: {
+          ml: {
+            all_jobs_count: response.data?.count ?? 0
+          }
+        }
+      };
+    }
+  },
+  {
+    name: 'agents',
+    executor: async ({ search, indices }) => {
+      const size = 3;
+
+      const agentData = await AGENT_NAMES.reduce(async (prevJob, agentName) => {
+        const data = await prevJob;
+
+        const response = await search({
+          index: [
+            indices['apm_oss.errorIndices'],
+            indices['apm_oss.metricsIndices'],
+            indices['apm_oss.transactionIndices']
+          ],
+          body: {
+            size: 0,
+            query: {
+              bool: {
+                filter: [
+                  { term: { [AGENT_NAME]: agentName } },
+                  { range: { '@timestamp': { gte: 'now-1d' } } }
+                ]
+              }
+            },
+            sort: {
+              '@timestamp': 'desc'
+            },
+            aggs: {
+              [AGENT_VERSION]: {
+                terms: {
+                  field: AGENT_VERSION,
+                  size
+                }
+              },
+              [SERVICE_FRAMEWORK_NAME]: {
+                terms: {
+                  field: SERVICE_FRAMEWORK_NAME,
+                  size
+                },
+                aggs: {
+                  [SERVICE_FRAMEWORK_VERSION]: {
+                    terms: {
+                      field: SERVICE_FRAMEWORK_VERSION,
+                      size
+                    }
+                  }
+                }
+              },
+              [SERVICE_FRAMEWORK_VERSION]: {
+                terms: {
+                  field: SERVICE_FRAMEWORK_VERSION,
+                  size
+                }
+              },
+              [SERVICE_LANGUAGE_NAME]: {
+                terms: {
+                  field: SERVICE_LANGUAGE_NAME,
+                  size
+                },
+                aggs: {
+                  [SERVICE_LANGUAGE_VERSION]: {
+                    terms: {
+                      field: SERVICE_LANGUAGE_VERSION,
+                      size
+                    }
+                  }
+                }
+              },
+              [SERVICE_LANGUAGE_VERSION]: {
+                terms: {
+                  field: SERVICE_LANGUAGE_VERSION,
+                  size
+                }
+              },
+              [SERVICE_RUNTIME_NAME]: {
+                terms: {
+                  field: SERVICE_RUNTIME_NAME,
+                  size
+                },
+                aggs: {
+                  [SERVICE_RUNTIME_VERSION]: {
+                    terms: {
+                      field: SERVICE_RUNTIME_VERSION,
+                      size
+                    }
+                  }
+                }
+              },
+              [SERVICE_RUNTIME_VERSION]: {
+                terms: {
+                  field: SERVICE_RUNTIME_VERSION,
+                  size
+                }
+              }
+            }
+          }
+        });
+
+        const { aggregations } = response;
+
+        if (!aggregations) {
+          return data;
+        }
+
+        const toComposite = (
+          outerKey: string | number,
+          innerKey: string | number
+        ) => `${outerKey}/${innerKey}`;
+
+        return {
+          ...data,
+          [agentName]: {
+            agent: {
+              version: aggregations[AGENT_VERSION].buckets.map(
+                bucket => bucket.key as string
+              )
+            },
+            service: {
+              framework: {
+                name: aggregations[SERVICE_FRAMEWORK_NAME].buckets
+                  .map(bucket => bucket.key as string)
+                  .slice(0, size),
+                version: aggregations[SERVICE_FRAMEWORK_VERSION].buckets
+                  .map(bucket => bucket.key as string)
+                  .slice(0, size),
+                composite: sortBy(
+                  flatten(
+                    aggregations[SERVICE_FRAMEWORK_NAME].buckets.map(bucket =>
+                      bucket[SERVICE_FRAMEWORK_VERSION].buckets.map(
+                        versionBucket => ({
+                          doc_count: versionBucket.doc_count,
+                          name: toComposite(bucket.key, versionBucket.key)
+                        })
+                      )
+                    )
+                  ),
+                  'doc_count'
+                )
+                  .reverse()
+                  .slice(0, size)
+                  .map(composite => composite.name)
+              },
+              language: {
+                name: aggregations[SERVICE_LANGUAGE_NAME].buckets
+                  .map(bucket => bucket.key as string)
+                  .slice(0, size),
+                version: aggregations[SERVICE_LANGUAGE_VERSION].buckets
+                  .map(bucket => bucket.key as string)
+                  .slice(0, size),
+                composite: sortBy(
+                  flatten(
+                    aggregations[SERVICE_LANGUAGE_NAME].buckets.map(bucket =>
+                      bucket[SERVICE_LANGUAGE_VERSION].buckets.map(
+                        versionBucket => ({
+                          doc_count: versionBucket.doc_count,
+                          name: toComposite(bucket.key, versionBucket.key)
+                        })
+                      )
+                    )
+                  ),
+                  'doc_count'
+                )
+                  .reverse()
+                  .slice(0, size)
+                  .map(composite => composite.name)
+              },
+              runtime: {
+                name: aggregations[SERVICE_RUNTIME_NAME].buckets
+                  .map(bucket => bucket.key as string)
+                  .slice(0, size),
+                version: aggregations[SERVICE_RUNTIME_VERSION].buckets
+                  .map(bucket => bucket.key as string)
+                  .slice(0, size),
+                composite: sortBy(
+                  flatten(
+                    aggregations[SERVICE_RUNTIME_NAME].buckets.map(bucket =>
+                      bucket[SERVICE_RUNTIME_VERSION].buckets.map(
+                        versionBucket => ({
+                          doc_count: versionBucket.doc_count,
+                          name: toComposite(bucket.key, versionBucket.key)
+                        })
+                      )
+                    )
+                  ),
+                  'doc_count'
+                )
+                  .reverse()
+                  .slice(0, size)
+                  .map(composite => composite.name)
+              }
+            }
+          }
+        };
+      }, Promise.resolve({} as APMTelemetry['agents']));
+
+      return {
+        agents: agentData
+      };
+    }
+  },
+  {
+    name: 'indices_stats',
+    executor: async ({ indicesStats, indices }) => {
+      const response = await indicesStats({
+        index: [
+          indices.apmAgentConfigurationIndex,
+          indices['apm_oss.errorIndices'],
+          indices['apm_oss.metricsIndices'],
+          indices['apm_oss.onboardingIndices'],
+          indices['apm_oss.sourcemapIndices'],
+          indices['apm_oss.spanIndices'],
+          indices['apm_oss.transactionIndices']
+        ]
+      });
+
+      return {
+        indices: {
+          shards: {
+            total: response._shards.total
+          },
+          all: {
+            total: {
+              docs: {
+                count: response._all.total.docs.count
+              },
+              store: {
+                size_in_bytes: response._all.total.store.size_in_bytes
+              }
+            }
+          }
+        }
+      };
+    }
+  },
+  {
+    name: 'cardinality',
+    executor: async ({ search }) => {
+      const allAgentsCardinalityResponse = await search({
+        body: {
+          size: 0,
+          query: {
+            bool: {
+              filter: [{ range: { '@timestamp': { gte: 'now-1d' } } }]
+            }
+          },
+          aggs: {
+            [TRANSACTION_NAME]: {
+              cardinality: {
+                field: TRANSACTION_NAME
+              }
+            },
+            [USER_AGENT_ORIGINAL]: {
+              cardinality: {
+                field: USER_AGENT_ORIGINAL
+              }
+            }
+          }
+        }
+      });
+
+      const rumAgentCardinalityResponse = await search({
+        body: {
+          size: 0,
+          query: {
+            bool: {
+              filter: [
+                { range: { '@timestamp': { gte: 'now-1d' } } },
+                { terms: { [AGENT_NAME]: ['rum-js', 'js-base'] } }
+              ]
+            }
+          },
+          aggs: {
+            [TRANSACTION_NAME]: {
+              cardinality: {
+                field: TRANSACTION_NAME
+              }
+            },
+            [USER_AGENT_ORIGINAL]: {
+              cardinality: {
+                field: USER_AGENT_ORIGINAL
+              }
+            }
+          }
+        }
+      });
+
+      return {
+        cardinality: {
+          transaction: {
+            name: {
+              all_agents: {
+                '1d':
+                  allAgentsCardinalityResponse.aggregations?.[TRANSACTION_NAME]
+                    .value
+              },
+              rum: {
+                '1d':
+                  rumAgentCardinalityResponse.aggregations?.[TRANSACTION_NAME]
+                    .value
+              }
+            }
+          },
+          user_agent: {
+            original: {
+              all_agents: {
+                '1d':
+                  allAgentsCardinalityResponse.aggregations?.[
+                    USER_AGENT_ORIGINAL
+                  ].value
+              },
+              rum: {
+                '1d':
+                  rumAgentCardinalityResponse.aggregations?.[
+                    USER_AGENT_ORIGINAL
+                  ].value
+              }
+            }
+          }
+        }
+      };
+    }
+  }
+];
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/index.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/index.ts
index a2b0494730826..c80057a2894dc 100644
--- a/x-pack/plugins/apm/server/lib/apm_telemetry/index.ts
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/index.ts
@@ -3,60 +3,127 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-
-import { countBy } from 'lodash';
-import { SavedObjectAttributes } from '../../../../../../src/core/server';
-import { isAgentName } from '../../../common/agent_name';
+import { CoreSetup, Logger } from 'src/core/server';
+import { Observable } from 'rxjs';
+import { take } from 'rxjs/operators';
+import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import {
+  TaskManagerStartContract,
+  TaskManagerSetupContract
+} from '../../../../task_manager/server';
+import { getApmIndices } from '../settings/apm_indices/get_apm_indices';
 import {
-  APM_SERVICES_TELEMETRY_SAVED_OBJECT_TYPE,
-  APM_SERVICES_TELEMETRY_SAVED_OBJECT_ID
+  APM_TELEMETRY_SAVED_OBJECT_ID,
+  APM_TELEMETRY_SAVED_OBJECT_TYPE
 } from '../../../common/apm_saved_object_constants';
-import { UsageCollectionSetup } from '../../../../../../src/plugins/usage_collection/server';
-import { InternalSavedObjectsClient } from '../helpers/get_internal_saved_objects_client';
-
-export function createApmTelementry(
-  agentNames: string[] = []
-): SavedObjectAttributes {
-  const validAgentNames = agentNames.filter(isAgentName);
-  return {
-    has_any_services: validAgentNames.length > 0,
-    services_per_agent: countBy(validAgentNames)
+import {
+  collectDataTelemetry,
+  CollectTelemetryParams
+} from './collect_data_telemetry';
+import { APMConfig } from '../..';
+import { getInternalSavedObjectsClient } from '../helpers/get_internal_saved_objects_client';
+
+const APM_TELEMETRY_TASK_NAME = 'apm-telemetry-task';
+
+export async function createApmTelemetry({
+  core,
+  config$,
+  usageCollector,
+  taskManager,
+  logger
+}: {
+  core: CoreSetup;
+  config$: Observable<APMConfig>;
+  usageCollector: UsageCollectionSetup;
+  taskManager: TaskManagerSetupContract;
+  logger: Logger;
+}) {
+  const savedObjectsClient = await getInternalSavedObjectsClient(core);
+
+  const collectAndStore = async () => {
+    const config = await config$.pipe(take(1)).toPromise();
+    const esClient = core.elasticsearch.dataClient;
+
+    const indices = await getApmIndices({
+      config,
+      savedObjectsClient
+    });
+
+    const search = esClient.callAsInternalUser.bind(
+      esClient,
+      'search'
+    ) as CollectTelemetryParams['search'];
+
+    const indicesStats = esClient.callAsInternalUser.bind(
+      esClient,
+      'indices.stats'
+    ) as CollectTelemetryParams['indicesStats'];
+
+    const transportRequest = esClient.callAsInternalUser.bind(
+      esClient,
+      'transport.request'
+    ) as CollectTelemetryParams['transportRequest'];
+
+    const dataTelemetry = await collectDataTelemetry({
+      search,
+      indices,
+      logger,
+      indicesStats,
+      transportRequest
+    });
+
+    await savedObjectsClient.create(
+      APM_TELEMETRY_SAVED_OBJECT_TYPE,
+      dataTelemetry,
+      { id: APM_TELEMETRY_SAVED_OBJECT_TYPE, overwrite: true }
+    );
   };
-}
 
-export async function storeApmServicesTelemetry(
-  savedObjectsClient: InternalSavedObjectsClient,
-  apmTelemetry: SavedObjectAttributes
-) {
-  return savedObjectsClient.create(
-    APM_SERVICES_TELEMETRY_SAVED_OBJECT_TYPE,
-    apmTelemetry,
-    {
-      id: APM_SERVICES_TELEMETRY_SAVED_OBJECT_ID,
-      overwrite: true
+  taskManager.registerTaskDefinitions({
+    [APM_TELEMETRY_TASK_NAME]: {
+      title: 'Collect APM telemetry',
+      type: APM_TELEMETRY_TASK_NAME,
+      createTaskRunner: () => {
+        return {
+          run: async () => {
+            await collectAndStore();
+          }
+        };
+      }
     }
-  );
-}
+  });
 
-export function makeApmUsageCollector(
-  usageCollector: UsageCollectionSetup,
-  savedObjectsRepository: InternalSavedObjectsClient
-) {
-  const apmUsageCollector = usageCollector.makeUsageCollector({
+  const collector = usageCollector.makeUsageCollector({
     type: 'apm',
     fetch: async () => {
-      try {
-        const apmTelemetrySavedObject = await savedObjectsRepository.get(
-          APM_SERVICES_TELEMETRY_SAVED_OBJECT_TYPE,
-          APM_SERVICES_TELEMETRY_SAVED_OBJECT_ID
-        );
-        return apmTelemetrySavedObject.attributes;
-      } catch (err) {
-        return createApmTelementry();
-      }
+      const data = (
+        await savedObjectsClient.get(
+          APM_TELEMETRY_SAVED_OBJECT_TYPE,
+          APM_TELEMETRY_SAVED_OBJECT_ID
+        )
+      ).attributes;
+
+      return data;
     },
     isReady: () => true
   });
 
-  usageCollector.registerCollector(apmUsageCollector);
+  usageCollector.registerCollector(collector);
+
+  core.getStartServices().then(([coreStart, pluginsStart]) => {
+    const { taskManager: taskManagerStart } = pluginsStart as {
+      taskManager: TaskManagerStartContract;
+    };
+
+    taskManagerStart.ensureScheduled({
+      id: APM_TELEMETRY_TASK_NAME,
+      taskType: APM_TELEMETRY_TASK_NAME,
+      schedule: {
+        interval: '720m'
+      },
+      scope: ['apm'],
+      params: {},
+      state: {}
+    });
+  });
 }
diff --git a/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts b/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
new file mode 100644
index 0000000000000..f68dc517a2227
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/apm_telemetry/types.ts
@@ -0,0 +1,118 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DeepPartial } from 'utility-types';
+import { AgentName } from '../../../typings/es_schemas/ui/fields/agent';
+
+export interface TimeframeMap {
+  '1d': number;
+  all: number;
+}
+
+export type TimeframeMap1d = Pick<TimeframeMap, '1d'>;
+export type TimeframeMapAll = Pick<TimeframeMap, 'all'>;
+
+export type APMDataTelemetry = DeepPartial<{
+  has_any_services: boolean;
+  services_per_agent: Record<AgentName, number>;
+  versions: {
+    apm_server: {
+      minor: number;
+      major: number;
+      patch: number;
+    };
+  };
+  counts: {
+    transaction: TimeframeMap;
+    span: TimeframeMap;
+    error: TimeframeMap;
+    metric: TimeframeMap;
+    sourcemap: TimeframeMap;
+    onboarding: TimeframeMap;
+    agent_configuration: TimeframeMapAll;
+    max_transaction_groups_per_service: TimeframeMap;
+    max_error_groups_per_service: TimeframeMap;
+    traces: TimeframeMap;
+    services: TimeframeMap;
+  };
+  cardinality: {
+    user_agent: {
+      original: {
+        all_agents: TimeframeMap1d;
+        rum: TimeframeMap1d;
+      };
+    };
+    transaction: {
+      name: {
+        all_agents: TimeframeMap1d;
+        rum: TimeframeMap1d;
+      };
+    };
+  };
+  retainment: Record<
+    'span' | 'transaction' | 'error' | 'metric' | 'sourcemap' | 'onboarding',
+    { ms: number }
+  >;
+  integrations: {
+    ml: {
+      all_jobs_count: number;
+    };
+  };
+  agents: Record<
+    AgentName,
+    {
+      agent: {
+        version: string[];
+      };
+      service: {
+        framework: {
+          name: string[];
+          version: string[];
+          composite: string[];
+        };
+        language: {
+          name: string[];
+          version: string[];
+          composite: string[];
+        };
+        runtime: {
+          name: string[];
+          version: string[];
+          composite: string[];
+        };
+      };
+    }
+  >;
+  indices: {
+    shards: {
+      total: number;
+    };
+    all: {
+      total: {
+        docs: {
+          count: number;
+        };
+        store: {
+          size_in_bytes: number;
+        };
+      };
+    };
+  };
+  tasks: Record<
+    | 'processor_events'
+    | 'agent_configuration'
+    | 'services'
+    | 'versions'
+    | 'groupings'
+    | 'integrations'
+    | 'agents'
+    | 'indices_stats'
+    | 'cardinality',
+    { took: { ms: number } }
+  >;
+}>;
+
+export type APMTelemetry = APMDataTelemetry;
diff --git a/x-pack/plugins/apm/server/lib/helpers/create_or_update_index.ts b/x-pack/plugins/apm/server/lib/helpers/create_or_update_index.ts
index 0a0da332e73ae..91a595c0900be 100644
--- a/x-pack/plugins/apm/server/lib/helpers/create_or_update_index.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/create_or_update_index.ts
@@ -9,8 +9,9 @@ import { CallCluster } from 'src/legacy/core_plugins/elasticsearch';
 
 export type Mappings =
   | {
-      dynamic?: boolean;
+      dynamic?: boolean | 'strict';
       properties: Record<string, Mappings>;
+      dynamic_templates?: any[];
     }
   | {
       type: string;
@@ -18,6 +19,7 @@ export type Mappings =
       scaling_factor?: number;
       ignore_malformed?: boolean;
       coerce?: boolean;
+      fields?: Record<string, Mappings>;
     };
 
 export async function createOrUpdateIndex({
diff --git a/x-pack/plugins/apm/server/lib/helpers/setup_request.test.ts b/x-pack/plugins/apm/server/lib/helpers/setup_request.test.ts
index 40a2a0e7216a0..8e8cf698a84cf 100644
--- a/x-pack/plugins/apm/server/lib/helpers/setup_request.test.ts
+++ b/x-pack/plugins/apm/server/lib/helpers/setup_request.test.ts
@@ -39,6 +39,19 @@ function getMockRequest() {
         _debug: false
       }
     },
+    __LEGACY: {
+      server: {
+        plugins: {
+          elasticsearch: {
+            getCluster: jest.fn().mockReturnValue({ callWithInternalUser: {} })
+          }
+        },
+        savedObjects: {
+          SavedObjectsClient: jest.fn(),
+          getSavedObjectsRepository: jest.fn()
+        }
+      }
+    },
     core: {
       elasticsearch: {
         dataClient: {
diff --git a/x-pack/plugins/apm/server/lib/service_map/dedupe_connections/index.test.ts b/x-pack/plugins/apm/server/lib/service_map/dedupe_connections/index.test.ts
new file mode 100644
index 0000000000000..01d6a2e2e81bc
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/service_map/dedupe_connections/index.test.ts
@@ -0,0 +1,143 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ServiceMapResponse } from './';
+import {
+  SPAN_DESTINATION_SERVICE_RESOURCE,
+  SERVICE_NAME,
+  SERVICE_ENVIRONMENT,
+  SERVICE_FRAMEWORK_NAME,
+  AGENT_NAME,
+  SPAN_TYPE,
+  SPAN_SUBTYPE
+} from '../../../../common/elasticsearch_fieldnames';
+import { dedupeConnections } from './';
+
+const nodejsService = {
+  [SERVICE_NAME]: 'opbeans-node',
+  [SERVICE_ENVIRONMENT]: 'production',
+  [SERVICE_FRAMEWORK_NAME]: null,
+  [AGENT_NAME]: 'nodejs'
+};
+
+const nodejsExternal = {
+  [SPAN_DESTINATION_SERVICE_RESOURCE]: 'opbeans-node',
+  [SPAN_TYPE]: 'external',
+  [SPAN_SUBTYPE]: 'aa'
+};
+
+const javaService = {
+  [SERVICE_NAME]: 'opbeans-java',
+  [SERVICE_ENVIRONMENT]: 'production',
+  [SERVICE_FRAMEWORK_NAME]: null,
+  [AGENT_NAME]: 'java'
+};
+
+describe('dedupeConnections', () => {
+  it('maps external destinations to internal services', () => {
+    const response: ServiceMapResponse = {
+      services: [nodejsService, javaService],
+      discoveredServices: [
+        {
+          from: nodejsExternal,
+          to: nodejsService
+        }
+      ],
+      connections: [
+        {
+          source: javaService,
+          destination: nodejsExternal
+        }
+      ]
+    };
+
+    const { elements } = dedupeConnections(response);
+
+    const connection = elements.find(
+      element => 'source' in element.data && 'target' in element.data
+    );
+
+    // @ts-ignore
+    expect(connection?.data.target).toBe('opbeans-node');
+
+    expect(
+      elements.find(element => element.data.id === '>opbeans-node')
+    ).toBeUndefined();
+  });
+
+  it('collapses external destinations based on span.destination.resource.name', () => {
+    const response: ServiceMapResponse = {
+      services: [nodejsService, javaService],
+      discoveredServices: [
+        {
+          from: nodejsExternal,
+          to: nodejsService
+        }
+      ],
+      connections: [
+        {
+          source: javaService,
+          destination: nodejsExternal
+        },
+        {
+          source: javaService,
+          destination: {
+            ...nodejsExternal,
+            [SPAN_TYPE]: 'foo'
+          }
+        }
+      ]
+    };
+
+    const { elements } = dedupeConnections(response);
+
+    const connections = elements.filter(element => 'source' in element.data);
+
+    expect(connections.length).toBe(1);
+
+    const nodes = elements.filter(element => !('source' in element.data));
+
+    expect(nodes.length).toBe(2);
+  });
+
+  it('picks the first span.type/subtype in an alphabetically sorted list', () => {
+    const response: ServiceMapResponse = {
+      services: [javaService],
+      discoveredServices: [],
+      connections: [
+        {
+          source: javaService,
+          destination: nodejsExternal
+        },
+        {
+          source: javaService,
+          destination: {
+            ...nodejsExternal,
+            [SPAN_TYPE]: 'foo'
+          }
+        },
+        {
+          source: javaService,
+          destination: {
+            ...nodejsExternal,
+            [SPAN_SUBTYPE]: 'bb'
+          }
+        }
+      ]
+    };
+
+    const { elements } = dedupeConnections(response);
+
+    const nodes = elements.filter(element => !('source' in element.data));
+
+    const nodejsNode = nodes.find(node => node.data.id === '>opbeans-node');
+
+    // @ts-ignore
+    expect(nodejsNode?.data[SPAN_TYPE]).toBe('external');
+    // @ts-ignore
+    expect(nodejsNode?.data[SPAN_SUBTYPE]).toBe('aa');
+  });
+});
diff --git a/x-pack/plugins/apm/server/lib/service_map/dedupe_connections.ts b/x-pack/plugins/apm/server/lib/service_map/dedupe_connections/index.ts
similarity index 54%
rename from x-pack/plugins/apm/server/lib/service_map/dedupe_connections.ts
rename to x-pack/plugins/apm/server/lib/service_map/dedupe_connections/index.ts
index 485958cc17afd..d256f657bb778 100644
--- a/x-pack/plugins/apm/server/lib/service_map/dedupe_connections.ts
+++ b/x-pack/plugins/apm/server/lib/service_map/dedupe_connections/index.ts
@@ -6,23 +6,25 @@
 import { isEqual, sortBy } from 'lodash';
 import { ValuesType } from 'utility-types';
 import {
-  DESTINATION_ADDRESS,
-  SERVICE_NAME
-} from '../../../common/elasticsearch_fieldnames';
+  SERVICE_NAME,
+  SPAN_DESTINATION_SERVICE_RESOURCE,
+  SPAN_TYPE,
+  SPAN_SUBTYPE
+} from '../../../../common/elasticsearch_fieldnames';
 import {
   Connection,
   ConnectionNode,
-  ExternalConnectionNode,
-  ServiceConnectionNode
-} from '../../../common/service_map';
-import { ConnectionsResponse, ServicesResponse } from './get_service_map';
+  ServiceConnectionNode,
+  ExternalConnectionNode
+} from '../../../../common/service_map';
+import { ConnectionsResponse, ServicesResponse } from '../get_service_map';
 
 function getConnectionNodeId(node: ConnectionNode): string {
-  if (DESTINATION_ADDRESS in node) {
+  if ('span.destination.service.resource' in node) {
     // use a prefix to distinguish exernal destination ids from services
-    return `>${(node as ExternalConnectionNode)[DESTINATION_ADDRESS]}`;
+    return `>${node[SPAN_DESTINATION_SERVICE_RESOURCE]}`;
   }
-  return (node as ServiceConnectionNode)[SERVICE_NAME];
+  return node[SERVICE_NAME];
 }
 
 function getConnectionId(connection: Connection) {
@@ -31,32 +33,86 @@ function getConnectionId(connection: Connection) {
   )}`;
 }
 
-type ServiceMapResponse = ConnectionsResponse & { services: ServicesResponse };
+export type ServiceMapResponse = ConnectionsResponse & {
+  services: ServicesResponse;
+};
 
 export function dedupeConnections(response: ServiceMapResponse) {
   const { discoveredServices, services, connections } = response;
 
-  const serviceNodes = services.map(service => ({
-    ...service,
-    id: service[SERVICE_NAME]
-  }));
+  const allNodes = connections
+    .flatMap(connection => [connection.source, connection.destination])
+    .map(node => ({ ...node, id: getConnectionNodeId(node) }))
+    .concat(
+      services.map(service => ({
+        ...service,
+        id: service[SERVICE_NAME]
+      }))
+    );
 
-  // maps destination.address to service.name if possible
-  function getConnectionNode(node: ConnectionNode) {
-    let mappedNode: ConnectionNode | undefined;
+  const serviceNodes = allNodes.filter(node => SERVICE_NAME in node) as Array<
+    ServiceConnectionNode & {
+      id: string;
+    }
+  >;
 
-    if (DESTINATION_ADDRESS in node) {
-      mappedNode = discoveredServices.find(map => isEqual(map.from, node))?.to;
+  const externalNodes = allNodes.filter(
+    node => SPAN_DESTINATION_SERVICE_RESOURCE in node
+  ) as Array<
+    ExternalConnectionNode & {
+      id: string;
+    }
+  >;
+
+  // 1. maps external nodes to internal services
+  // 2. collapses external nodes into one node based on span.destination.service.resource
+  // 3. picks the first available span.type/span.subtype in an alphabetically sorted list
+  const nodeMap = allNodes.reduce((map, node) => {
+    if (map[node.id]) {
+      return map;
     }
 
-    if (!mappedNode) {
-      mappedNode = node;
+    const service =
+      discoveredServices.find(({ from }) => {
+        if ('span.destination.service.resource' in node) {
+          return (
+            node[SPAN_DESTINATION_SERVICE_RESOURCE] ===
+            from[SPAN_DESTINATION_SERVICE_RESOURCE]
+          );
+        }
+        return false;
+      })?.to ?? serviceNodes.find(serviceNode => serviceNode.id === node.id);
+
+    if (service) {
+      return {
+        ...map,
+        [node.id]: {
+          id: service[SERVICE_NAME],
+          ...service
+        }
+      };
     }
 
+    const allMatchedExternalNodes = externalNodes.filter(n => n.id === node.id);
+
+    const firstMatchedNode = allMatchedExternalNodes[0];
+
     return {
-      ...mappedNode,
-      id: getConnectionNodeId(mappedNode)
+      ...map,
+      [node.id]: {
+        ...firstMatchedNode,
+        label: firstMatchedNode[SPAN_DESTINATION_SERVICE_RESOURCE],
+        [SPAN_TYPE]: allMatchedExternalNodes.map(n => n[SPAN_TYPE]).sort()[0],
+        [SPAN_SUBTYPE]: allMatchedExternalNodes
+          .map(n => n[SPAN_SUBTYPE])
+          .sort()[0]
+      }
     };
+  }, {} as Record<string, ConnectionNode & { id: string }>);
+
+  // maps destination.address to service.name if possible
+  function getConnectionNode(node: ConnectionNode) {
+    return nodeMap[getConnectionNodeId(node)];
   }
 
   // build connections with mapped nodes
diff --git a/x-pack/plugins/apm/server/lib/service_map/get_service_map_from_trace_ids.ts b/x-pack/plugins/apm/server/lib/service_map/get_service_map_from_trace_ids.ts
index d6d9e9b875408..eaf3d63521a98 100644
--- a/x-pack/plugins/apm/server/lib/service_map/get_service_map_from_trace_ids.ts
+++ b/x-pack/plugins/apm/server/lib/service_map/get_service_map_from_trace_ids.ts
@@ -65,7 +65,7 @@ export async function getServiceMapFromTraceIds({
                   'parent.id',
                   'service.name',
                   'service.environment',
-                  'destination.address',
+                  'span.destination.service.resource',
                   'trace.id',
                   'processor.event',
                   'span.type',
@@ -103,7 +103,7 @@ export async function getServiceMapFromTraceIds({
               source: `
               def getDestination ( def event ) {
                 def destination = new HashMap();
-                destination['destination.address'] = event['destination.address'];
+                destination['span.destination.service.resource'] = event['span.destination.service.resource'];
                 destination['span.type'] = event['span.type'];
                 destination['span.subtype'] = event['span.subtype'];
                 return destination;
@@ -138,13 +138,11 @@ export async function getServiceMapFromTraceIds({
                     /* flag parent path for removal, as it has children */
                     context.locationsToRemove.add(parent.path);
 
-                    /* if the parent has 'destination.address' set, and the service is different,
+                    /* if the parent has 'span.destination.service.resource' set, and the service is different,
                     we've discovered a service */
 
-                    if (parent['destination.address'] != null
-                      && parent['destination.address'] != ""
-                      && (parent['span.type'] == 'external'
-                        || parent['span.type'] == 'messaging')
+                    if (parent['span.destination.service.resource'] != null
+                      && parent['span.destination.service.resource'] != ""
                       && (parent['service.name'] != event['service.name']
                         || parent['service.environment'] != event['service.environment']
                       )
@@ -165,8 +163,8 @@ export async function getServiceMapFromTraceIds({
                 }
 
                 /* if there is an outgoing span, create a new path */
-                if (event['destination.address'] != null
-                  && event['destination.address'] != '') {
+                if (event['span.destination.service.resource'] != null
+                  && event['span.destination.service.resource'] != '') {
                   def outgoingLocation = getDestination(event);
                   def outgoingPath = new ArrayList(basePath);
                   outgoingPath.add(outgoingLocation);
diff --git a/x-pack/plugins/apm/server/lib/service_map/get_trace_sample_ids.ts b/x-pack/plugins/apm/server/lib/service_map/get_trace_sample_ids.ts
index f4e12df5d6a66..9cb1a61e1d76f 100644
--- a/x-pack/plugins/apm/server/lib/service_map/get_trace_sample_ids.ts
+++ b/x-pack/plugins/apm/server/lib/service_map/get_trace_sample_ids.ts
@@ -16,9 +16,7 @@ import {
   SERVICE_NAME,
   SERVICE_ENVIRONMENT,
   TRACE_ID,
-  DESTINATION_ADDRESS,
-  SPAN_TYPE,
-  SPAN_SUBTYPE
+  SPAN_DESTINATION_SERVICE_RESOURCE
 } from '../../../common/elasticsearch_fieldnames';
 
 const MAX_TRACES_TO_INSPECT = 1000;
@@ -46,7 +44,7 @@ export async function getTraceSampleIds({
         },
         {
           exists: {
-            field: DESTINATION_ADDRESS
+            field: SPAN_DESTINATION_SERVICE_RESOURCE
           }
         },
         rangeQuery
@@ -82,9 +80,9 @@ export async function getTraceSampleIds({
           composite: {
             sources: [
               {
-                [DESTINATION_ADDRESS]: {
+                [SPAN_DESTINATION_SERVICE_RESOURCE]: {
                   terms: {
-                    field: DESTINATION_ADDRESS
+                    field: SPAN_DESTINATION_SERVICE_RESOURCE
                   }
                 }
               },
@@ -102,21 +100,6 @@ export async function getTraceSampleIds({
                     missing_bucket: true
                   }
                 }
-              },
-              {
-                [SPAN_TYPE]: {
-                  terms: {
-                    field: SPAN_TYPE
-                  }
-                }
-              },
-              {
-                [SPAN_SUBTYPE]: {
-                  terms: {
-                    field: SPAN_SUBTYPE,
-                    missing_bucket: true
-                  }
-                }
               }
             ],
             size: fingerprintBucketSize
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/convert_settings_to_string.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/convert_settings_to_string.ts
new file mode 100644
index 0000000000000..ab01a68733a7a
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/convert_settings_to_string.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ESSearchHit } from '../../../../typings/elasticsearch';
+import { AgentConfiguration } from '../../../../common/agent_configuration/configuration_types';
+
+// needed for backwards compatability
+// All settings except `transaction_sample_rate` and `transaction_max_spans` are stored as strings (they are stored as float and integer respectively)
+export function convertConfigSettingsToString(
+  hit: ESSearchHit<AgentConfiguration>
+) {
+  const config = hit._source;
+
+  if (config.settings?.transaction_sample_rate) {
+    config.settings.transaction_sample_rate = config.settings.transaction_sample_rate.toString();
+  }
+
+  if (config.settings?.transaction_max_spans) {
+    config.settings.transaction_max_spans = config.settings.transaction_max_spans.toString();
+  }
+
+  return hit;
+}
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/create_agent_config_index.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/create_agent_config_index.ts
index bc03138e0c247..b2dc22ceb2918 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/create_agent_config_index.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/create_agent_config_index.ts
@@ -26,6 +26,19 @@ export async function createApmAgentConfigurationIndex({
 }
 
 const mappings: Mappings = {
+  dynamic: 'strict',
+  dynamic_templates: [
+    {
+      // force string to keyword (instead of default of text + keyword)
+      strings: {
+        match_mapping_type: 'string',
+        mapping: {
+          type: 'keyword',
+          ignore_above: 1024
+        }
+      }
+    }
+  ],
   properties: {
     '@timestamp': {
       type: 'date'
@@ -43,21 +56,9 @@ const mappings: Mappings = {
       }
     },
     settings: {
-      properties: {
-        transaction_sample_rate: {
-          type: 'scaled_float',
-          scaling_factor: 1000,
-          ignore_malformed: true,
-          coerce: false
-        },
-        capture_body: {
-          type: 'keyword',
-          ignore_above: 1024
-        },
-        transaction_max_spans: {
-          type: 'short'
-        }
-      }
+      // allowing dynamic fields without specifying anything specific
+      dynamic: true,
+      properties: {}
     },
     applied_by_agent: {
       type: 'boolean'
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/create_or_update_configuration.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/create_or_update_configuration.ts
index 74fcc61dde863..aa5ddb288b2d7 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/create_or_update_configuration.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/create_or_update_configuration.ts
@@ -9,7 +9,7 @@ import { Setup } from '../../helpers/setup_request';
 import {
   AgentConfiguration,
   AgentConfigurationIntake
-} from './configuration_types';
+} from '../../../../common/agent_configuration/configuration_types';
 import { APMIndexDocumentParams } from '../../helpers/es_client';
 
 export async function createOrUpdateConfiguration({
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/find_exact_configuration.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/find_exact_configuration.ts
index eea409882f876..e3455cdbc5a1c 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/find_exact_configuration.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/find_exact_configuration.ts
@@ -9,8 +9,9 @@ import {
   SERVICE_ENVIRONMENT
 } from '../../../../common/elasticsearch_fieldnames';
 import { Setup } from '../../helpers/setup_request';
-import { AgentConfiguration } from './configuration_types';
+import { AgentConfiguration } from '../../../../common/agent_configuration/configuration_types';
 import { ESSearchHit } from '../../../../typings/elasticsearch';
+import { convertConfigSettingsToString } from './convert_settings_to_string';
 
 export async function findExactConfiguration({
   service,
@@ -42,5 +43,11 @@ export async function findExactConfiguration({
     params
   );
 
-  return resp.hits.hits[0] as ESSearchHit<AgentConfiguration> | undefined;
+  const hit = resp.hits.hits[0] as ESSearchHit<AgentConfiguration> | undefined;
+
+  if (!hit) {
+    return;
+  }
+
+  return convertConfigSettingsToString(hit);
 }
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_all_environments.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_all_environments.ts
index 52a3422f8e6b7..a70f7965d0e59 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_all_environments.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_all_environments.ts
@@ -10,7 +10,7 @@ import {
   SERVICE_NAME,
   SERVICE_ENVIRONMENT
 } from '../../../../../common/elasticsearch_fieldnames';
-import { ALL_OPTION_VALUE } from '../../../../../common/agent_configuration_constants';
+import { ALL_OPTION_VALUE } from '../../../../../common/agent_configuration/all_option';
 
 export async function getAllEnvironments({
   serviceName,
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_existing_environments_for_service.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_existing_environments_for_service.ts
index f54217461510f..754c698af8753 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_existing_environments_for_service.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_environments/get_existing_environments_for_service.ts
@@ -9,7 +9,7 @@ import {
   SERVICE_NAME,
   SERVICE_ENVIRONMENT
 } from '../../../../../common/elasticsearch_fieldnames';
-import { ALL_OPTION_VALUE } from '../../../../../common/agent_configuration_constants';
+import { ALL_OPTION_VALUE } from '../../../../../common/agent_configuration/all_option';
 
 export async function getExistingEnvironmentsForService({
   serviceName,
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
index 9b9acbb1e0ad5..352bbe1b6a294 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/get_service_names.ts
@@ -10,7 +10,7 @@ import {
   PROCESSOR_EVENT,
   SERVICE_NAME
 } from '../../../../common/elasticsearch_fieldnames';
-import { ALL_OPTION_VALUE } from '../../../../common/agent_configuration_constants';
+import { ALL_OPTION_VALUE } from '../../../../common/agent_configuration/all_option';
 
 export type AgentConfigurationServicesAPIResponse = PromiseReturnType<
   typeof getServiceNames
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/list_configurations.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/list_configurations.ts
index 585de740bc88d..c44d7b41f532b 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/list_configurations.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/list_configurations.ts
@@ -6,7 +6,8 @@
 
 import { PromiseReturnType } from '../../../../typings/common';
 import { Setup } from '../../helpers/setup_request';
-import { AgentConfiguration } from './configuration_types';
+import { AgentConfiguration } from '../../../../common/agent_configuration/configuration_types';
+import { convertConfigSettingsToString } from './convert_settings_to_string';
 
 export type AgentConfigurationListAPIResponse = PromiseReturnType<
   typeof listConfigurations
@@ -20,8 +21,7 @@ export async function listConfigurations({ setup }: { setup: Setup }) {
   };
 
   const resp = await internalClient.search<AgentConfiguration>(params);
-  return resp.hits.hits.map(item => ({
-    id: item._id,
-    ...item._source
-  }));
+  return resp.hits.hits
+    .map(convertConfigSettingsToString)
+    .map(hit => hit._source);
 }
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/mark_applied_by_agent.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/mark_applied_by_agent.ts
index b6aecd1d7f0ca..5157c94a74768 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/mark_applied_by_agent.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/mark_applied_by_agent.ts
@@ -5,7 +5,7 @@
  */
 
 import { Setup } from '../../helpers/setup_request';
-import { AgentConfiguration } from './configuration_types';
+import { AgentConfiguration } from '../../../../common/agent_configuration/configuration_types';
 
 export async function markAppliedByAgent({
   id,
diff --git a/x-pack/plugins/apm/server/lib/settings/agent_configuration/search_configurations.ts b/x-pack/plugins/apm/server/lib/settings/agent_configuration/search_configurations.ts
index 9bbdc96a3a797..fa38e8fabfb69 100644
--- a/x-pack/plugins/apm/server/lib/settings/agent_configuration/search_configurations.ts
+++ b/x-pack/plugins/apm/server/lib/settings/agent_configuration/search_configurations.ts
@@ -9,7 +9,8 @@ import {
   SERVICE_ENVIRONMENT
 } from '../../../../common/elasticsearch_fieldnames';
 import { Setup } from '../../helpers/setup_request';
-import { AgentConfiguration } from './configuration_types';
+import { AgentConfiguration } from '../../../../common/agent_configuration/configuration_types';
+import { convertConfigSettingsToString } from './convert_settings_to_string';
 
 export async function searchConfigurations({
   service,
@@ -66,5 +67,11 @@ export async function searchConfigurations({
     params
   );
 
-  return resp.hits.hits[0] as ESSearchHit<AgentConfiguration> | undefined;
+  const hit = resp.hits.hits[0] as ESSearchHit<AgentConfiguration> | undefined;
+
+  if (!hit) {
+    return;
+  }
+
+  return convertConfigSettingsToString(hit);
 }
diff --git a/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/__snapshots__/get_transaction.test.ts.snap b/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/__snapshots__/get_transaction.test.ts.snap
new file mode 100644
index 0000000000000..16a270fd6d25b
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/__snapshots__/get_transaction.test.ts.snap
@@ -0,0 +1,73 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`custom link get transaction fetches with all filter 1`] = `
+Object {
+  "body": Object {
+    "query": Object {
+      "bool": Object {
+        "filter": Array [
+          Object {
+            "term": Object {
+              "service.name": "foo",
+            },
+          },
+          Object {
+            "term": Object {
+              "service.environment": "bar",
+            },
+          },
+          Object {
+            "term": Object {
+              "transaction.type": "qux",
+            },
+          },
+          Object {
+            "term": Object {
+              "transaction.name": "baz",
+            },
+          },
+        ],
+      },
+    },
+  },
+  "index": "myIndex",
+  "size": 1,
+  "terminateAfter": 1,
+}
+`;
+
+exports[`custom link get transaction fetches without filter 1`] = `
+Object {
+  "body": Object {
+    "query": Object {
+      "bool": Object {
+        "filter": Array [],
+      },
+    },
+  },
+  "index": "myIndex",
+  "size": 1,
+  "terminateAfter": 1,
+}
+`;
+
+exports[`custom link get transaction removes not listed filters from query 1`] = `
+Object {
+  "body": Object {
+    "query": Object {
+      "bool": Object {
+        "filter": Array [
+          Object {
+            "term": Object {
+              "service.name": "foo",
+            },
+          },
+        ],
+      },
+    },
+  },
+  "index": "myIndex",
+  "size": 1,
+  "terminateAfter": 1,
+}
+`;
diff --git a/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/__snapshots__/list_custom_links.test.ts.snap b/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/__snapshots__/list_custom_links.test.ts.snap
index b3819ace40d6c..bb8f6dcb22902 100644
--- a/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/__snapshots__/list_custom_links.test.ts.snap
+++ b/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/__snapshots__/list_custom_links.test.ts.snap
@@ -8,6 +8,13 @@ Object {
         "filter": Array [],
       },
     },
+    "sort": Array [
+      Object {
+        "label.keyword": Object {
+          "order": "asc",
+        },
+      },
+    ],
   },
   "index": "myIndex",
   "size": 500,
@@ -69,6 +76,13 @@ Object {
         ],
       },
     },
+    "sort": Array [
+      Object {
+        "label.keyword": Object {
+          "order": "asc",
+        },
+      },
+    ],
   },
   "index": "myIndex",
   "size": 500,
diff --git a/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/get_transaction.test.ts b/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/get_transaction.test.ts
new file mode 100644
index 0000000000000..4fc22298a476c
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/settings/custom_link/__test__/get_transaction.test.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import {
+  inspectSearchParams,
+  SearchParamsMock
+} from '../../../../../../../legacy/plugins/apm/public/utils/testHelpers';
+import { getTransaction } from '../get_transaction';
+import { Setup } from '../../../helpers/setup_request';
+import {
+  SERVICE_NAME,
+  TRANSACTION_TYPE,
+  SERVICE_ENVIRONMENT,
+  TRANSACTION_NAME
+} from '../../../../../common/elasticsearch_fieldnames';
+
+describe('custom link get transaction', () => {
+  let mock: SearchParamsMock;
+  it('removes not listed filters from query', async () => {
+    mock = await inspectSearchParams(setup =>
+      getTransaction({
+        setup: (setup as unknown) as Setup,
+        // @ts-ignore ignoring the _debug is not part of filter options
+        filters: { _debug: true, [SERVICE_NAME]: 'foo' }
+      })
+    );
+
+    expect(mock.params).toMatchSnapshot();
+  });
+  it('fetches without filter', async () => {
+    mock = await inspectSearchParams(setup =>
+      getTransaction({
+        setup: (setup as unknown) as Setup
+      })
+    );
+
+    expect(mock.params).toMatchSnapshot();
+  });
+  it('fetches with all filter', async () => {
+    mock = await inspectSearchParams(setup =>
+      getTransaction({
+        setup: (setup as unknown) as Setup,
+        filters: {
+          [SERVICE_NAME]: 'foo',
+          [SERVICE_ENVIRONMENT]: 'bar',
+          [TRANSACTION_NAME]: 'baz',
+          [TRANSACTION_TYPE]: 'qux'
+        }
+      })
+    );
+
+    expect(mock.params).toMatchSnapshot();
+  });
+});
diff --git a/x-pack/plugins/apm/server/lib/settings/custom_link/create_custom_link_index.ts b/x-pack/plugins/apm/server/lib/settings/custom_link/create_custom_link_index.ts
index cdb3cff616030..42b99b34beea7 100644
--- a/x-pack/plugins/apm/server/lib/settings/custom_link/create_custom_link_index.ts
+++ b/x-pack/plugins/apm/server/lib/settings/custom_link/create_custom_link_index.ts
@@ -26,12 +26,19 @@ export const createApmCustomLinkIndex = async ({
 };
 
 const mappings: Mappings = {
+  dynamic: 'strict',
   properties: {
     '@timestamp': {
       type: 'date'
     },
     label: {
-      type: 'text'
+      type: 'text',
+      fields: {
+        // Adding keyword type to be able to sort by label alphabetically
+        keyword: {
+          type: 'keyword'
+        }
+      }
     },
     url: {
       type: 'keyword'
diff --git a/x-pack/plugins/apm/server/lib/settings/custom_link/create_or_update_custom_link.ts b/x-pack/plugins/apm/server/lib/settings/custom_link/create_or_update_custom_link.ts
index 809fe2050a072..5dce371e4f307 100644
--- a/x-pack/plugins/apm/server/lib/settings/custom_link/create_or_update_custom_link.ts
+++ b/x-pack/plugins/apm/server/lib/settings/custom_link/create_or_update_custom_link.ts
@@ -5,7 +5,7 @@
  */
 
 import { pick } from 'lodash';
-import { filterOptions } from '../../../routes/settings/custom_link';
+import { FILTER_OPTIONS } from '../../../../common/custom_link_filter_options';
 import { APMIndexDocumentParams } from '../../helpers/es_client';
 import { Setup } from '../../helpers/setup_request';
 import { CustomLink } from './custom_link_types';
@@ -28,7 +28,7 @@ export async function createOrUpdateCustomLink({
       '@timestamp': Date.now(),
       label: customLink.label,
       url: customLink.url,
-      ...pick(customLink, filterOptions)
+      ...pick(customLink, FILTER_OPTIONS)
     }
   };
 
diff --git a/x-pack/plugins/apm/server/lib/settings/custom_link/custom_link_types.d.ts b/x-pack/plugins/apm/server/lib/settings/custom_link/custom_link_types.d.ts
index 60b97712713a9..edb9eb35b9029 100644
--- a/x-pack/plugins/apm/server/lib/settings/custom_link/custom_link_types.d.ts
+++ b/x-pack/plugins/apm/server/lib/settings/custom_link/custom_link_types.d.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import * as t from 'io-ts';
-import { FilterOptions } from '../../../routes/settings/custom_link';
+import { FilterOptions } from '../../../../common/custom_link_filter_options';
 
 export type CustomLink = {
   id?: string;
diff --git a/x-pack/plugins/apm/server/lib/settings/custom_link/get_transaction.ts b/x-pack/plugins/apm/server/lib/settings/custom_link/get_transaction.ts
new file mode 100644
index 0000000000000..396a7cb29f014
--- /dev/null
+++ b/x-pack/plugins/apm/server/lib/settings/custom_link/get_transaction.ts
@@ -0,0 +1,38 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pick } from 'lodash';
+import {
+  FilterOptions,
+  FILTER_OPTIONS
+} from '../../../../common/custom_link_filter_options';
+import { Transaction } from '../../../../typings/es_schemas/ui/transaction';
+import { Setup } from '../../helpers/setup_request';
+
+export async function getTransaction({
+  setup,
+  filters = {}
+}: {
+  setup: Setup;
+  filters?: FilterOptions;
+}) {
+  const { client, indices } = setup;
+
+  const esFilters = Object.entries(pick(filters, FILTER_OPTIONS)).map(
+    ([key, value]) => {
+      return { term: { [key]: value } };
+    }
+  );
+
+  const params = {
+    terminateAfter: 1,
+    index: indices['apm_oss.transactionIndices'],
+    size: 1,
+    body: { query: { bool: { filter: esFilters } } }
+  };
+  const resp = await client.search<Transaction>(params);
+  return resp.hits.hits[0]?._source;
+}
diff --git a/x-pack/plugins/apm/server/lib/settings/custom_link/list_custom_links.ts b/x-pack/plugins/apm/server/lib/settings/custom_link/list_custom_links.ts
index e6052da73b0db..67956ef3a60ce 100644
--- a/x-pack/plugins/apm/server/lib/settings/custom_link/list_custom_links.ts
+++ b/x-pack/plugins/apm/server/lib/settings/custom_link/list_custom_links.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { FilterOptions } from '../../../../common/custom_link_filter_options';
 import { Setup } from '../../helpers/setup_request';
 import { CustomLink } from './custom_link_types';
-import { FilterOptions } from '../../../routes/settings/custom_link';
 
 export async function listCustomLinks({
   setup,
@@ -37,7 +37,14 @@ export async function listCustomLinks({
         bool: {
           filter: esFilters
         }
-      }
+      },
+      sort: [
+        {
+          'label.keyword': {
+            order: 'asc'
+          }
+        }
+      ]
     }
   };
   const resp = await internalClient.search<CustomLink>(params);
diff --git a/x-pack/plugins/apm/server/plugin.ts b/x-pack/plugins/apm/server/plugin.ts
index db14730f802a9..e18b6d33ca419 100644
--- a/x-pack/plugins/apm/server/plugin.ts
+++ b/x-pack/plugins/apm/server/plugin.ts
@@ -8,9 +8,11 @@ import { Observable, combineLatest, AsyncSubject } from 'rxjs';
 import { map, take } from 'rxjs/operators';
 import { Server } from 'hapi';
 import { once } from 'lodash';
-import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
+import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/server';
+import { TaskManagerSetupContract } from '../../task_manager/server';
+import { AlertingPlugin } from '../../alerting/server';
+import { ActionsPlugin } from '../../actions/server';
 import { APMOSSPluginSetup } from '../../../../src/plugins/apm_oss/server';
-import { makeApmUsageCollector } from './lib/apm_telemetry';
 import { createApmAgentConfigurationIndex } from './lib/settings/agent_configuration/create_agent_config_index';
 import { createApmCustomLinkIndex } from './lib/settings/custom_link/create_custom_link_index';
 import { createApmApi } from './routes/create_apm_api';
@@ -21,6 +23,8 @@ import { tutorialProvider } from './tutorial';
 import { CloudSetup } from '../../cloud/server';
 import { getInternalSavedObjectsClient } from './lib/helpers/get_internal_saved_objects_client';
 import { LicensingPluginSetup } from '../../licensing/public';
+import { registerApmAlerts } from './lib/alerts/register_apm_alerts';
+import { createApmTelemetry } from './lib/apm_telemetry';
 
 export interface LegacySetup {
   server: Server;
@@ -47,20 +51,45 @@ export class APMPlugin implements Plugin<APMPluginContract> {
       licensing: LicensingPluginSetup;
       cloud?: CloudSetup;
       usageCollection?: UsageCollectionSetup;
+      taskManager?: TaskManagerSetupContract;
+      alerting?: AlertingPlugin['setup'];
+      actions?: ActionsPlugin['setup'];
     }
   ) {
-    const logger = this.initContext.logger.get('apm');
+    const logger = this.initContext.logger.get();
     const config$ = this.initContext.config.create<APMXPackConfig>();
     const mergedConfig$ = combineLatest(plugins.apm_oss.config$, config$).pipe(
       map(([apmOssConfig, apmConfig]) => mergeConfigs(apmOssConfig, apmConfig))
     );
 
+    if (plugins.actions && plugins.alerting) {
+      registerApmAlerts({
+        alerting: plugins.alerting,
+        actions: plugins.actions,
+        config$: mergedConfig$
+      });
+    }
+
     this.legacySetup$.subscribe(__LEGACY => {
       createApmApi().init(core, { config$: mergedConfig$, logger, __LEGACY });
     });
 
     const currentConfig = await mergedConfig$.pipe(take(1)).toPromise();
 
+    if (
+      plugins.taskManager &&
+      plugins.usageCollection &&
+      currentConfig['xpack.apm.telemetryCollectionEnabled']
+    ) {
+      createApmTelemetry({
+        core,
+        config$: mergedConfig$,
+        usageCollector: plugins.usageCollection,
+        taskManager: plugins.taskManager,
+        logger
+      });
+    }
+
     // create agent configuration index without blocking setup lifecycle
     createApmAgentConfigurationIndex({
       esClient: core.elasticsearch.dataClient,
@@ -89,18 +118,6 @@ export class APMPlugin implements Plugin<APMPluginContract> {
       })
     );
 
-    const usageCollection = plugins.usageCollection;
-    if (usageCollection) {
-      getInternalSavedObjectsClient(core)
-        .then(savedObjectsClient => {
-          makeApmUsageCollector(usageCollection, savedObjectsClient);
-        })
-        .catch(error => {
-          logger.error('Unable to initialize use collection');
-          logger.error(error.message);
-        });
-    }
-
     return {
       config$: mergedConfig$,
       registerLegacyAPI: once((__LEGACY: LegacySetup) => {
@@ -115,6 +132,7 @@ export class APMPlugin implements Plugin<APMPluginContract> {
     };
   }
 
-  public start() {}
+  public async start() {}
+
   public stop() {}
 }
diff --git a/x-pack/plugins/apm/server/routes/create_api/index.test.ts b/x-pack/plugins/apm/server/routes/create_api/index.test.ts
index e639bb5101e2f..312dae1d1f9d2 100644
--- a/x-pack/plugins/apm/server/routes/create_api/index.test.ts
+++ b/x-pack/plugins/apm/server/routes/create_api/index.test.ts
@@ -36,6 +36,7 @@ const getCoreMock = () => {
     put,
     createRouter,
     context: {
+      measure: () => undefined,
       config$: new BehaviorSubject({} as APMConfig),
       logger: ({
         error: jest.fn()
diff --git a/x-pack/plugins/apm/server/routes/create_apm_api.ts b/x-pack/plugins/apm/server/routes/create_apm_api.ts
index 34f0536a90b4d..57b3f282852c4 100644
--- a/x-pack/plugins/apm/server/routes/create_apm_api.ts
+++ b/x-pack/plugins/apm/server/routes/create_apm_api.ts
@@ -22,6 +22,7 @@ import {
 } from './services';
 import {
   agentConfigurationRoute,
+  getSingleAgentConfigurationRoute,
   agentConfigurationSearchRoute,
   deleteAgentConfigurationRoute,
   listAgentConfigurationEnvironmentsRoute,
@@ -63,7 +64,8 @@ import {
   createCustomLinkRoute,
   updateCustomLinkRoute,
   deleteCustomLinkRoute,
-  listCustomLinksRoute
+  listCustomLinksRoute,
+  customLinkTransactionRoute
 } from './settings/custom_link';
 
 const createApmApi = () => {
@@ -85,6 +87,7 @@ const createApmApi = () => {
     .add(serviceAnnotationsRoute)
 
     // Agent configuration
+    .add(getSingleAgentConfigurationRoute)
     .add(agentConfigurationAgentNameRoute)
     .add(agentConfigurationRoute)
     .add(agentConfigurationSearchRoute)
@@ -138,7 +141,8 @@ const createApmApi = () => {
     .add(createCustomLinkRoute)
     .add(updateCustomLinkRoute)
     .add(deleteCustomLinkRoute)
-    .add(listCustomLinksRoute);
+    .add(listCustomLinksRoute)
+    .add(customLinkTransactionRoute);
 
   return api;
 };
diff --git a/x-pack/plugins/apm/server/routes/services.ts b/x-pack/plugins/apm/server/routes/services.ts
index 2d4fae9d2707a..1c6561ee24c93 100644
--- a/x-pack/plugins/apm/server/routes/services.ts
+++ b/x-pack/plugins/apm/server/routes/services.ts
@@ -5,11 +5,6 @@
  */
 
 import * as t from 'io-ts';
-import { AgentName } from '../../typings/es_schemas/ui/fields/agent';
-import {
-  createApmTelementry,
-  storeApmServicesTelemetry
-} from '../lib/apm_telemetry';
 import { setupRequest } from '../lib/helpers/setup_request';
 import { getServiceAgentName } from '../lib/services/get_service_agent_name';
 import { getServices } from '../lib/services/get_services';
@@ -18,7 +13,6 @@ import { getServiceNodeMetadata } from '../lib/services/get_service_node_metadat
 import { createRoute } from './create_route';
 import { uiFiltersRt, rangeRt } from './default_api_types';
 import { getServiceAnnotations } from '../lib/services/annotations';
-import { getInternalSavedObjectsClient } from '../lib/helpers/get_internal_saved_objects_client';
 
 export const servicesRoute = createRoute(core => ({
   path: '/api/apm/services',
@@ -29,16 +23,6 @@ export const servicesRoute = createRoute(core => ({
     const setup = await setupRequest(context, request);
     const services = await getServices(setup);
 
-    // Store telemetry data derived from services
-    const agentNames = services.items.map(
-      ({ agentName }) => agentName as AgentName
-    );
-    const apmTelemetry = createApmTelementry(agentNames);
-    const savedObjectsClient = await getInternalSavedObjectsClient(core);
-    storeApmServicesTelemetry(savedObjectsClient, apmTelemetry).catch(error => {
-      context.logger.error(error.message);
-    });
-
     return services;
   }
 }));
diff --git a/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts b/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
index 83b845b1fc436..8cfd736a336c2 100644
--- a/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
+++ b/x-pack/plugins/apm/server/routes/settings/agent_configuration.ts
@@ -20,7 +20,7 @@ import { markAppliedByAgent } from '../../lib/settings/agent_configuration/mark_
 import {
   serviceRt,
   agentConfigurationIntakeRt
-} from '../../../common/runtime_types/agent_configuration_intake_rt';
+} from '../../../common/agent_configuration/runtime_types/agent_configuration_intake_rt';
 import { jsonRt } from '../../../common/runtime_types/json_rt';
 
 // get list of configurations
@@ -32,6 +32,31 @@ export const agentConfigurationRoute = createRoute(core => ({
   }
 }));
 
+// get a single configuration
+export const getSingleAgentConfigurationRoute = createRoute(() => ({
+  path: '/api/apm/settings/agent-configuration/view',
+  params: {
+    query: serviceRt
+  },
+  handler: async ({ context, request }) => {
+    const setup = await setupRequest(context, request);
+    const { name, environment } = context.params.query;
+
+    const service = { name, environment };
+    const config = await findExactConfiguration({ service, setup });
+
+    if (!config) {
+      context.logger.info(
+        `Config was not found for ${service.name}/${service.environment}`
+      );
+
+      throw Boom.notFound();
+    }
+
+    return config._source;
+  }
+}));
+
 // delete configuration
 export const deleteAgentConfigurationRoute = createRoute(() => ({
   method: 'DELETE',
@@ -68,45 +93,7 @@ export const deleteAgentConfigurationRoute = createRoute(() => ({
   }
 }));
 
-// get list of services
-export const listAgentConfigurationServicesRoute = createRoute(() => ({
-  method: 'GET',
-  path: '/api/apm/settings/agent-configuration/services',
-  handler: async ({ context, request }) => {
-    const setup = await setupRequest(context, request);
-    return await getServiceNames({
-      setup
-    });
-  }
-}));
-
-// get environments for service
-export const listAgentConfigurationEnvironmentsRoute = createRoute(() => ({
-  path: '/api/apm/settings/agent-configuration/environments',
-  params: {
-    query: t.partial({ serviceName: t.string })
-  },
-  handler: async ({ context, request }) => {
-    const setup = await setupRequest(context, request);
-    const { serviceName } = context.params.query;
-    return await getEnvironments({ serviceName, setup });
-  }
-}));
-
-// get agentName for service
-export const agentConfigurationAgentNameRoute = createRoute(() => ({
-  path: '/api/apm/settings/agent-configuration/agent_name',
-  params: {
-    query: t.type({ serviceName: t.string })
-  },
-  handler: async ({ context, request }) => {
-    const setup = await setupRequest(context, request);
-    const { serviceName } = context.params.query;
-    const agentName = await getAgentNameByService({ serviceName, setup });
-    return { agentName };
-  }
-}));
-
+// create/update configuration
 export const createOrUpdateAgentConfigurationRoute = createRoute(() => ({
   method: 'PUT',
   path: '/api/apm/settings/agent-configuration',
@@ -154,10 +141,10 @@ export const agentConfigurationSearchRoute = createRoute(core => ({
   method: 'POST',
   path: '/api/apm/settings/agent-configuration/search',
   params: {
-    body: t.type({
-      service: serviceRt,
-      etag: t.string
-    })
+    body: t.intersection([
+      t.type({ service: serviceRt }),
+      t.partial({ etag: t.string })
+    ])
   },
   handler: async ({ context, request }) => {
     const { service, etag } = context.params.body;
@@ -188,3 +175,46 @@ export const agentConfigurationSearchRoute = createRoute(core => ({
     return config;
   }
 }));
+
+/*
+ * Utility endpoints (not documented as part of the public API)
+ */
+
+// get list of services
+export const listAgentConfigurationServicesRoute = createRoute(() => ({
+  method: 'GET',
+  path: '/api/apm/settings/agent-configuration/services',
+  handler: async ({ context, request }) => {
+    const setup = await setupRequest(context, request);
+    return await getServiceNames({
+      setup
+    });
+  }
+}));
+
+// get environments for service
+export const listAgentConfigurationEnvironmentsRoute = createRoute(() => ({
+  path: '/api/apm/settings/agent-configuration/environments',
+  params: {
+    query: t.partial({ serviceName: t.string })
+  },
+  handler: async ({ context, request }) => {
+    const setup = await setupRequest(context, request);
+    const { serviceName } = context.params.query;
+    return await getEnvironments({ serviceName, setup });
+  }
+}));
+
+// get agentName for service
+export const agentConfigurationAgentNameRoute = createRoute(() => ({
+  path: '/api/apm/settings/agent-configuration/agent_name',
+  params: {
+    query: t.type({ serviceName: t.string })
+  },
+  handler: async ({ context, request }) => {
+    const setup = await setupRequest(context, request);
+    const { serviceName } = context.params.query;
+    const agentName = await getAgentNameByService({ serviceName, setup });
+    return { agentName };
+  }
+}));
diff --git a/x-pack/plugins/apm/server/routes/settings/custom_link.ts b/x-pack/plugins/apm/server/routes/settings/custom_link.ts
index 5988d7f85b186..e11c1df9d4b16 100644
--- a/x-pack/plugins/apm/server/routes/settings/custom_link.ts
+++ b/x-pack/plugins/apm/server/routes/settings/custom_link.ts
@@ -4,33 +4,25 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import * as t from 'io-ts';
-import {
-  SERVICE_NAME,
-  SERVICE_ENVIRONMENT,
-  TRANSACTION_NAME,
-  TRANSACTION_TYPE
-} from '../../../common/elasticsearch_fieldnames';
+import { FilterOptionsRt } from '../../../common/custom_link_filter_options';
 import { createRoute } from '../create_route';
 import { setupRequest } from '../../lib/helpers/setup_request';
 import { createOrUpdateCustomLink } from '../../lib/settings/custom_link/create_or_update_custom_link';
 import { deleteCustomLink } from '../../lib/settings/custom_link/delete_custom_link';
 import { listCustomLinks } from '../../lib/settings/custom_link/list_custom_links';
+import { getTransaction } from '../../lib/settings/custom_link/get_transaction';
 
-const FilterOptionsRt = t.partial({
-  [SERVICE_NAME]: t.string,
-  [SERVICE_ENVIRONMENT]: t.string,
-  [TRANSACTION_NAME]: t.string,
-  [TRANSACTION_TYPE]: t.string
-});
-
-export type FilterOptions = t.TypeOf<typeof FilterOptionsRt>;
-
-export const filterOptions: Array<keyof FilterOptions> = [
-  SERVICE_NAME,
-  SERVICE_ENVIRONMENT,
-  TRANSACTION_TYPE,
-  TRANSACTION_NAME
-];
+export const customLinkTransactionRoute = createRoute(core => ({
+  path: '/api/apm/settings/custom_links/transaction',
+  params: {
+    query: FilterOptionsRt
+  },
+  handler: async ({ context, request }) => {
+    const setup = await setupRequest(context, request);
+    const { params } = context;
+    return await getTransaction({ setup, filters: params.query });
+  }
+}));
 
 export const listCustomLinksRoute = createRoute(core => ({
   path: '/api/apm/settings/custom_links',
diff --git a/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts b/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
index 6d3620f11a87b..8a8d256cf4273 100644
--- a/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
+++ b/x-pack/plugins/apm/typings/elasticsearch/aggregations.ts
@@ -126,6 +126,16 @@ export interface AggregationOptionsByType {
     combine_script: Script;
     reduce_script: Script;
   };
+  date_range: {
+    field: string;
+    format?: string;
+    ranges: Array<
+      | { from: string | number }
+      | { to: string | number }
+      | { from: string | number; to: string | number }
+    >;
+    keyed?: boolean;
+  };
 }
 
 type AggregationType = keyof AggregationOptionsByType;
@@ -136,6 +146,15 @@ type AggregationOptionsMap = Unionize<
   }
 > & { aggs?: AggregationInputMap };
 
+interface DateRangeBucket {
+  key: string;
+  to?: number;
+  from?: number;
+  to_as_string?: string;
+  from_as_string?: string;
+  doc_count: number;
+}
+
 export interface AggregationInputMap {
   [key: string]: AggregationOptionsMap;
 }
@@ -276,6 +295,11 @@ interface AggregationResponsePart<
   scripted_metric: {
     value: unknown;
   };
+  date_range: {
+    buckets: TAggregationOptionsMap extends { date_range: { keyed: true } }
+      ? Record<string, DateRangeBucket>
+      : { buckets: DateRangeBucket[] };
+  };
 }
 
 // Type for debugging purposes. If you see an error in AggregationResponseMap
@@ -285,7 +309,7 @@ interface AggregationResponsePart<
 
 // type MissingAggregationResponseTypes = Exclude<
 //   AggregationType,
-//   keyof AggregationResponsePart<{}>
+//   keyof AggregationResponsePart<{}, unknown>
 // >;
 
 export type AggregationResponseMap<
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/error_raw.ts b/x-pack/plugins/apm/typings/es_schemas/raw/error_raw.ts
index 485ad18019c12..c189c845834a4 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/error_raw.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/error_raw.ts
@@ -15,6 +15,7 @@ import { Service } from './fields/service';
 import { IStackframe } from './fields/stackframe';
 import { Url } from './fields/url';
 import { User } from './fields/user';
+import { Observer } from './fields/observer';
 
 interface Processor {
   name: 'error';
@@ -64,4 +65,5 @@ export interface ErrorRaw extends APMBaseDoc {
   service: Service;
   url?: Url;
   user?: User;
+  observer?: Observer;
 }
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts b/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts
new file mode 100644
index 0000000000000..42843130ec47f
--- /dev/null
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/fields/observer.ts
@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface Observer {
+  version: string;
+  version_major: number;
+}
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/fields/service.ts b/x-pack/plugins/apm/typings/es_schemas/raw/fields/service.ts
index 6272c06455758..676e4f49b2078 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/fields/service.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/fields/service.ts
@@ -6,6 +6,7 @@
 
 export interface Service {
   name: string;
+  environment?: string;
   framework?: {
     name: string;
     version: string;
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/span_raw.ts b/x-pack/plugins/apm/typings/es_schemas/raw/span_raw.ts
index 954e274b48c1f..7fc17151c8a89 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/span_raw.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/span_raw.ts
@@ -6,6 +6,7 @@
 
 import { APMBaseDoc } from './apm_base_doc';
 import { IStackframe } from './fields/stackframe';
+import { Observer } from './fields/observer';
 
 interface Processor {
   name: 'transaction';
@@ -52,4 +53,5 @@ export interface SpanRaw extends APMBaseDoc {
   transaction?: {
     id: string;
   };
+  observer?: Observer;
 }
diff --git a/x-pack/plugins/apm/typings/es_schemas/raw/transaction_raw.ts b/x-pack/plugins/apm/typings/es_schemas/raw/transaction_raw.ts
index 03cbd387d4fd4..84b7d3be33c92 100644
--- a/x-pack/plugins/apm/typings/es_schemas/raw/transaction_raw.ts
+++ b/x-pack/plugins/apm/typings/es_schemas/raw/transaction_raw.ts
@@ -15,6 +15,7 @@ import { Service } from './fields/service';
 import { Url } from './fields/url';
 import { User } from './fields/user';
 import { UserAgent } from './fields/user_agent';
+import { Observer } from './fields/observer';
 
 interface Processor {
   name: 'transaction';
@@ -63,4 +64,5 @@ export interface TransactionRaw extends APMBaseDoc {
   url?: Url;
   user?: User;
   user_agent?: UserAgent;
+  observer?: Observer;
 }
diff --git a/x-pack/plugins/canvas/server/plugin.ts b/x-pack/plugins/canvas/server/plugin.ts
index bfda7ef5885bc..0325de9cf29e2 100644
--- a/x-pack/plugins/canvas/server/plugin.ts
+++ b/x-pack/plugins/canvas/server/plugin.ts
@@ -32,12 +32,15 @@ export class CanvasPlugin implements Plugin {
     plugins.features.registerFeature({
       id: 'canvas',
       name: 'Canvas',
+      order: 400,
       icon: 'canvasApp',
       navLinkId: 'canvas',
       app: ['canvas', 'kibana'],
       catalogue: ['canvas'],
       privileges: {
         all: {
+          app: ['canvas', 'kibana'],
+          catalogue: ['canvas'],
           savedObject: {
             all: ['canvas-workpad', 'canvas-element'],
             read: ['index-pattern'],
@@ -45,6 +48,8 @@ export class CanvasPlugin implements Plugin {
           ui: ['save', 'show'],
         },
         read: {
+          app: ['canvas', 'kibana'],
+          catalogue: ['canvas'],
           savedObject: {
             all: [],
             read: ['index-pattern', 'canvas-workpad', 'canvas-element'],
diff --git a/x-pack/plugins/case/common/api/cases/case.ts b/x-pack/plugins/case/common/api/cases/case.ts
index 6f58e2702ec5b..ee244dd205113 100644
--- a/x-pack/plugins/case/common/api/cases/case.ts
+++ b/x-pack/plugins/case/common/api/cases/case.ts
@@ -11,6 +11,8 @@ import { UserRT } from '../user';
 import { CommentResponseRt } from './comment';
 import { CasesStatusResponseRt } from './status';
 
+export { ActionTypeExecutorResult } from '../../../../actions/server/types';
+
 const StatusRt = rt.union([rt.literal('open'), rt.literal('closed')]);
 
 const CaseBasicRt = rt.type({
@@ -20,14 +22,33 @@ const CaseBasicRt = rt.type({
   title: rt.string,
 });
 
+const CaseExternalServiceBasicRt = rt.type({
+  connector_id: rt.string,
+  connector_name: rt.string,
+  external_id: rt.string,
+  external_title: rt.string,
+  external_url: rt.string,
+});
+
+const CaseFullExternalServiceRt = rt.union([
+  rt.intersection([
+    CaseExternalServiceBasicRt,
+    rt.type({
+      pushed_at: rt.string,
+      pushed_by: UserRT,
+    }),
+  ]),
+  rt.null,
+]);
+
 export const CaseAttributesRt = rt.intersection([
   CaseBasicRt,
   rt.type({
-    comment_ids: rt.array(rt.string),
     closed_at: rt.union([rt.string, rt.null]),
     closed_by: rt.union([UserRT, rt.null]),
     created_at: rt.string,
     created_by: UserRT,
+    external_service: CaseFullExternalServiceRt,
     updated_at: rt.union([rt.string, rt.null]),
     updated_by: rt.union([UserRT, rt.null]),
   }),
@@ -35,6 +56,8 @@ export const CaseAttributesRt = rt.intersection([
 
 export const CaseRequestRt = CaseBasicRt;
 
+export const CaseExternalServiceRequestRt = CaseExternalServiceBasicRt;
+
 export const CasesFindRequestRt = rt.partial({
   tags: rt.union([rt.array(rt.string), rt.string]),
   status: StatusRt,
@@ -53,6 +76,7 @@ export const CaseResponseRt = rt.intersection([
   CaseAttributesRt,
   rt.type({
     id: rt.string,
+    totalComment: rt.number,
     version: rt.string,
   }),
   rt.partial({
@@ -78,6 +102,60 @@ export const CasePatchRequestRt = rt.intersection([
 export const CasesPatchRequestRt = rt.type({ cases: rt.array(CasePatchRequestRt) });
 export const CasesResponseRt = rt.array(CaseResponseRt);
 
+/*
+ * This type are related to this file below
+ * x-pack/plugins/actions/server/builtin_action_types/servicenow/schema.ts
+ * why because this schema is not share in a common folder
+ * so we redefine then so we can use/validate types
+ */
+
+const ServiceConnectorUserParams = rt.type({
+  fullName: rt.union([rt.string, rt.null]),
+  username: rt.string,
+});
+
+export const ServiceConnectorCommentParamsRt = rt.type({
+  commentId: rt.string,
+  comment: rt.string,
+  createdAt: rt.string,
+  createdBy: ServiceConnectorUserParams,
+  updatedAt: rt.union([rt.string, rt.null]),
+  updatedBy: rt.union([ServiceConnectorUserParams, rt.null]),
+});
+
+export const ServiceConnectorCaseParamsRt = rt.intersection([
+  rt.type({
+    caseId: rt.string,
+    createdAt: rt.string,
+    createdBy: ServiceConnectorUserParams,
+    incidentId: rt.union([rt.string, rt.null]),
+    title: rt.string,
+    updatedAt: rt.union([rt.string, rt.null]),
+    updatedBy: rt.union([ServiceConnectorUserParams, rt.null]),
+  }),
+  rt.partial({
+    description: rt.string,
+    comments: rt.array(ServiceConnectorCommentParamsRt),
+  }),
+]);
+
+export const ServiceConnectorCaseResponseRt = rt.intersection([
+  rt.type({
+    number: rt.string,
+    incidentId: rt.string,
+    pushedDate: rt.string,
+    url: rt.string,
+  }),
+  rt.partial({
+    comments: rt.array(
+      rt.type({
+        commentId: rt.string,
+        pushedDate: rt.string,
+      })
+    ),
+  }),
+]);
+
 export type CaseAttributes = rt.TypeOf<typeof CaseAttributesRt>;
 export type CaseRequest = rt.TypeOf<typeof CaseRequestRt>;
 export type CaseResponse = rt.TypeOf<typeof CaseResponseRt>;
@@ -85,3 +163,8 @@ export type CasesResponse = rt.TypeOf<typeof CasesResponseRt>;
 export type CasesFindResponse = rt.TypeOf<typeof CasesFindResponseRt>;
 export type CasePatchRequest = rt.TypeOf<typeof CasePatchRequestRt>;
 export type CasesPatchRequest = rt.TypeOf<typeof CasesPatchRequestRt>;
+export type CaseExternalServiceRequest = rt.TypeOf<typeof CaseExternalServiceRequestRt>;
+export type ServiceConnectorCaseParams = rt.TypeOf<typeof ServiceConnectorCaseParamsRt>;
+export type ServiceConnectorCaseResponse = rt.TypeOf<typeof ServiceConnectorCaseResponseRt>;
+export type CaseFullExternalService = rt.TypeOf<typeof CaseFullExternalServiceRt>;
+export type ServiceConnectorCommentParams = rt.TypeOf<typeof ServiceConnectorCommentParamsRt>;
diff --git a/x-pack/plugins/case/common/api/cases/comment.ts b/x-pack/plugins/case/common/api/cases/comment.ts
index cebfa00425728..4549b1c31a7cf 100644
--- a/x-pack/plugins/case/common/api/cases/comment.ts
+++ b/x-pack/plugins/case/common/api/cases/comment.ts
@@ -17,6 +17,8 @@ export const CommentAttributesRt = rt.intersection([
   rt.type({
     created_at: rt.string,
     created_by: UserRT,
+    pushed_at: rt.union([rt.string, rt.null]),
+    pushed_by: rt.union([UserRT, rt.null]),
     updated_at: rt.union([rt.string, rt.null]),
     updated_by: rt.union([UserRT, rt.null]),
   }),
diff --git a/x-pack/plugins/case/common/api/cases/configure.ts b/x-pack/plugins/case/common/api/cases/configure.ts
index e0489ed7270fa..9b210c2aa05ad 100644
--- a/x-pack/plugins/case/common/api/cases/configure.ts
+++ b/x-pack/plugins/case/common/api/cases/configure.ts
@@ -73,6 +73,7 @@ const ClosureTypeRT = rt.union([rt.literal('close-by-user'), rt.literal('close-b
 
 const CasesConfigureBasicRt = rt.type({
   connector_id: rt.string,
+  connector_name: rt.string,
   closure_type: ClosureTypeRT,
 });
 
diff --git a/x-pack/plugins/case/common/api/cases/index.ts b/x-pack/plugins/case/common/api/cases/index.ts
index 5fbee98bc57ad..ffcd4d25eecf5 100644
--- a/x-pack/plugins/case/common/api/cases/index.ts
+++ b/x-pack/plugins/case/common/api/cases/index.ts
@@ -8,3 +8,4 @@ export * from './case';
 export * from './configure';
 export * from './comment';
 export * from './status';
+export * from './user_actions';
diff --git a/x-pack/plugins/case/common/api/cases/user_actions.ts b/x-pack/plugins/case/common/api/cases/user_actions.ts
new file mode 100644
index 0000000000000..2b70a698a5152
--- /dev/null
+++ b/x-pack/plugins/case/common/api/cases/user_actions.ts
@@ -0,0 +1,59 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as rt from 'io-ts';
+
+import { UserRT } from '../user';
+
+/* To the next developer, if you add/removed fields here
+ * make sure to check this file (x-pack/plugins/case/server/services/user_actions/helpers.ts) too
+ */
+const UserActionFieldRt = rt.array(
+  rt.union([
+    rt.literal('comment'),
+    rt.literal('description'),
+    rt.literal('pushed'),
+    rt.literal('tags'),
+    rt.literal('title'),
+    rt.literal('status'),
+  ])
+);
+const UserActionRt = rt.union([
+  rt.literal('add'),
+  rt.literal('create'),
+  rt.literal('delete'),
+  rt.literal('update'),
+  rt.literal('push-to-service'),
+]);
+
+// TO DO change state to status
+const CaseUserActionBasicRT = rt.type({
+  action_field: UserActionFieldRt,
+  action: UserActionRt,
+  action_at: rt.string,
+  action_by: UserRT,
+  new_value: rt.union([rt.string, rt.null]),
+  old_value: rt.union([rt.string, rt.null]),
+});
+
+const CaseUserActionResponseRT = rt.intersection([
+  CaseUserActionBasicRT,
+  rt.type({
+    action_id: rt.string,
+    case_id: rt.string,
+    comment_id: rt.union([rt.string, rt.null]),
+  }),
+]);
+
+export const CaseUserActionAttributesRt = CaseUserActionBasicRT;
+
+export const CaseUserActionsResponseRt = rt.array(CaseUserActionResponseRT);
+
+export type CaseUserActionAttributes = rt.TypeOf<typeof CaseUserActionAttributesRt>;
+export type CaseUserActionsResponse = rt.TypeOf<typeof CaseUserActionsResponseRt>;
+
+export type UserAction = rt.TypeOf<typeof UserActionRt>;
+export type UserActionField = rt.TypeOf<typeof UserActionFieldRt>;
diff --git a/x-pack/plugins/case/server/plugin.ts b/x-pack/plugins/case/server/plugin.ts
index 1d6495c2d81f3..a6a459373b0ed 100644
--- a/x-pack/plugins/case/server/plugin.ts
+++ b/x-pack/plugins/case/server/plugin.ts
@@ -16,8 +16,9 @@ import {
   caseSavedObjectType,
   caseConfigureSavedObjectType,
   caseCommentSavedObjectType,
+  caseUserActionSavedObjectType,
 } from './saved_object_types';
-import { CaseConfigureService, CaseService } from './services';
+import { CaseConfigureService, CaseService, CaseUserActionService } from './services';
 
 function createConfig$(context: PluginInitializerContext) {
   return context.config.create<ConfigType>().pipe(map(config => config));
@@ -46,9 +47,11 @@ export class CasePlugin {
     core.savedObjects.registerType(caseSavedObjectType);
     core.savedObjects.registerType(caseCommentSavedObjectType);
     core.savedObjects.registerType(caseConfigureSavedObjectType);
+    core.savedObjects.registerType(caseUserActionSavedObjectType);
 
     const caseServicePlugin = new CaseService(this.log);
     const caseConfigureServicePlugin = new CaseConfigureService(this.log);
+    const userActionServicePlugin = new CaseUserActionService(this.log);
 
     this.log.debug(
       `Setting up Case Workflow with core contract [${Object.keys(
@@ -60,11 +63,13 @@ export class CasePlugin {
       authentication: plugins.security.authc,
     });
     const caseConfigureService = await caseConfigureServicePlugin.setup();
+    const userActionService = await userActionServicePlugin.setup();
 
     const router = core.http.createRouter();
     initCaseApi({
       caseConfigureService,
       caseService,
+      userActionService,
       router,
     });
   }
diff --git a/x-pack/plugins/case/server/routes/api/__fixtures__/mock_router.ts b/x-pack/plugins/case/server/routes/api/__fixtures__/mock_router.ts
index bc41ddbeff1f9..eff91fff32c02 100644
--- a/x-pack/plugins/case/server/routes/api/__fixtures__/mock_router.ts
+++ b/x-pack/plugins/case/server/routes/api/__fixtures__/mock_router.ts
@@ -32,6 +32,10 @@ export const createRoute = async (
     caseConfigureService,
     caseService,
     router,
+    userActionService: {
+      postUserActions: jest.fn(),
+      getUserActions: jest.fn(),
+    },
   });
 
   return router[method].mock.calls[0][1];
diff --git a/x-pack/plugins/case/server/routes/api/__fixtures__/mock_saved_objects.ts b/x-pack/plugins/case/server/routes/api/__fixtures__/mock_saved_objects.ts
index 5aa8b93f17b08..03da50f886fd5 100644
--- a/x-pack/plugins/case/server/routes/api/__fixtures__/mock_saved_objects.ts
+++ b/x-pack/plugins/case/server/routes/api/__fixtures__/mock_saved_objects.ts
@@ -14,7 +14,6 @@ export const mockCases: Array<SavedObject<CaseAttributes>> = [
     attributes: {
       closed_at: null,
       closed_by: null,
-      comment_ids: ['mock-comment-1'],
       created_at: '2019-11-25T21:54:48.952Z',
       created_by: {
         full_name: 'elastic',
@@ -22,6 +21,7 @@ export const mockCases: Array<SavedObject<CaseAttributes>> = [
         username: 'elastic',
       },
       description: 'This is a brand new case of a bad meanie defacing data',
+      external_service: null,
       title: 'Super Bad Security Issue',
       status: 'open',
       tags: ['defacement'],
@@ -42,7 +42,6 @@ export const mockCases: Array<SavedObject<CaseAttributes>> = [
     attributes: {
       closed_at: null,
       closed_by: null,
-      comment_ids: [],
       created_at: '2019-11-25T22:32:00.900Z',
       created_by: {
         full_name: 'elastic',
@@ -50,6 +49,7 @@ export const mockCases: Array<SavedObject<CaseAttributes>> = [
         username: 'elastic',
       },
       description: 'Oh no, a bad meanie destroying data!',
+      external_service: null,
       title: 'Damaging Data Destruction Detected',
       status: 'open',
       tags: ['Data Destruction'],
@@ -70,7 +70,6 @@ export const mockCases: Array<SavedObject<CaseAttributes>> = [
     attributes: {
       closed_at: null,
       closed_by: null,
-      comment_ids: [],
       created_at: '2019-11-25T22:32:17.947Z',
       created_by: {
         full_name: 'elastic',
@@ -78,6 +77,7 @@ export const mockCases: Array<SavedObject<CaseAttributes>> = [
         username: 'elastic',
       },
       description: 'Oh no, a bad meanie going LOLBins all over the place!',
+      external_service: null,
       title: 'Another bad one',
       status: 'open',
       tags: ['LOLBins'],
@@ -102,7 +102,6 @@ export const mockCases: Array<SavedObject<CaseAttributes>> = [
         email: 'testemail@elastic.co',
         username: 'elastic',
       },
-      comment_ids: [],
       created_at: '2019-11-25T22:32:17.947Z',
       created_by: {
         full_name: 'elastic',
@@ -110,8 +109,9 @@ export const mockCases: Array<SavedObject<CaseAttributes>> = [
         username: 'elastic',
       },
       description: 'Oh no, a bad meanie going LOLBins all over the place!',
-      title: 'Another bad one',
+      external_service: null,
       status: 'closed',
+      title: 'Another bad one',
       tags: ['LOLBins'],
       updated_at: '2019-11-25T22:32:17.947Z',
       updated_by: {
@@ -147,6 +147,8 @@ export const mockCaseComments: Array<SavedObject<CommentAttributes>> = [
         email: 'testemail@elastic.co',
         username: 'elastic',
       },
+      pushed_at: null,
+      pushed_by: null,
       updated_at: '2019-11-25T21:55:00.177Z',
       updated_by: {
         full_name: 'elastic',
@@ -175,6 +177,8 @@ export const mockCaseComments: Array<SavedObject<CommentAttributes>> = [
         email: 'testemail@elastic.co',
         username: 'elastic',
       },
+      pushed_at: null,
+      pushed_by: null,
       updated_at: '2019-11-25T21:55:14.633Z',
       updated_by: {
         full_name: 'elastic',
@@ -204,6 +208,8 @@ export const mockCaseComments: Array<SavedObject<CommentAttributes>> = [
         email: 'testemail@elastic.co',
         username: 'elastic',
       },
+      pushed_at: null,
+      pushed_by: null,
       updated_at: '2019-11-25T22:32:30.608Z',
       updated_by: {
         full_name: 'elastic',
diff --git a/x-pack/plugins/case/server/routes/api/cases/comments/delete_all_comments.ts b/x-pack/plugins/case/server/routes/api/cases/comments/delete_all_comments.ts
index 00d06bfdd2677..941ac90f2e90e 100644
--- a/x-pack/plugins/case/server/routes/api/cases/comments/delete_all_comments.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/comments/delete_all_comments.ts
@@ -5,10 +5,12 @@
  */
 
 import { schema } from '@kbn/config-schema';
+
+import { buildCommentUserActionItem } from '../../../../services/user_actions/helpers';
 import { RouteDeps } from '../../types';
 import { wrapError } from '../../utils';
 
-export function initDeleteAllCommentsApi({ caseService, router }: RouteDeps) {
+export function initDeleteAllCommentsApi({ caseService, router, userActionService }: RouteDeps) {
   router.delete(
     {
       path: '/api/cases/{case_id}/comments',
@@ -21,9 +23,11 @@ export function initDeleteAllCommentsApi({ caseService, router }: RouteDeps) {
     async (context, request, response) => {
       try {
         const client = context.core.savedObjects.client;
+        const { username, full_name, email } = await caseService.getUser({ request, response });
+        const deleteDate = new Date().toISOString();
 
         const comments = await caseService.getAllCaseComments({
-          client: context.core.savedObjects.client,
+          client,
           caseId: request.params.case_id,
         });
         await Promise.all(
@@ -35,15 +39,18 @@ export function initDeleteAllCommentsApi({ caseService, router }: RouteDeps) {
           )
         );
 
-        const updateCase = {
-          comment_ids: [],
-        };
-        await caseService.patchCase({
-          client: context.core.savedObjects.client,
-          caseId: request.params.case_id,
-          updatedAttributes: {
-            ...updateCase,
-          },
+        await userActionService.postUserActions({
+          client,
+          actions: comments.saved_objects.map(comment =>
+            buildCommentUserActionItem({
+              action: 'delete',
+              actionAt: deleteDate,
+              actionBy: { username, full_name, email },
+              caseId: request.params.case_id,
+              commentId: comment.id,
+              fields: ['comment'],
+            })
+          ),
         });
 
         return response.ok({ body: 'true' });
diff --git a/x-pack/plugins/case/server/routes/api/cases/comments/delete_comment.ts b/x-pack/plugins/case/server/routes/api/cases/comments/delete_comment.ts
index 85c4701f82e1d..44e57fc809e04 100644
--- a/x-pack/plugins/case/server/routes/api/cases/comments/delete_comment.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/comments/delete_comment.ts
@@ -6,10 +6,13 @@
 
 import Boom from 'boom';
 import { schema } from '@kbn/config-schema';
+
+import { CASE_SAVED_OBJECT } from '../../../../saved_object_types';
+import { buildCommentUserActionItem } from '../../../../services/user_actions/helpers';
 import { RouteDeps } from '../../types';
 import { wrapError } from '../../utils';
 
-export function initDeleteCommentApi({ caseService, router }: RouteDeps) {
+export function initDeleteCommentApi({ caseService, router, userActionService }: RouteDeps) {
   router.delete(
     {
       path: '/api/cases/{case_id}/comments/{comment_id}',
@@ -23,14 +26,22 @@ export function initDeleteCommentApi({ caseService, router }: RouteDeps) {
     async (context, request, response) => {
       try {
         const client = context.core.savedObjects.client;
-        const myCase = await caseService.getCase({
-          client: context.core.savedObjects.client,
-          caseId: request.params.case_id,
+        const { username, full_name, email } = await caseService.getUser({ request, response });
+        const deleteDate = new Date().toISOString();
+
+        const myComment = await caseService.getComment({
+          client,
+          commentId: request.params.comment_id,
         });
 
-        if (!myCase.attributes.comment_ids.includes(request.params.comment_id)) {
+        if (myComment == null) {
+          throw Boom.notFound(`This comment ${request.params.comment_id} does not exist anymore.`);
+        }
+
+        const caseRef = myComment.references.find(c => c.type === CASE_SAVED_OBJECT);
+        if (caseRef == null || (caseRef != null && caseRef.id !== request.params.case_id)) {
           throw Boom.notFound(
-            `This comment ${request.params.comment_id} does not exist in ${myCase.attributes.title} (id: ${request.params.case_id}).`
+            `This comment ${request.params.comment_id} does not exist in ${request.params.case_id}).`
           );
         }
 
@@ -39,17 +50,18 @@ export function initDeleteCommentApi({ caseService, router }: RouteDeps) {
           commentId: request.params.comment_id,
         });
 
-        const updateCase = {
-          comment_ids: myCase.attributes.comment_ids.filter(
-            cId => cId !== request.params.comment_id
-          ),
-        };
-        await caseService.patchCase({
-          client: context.core.savedObjects.client,
-          caseId: request.params.case_id,
-          updatedAttributes: {
-            ...updateCase,
-          },
+        await userActionService.postUserActions({
+          client,
+          actions: [
+            buildCommentUserActionItem({
+              action: 'delete',
+              actionAt: deleteDate,
+              actionBy: { username, full_name, email },
+              caseId: request.params.case_id,
+              commentId: request.params.comment_id,
+              fields: ['comment'],
+            }),
+          ],
         });
 
         return response.ok({ body: 'true' });
diff --git a/x-pack/plugins/case/server/routes/api/cases/comments/find_comments.ts b/x-pack/plugins/case/server/routes/api/cases/comments/find_comments.ts
index dcf70d0d9819c..92da64cebee74 100644
--- a/x-pack/plugins/case/server/routes/api/cases/comments/find_comments.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/comments/find_comments.ts
@@ -32,6 +32,7 @@ export function initFindCaseCommentsApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const query = pipe(
           SavedObjectFindOptionsRt.decode(request.query),
           fold(throwErrors(Boom.badRequest), identity)
@@ -39,7 +40,7 @@ export function initFindCaseCommentsApi({ caseService, router }: RouteDeps) {
 
         const args = query
           ? {
-              client: context.core.savedObjects.client,
+              client,
               caseId: request.params.case_id,
               options: {
                 ...query,
@@ -47,7 +48,7 @@ export function initFindCaseCommentsApi({ caseService, router }: RouteDeps) {
               },
             }
           : {
-              client: context.core.savedObjects.client,
+              client,
               caseId: request.params.case_id,
             };
 
diff --git a/x-pack/plugins/case/server/routes/api/cases/comments/get_all_comment.ts b/x-pack/plugins/case/server/routes/api/cases/comments/get_all_comment.ts
index 65f2de7125236..1500039eb2cc2 100644
--- a/x-pack/plugins/case/server/routes/api/cases/comments/get_all_comment.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/comments/get_all_comment.ts
@@ -22,8 +22,9 @@ export function initGetAllCommentsApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const comments = await caseService.getAllCaseComments({
-          client: context.core.savedObjects.client,
+          client,
           caseId: request.params.case_id,
         });
         return response.ok({
diff --git a/x-pack/plugins/case/server/routes/api/cases/comments/get_comment.ts b/x-pack/plugins/case/server/routes/api/cases/comments/get_comment.ts
index 06619abae8487..24f44a5f5129b 100644
--- a/x-pack/plugins/case/server/routes/api/cases/comments/get_comment.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/comments/get_comment.ts
@@ -5,7 +5,6 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import Boom from 'boom';
 
 import { CommentResponseRt } from '../../../../../common/api';
 import { RouteDeps } from '../../types';
@@ -25,16 +24,6 @@ export function initGetCommentApi({ caseService, router }: RouteDeps) {
     async (context, request, response) => {
       try {
         const client = context.core.savedObjects.client;
-        const myCase = await caseService.getCase({
-          client,
-          caseId: request.params.case_id,
-        });
-
-        if (!myCase.attributes.comment_ids.includes(request.params.comment_id)) {
-          throw Boom.notFound(
-            `This comment ${request.params.comment_id} does not exist in ${myCase.attributes.title} (id: ${request.params.case_id}).`
-          );
-        }
 
         const comment = await caseService.getComment({
           client,
diff --git a/x-pack/plugins/case/server/routes/api/cases/comments/patch_comment.ts b/x-pack/plugins/case/server/routes/api/cases/comments/patch_comment.ts
index c14a94e84e51c..c67ad1bdaea71 100644
--- a/x-pack/plugins/case/server/routes/api/cases/comments/patch_comment.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/comments/patch_comment.ts
@@ -11,11 +11,12 @@ import { fold } from 'fp-ts/lib/Either';
 import { identity } from 'fp-ts/lib/function';
 
 import { CommentPatchRequestRt, CommentResponseRt, throwErrors } from '../../../../../common/api';
-
+import { CASE_SAVED_OBJECT } from '../../../../saved_object_types';
+import { buildCommentUserActionItem } from '../../../../services/user_actions/helpers';
 import { RouteDeps } from '../../types';
 import { escapeHatch, wrapError, flattenCommentSavedObject } from '../../utils';
 
-export function initPatchCommentApi({ caseService, router }: RouteDeps) {
+export function initPatchCommentApi({ caseService, router, userActionService }: RouteDeps) {
   router.patch(
     {
       path: '/api/cases/{case_id}/comments',
@@ -28,46 +29,63 @@ export function initPatchCommentApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const query = pipe(
           CommentPatchRequestRt.decode(request.body),
           fold(throwErrors(Boom.badRequest), identity)
         );
 
-        const myCase = await caseService.getCase({
-          client: context.core.savedObjects.client,
-          caseId: request.params.case_id,
+        const myComment = await caseService.getComment({
+          client,
+          commentId: query.id,
         });
 
-        if (!myCase.attributes.comment_ids.includes(query.id)) {
+        if (myComment == null) {
+          throw Boom.notFound(`This comment ${query.id} does not exist anymore.`);
+        }
+
+        const caseRef = myComment.references.find(c => c.type === CASE_SAVED_OBJECT);
+        if (caseRef == null || (caseRef != null && caseRef.id !== request.params.case_id)) {
           throw Boom.notFound(
-            `This comment ${query.id} does not exist in ${myCase.attributes.title} (id: ${request.params.case_id}).`
+            `This comment ${query.id} does not exist in ${request.params.case_id}).`
           );
         }
 
-        const myComment = await caseService.getComment({
-          client: context.core.savedObjects.client,
-          commentId: query.id,
-        });
-
         if (query.version !== myComment.version) {
           throw Boom.conflict(
             'This case has been updated. Please refresh before saving additional updates.'
           );
         }
 
-        const updatedBy = await caseService.getUser({ request, response });
-        const { email, full_name, username } = updatedBy;
+        const { username, full_name, email } = await caseService.getUser({ request, response });
+        const updatedDate = new Date().toISOString();
         const updatedComment = await caseService.patchComment({
-          client: context.core.savedObjects.client,
+          client,
           commentId: query.id,
           updatedAttributes: {
             comment: query.comment,
-            updated_at: new Date().toISOString(),
+            updated_at: updatedDate,
             updated_by: { email, full_name, username },
           },
           version: query.version,
         });
 
+        await userActionService.postUserActions({
+          client,
+          actions: [
+            buildCommentUserActionItem({
+              action: 'update',
+              actionAt: updatedDate,
+              actionBy: { username, full_name, email },
+              caseId: request.params.case_id,
+              commentId: updatedComment.id,
+              fields: ['comment'],
+              newValue: query.comment,
+              oldValue: myComment.attributes.comment,
+            }),
+          ],
+        });
+
         return response.ok({
           body: CommentResponseRt.encode(
             flattenCommentSavedObject({
diff --git a/x-pack/plugins/case/server/routes/api/cases/comments/post_comment.ts b/x-pack/plugins/case/server/routes/api/cases/comments/post_comment.ts
index 9e82a8ffaaec7..2410505872a3a 100644
--- a/x-pack/plugins/case/server/routes/api/cases/comments/post_comment.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/comments/post_comment.ts
@@ -12,6 +12,7 @@ import { identity } from 'fp-ts/lib/function';
 
 import { CommentRequestRt, CommentResponseRt, throwErrors } from '../../../../../common/api';
 import { CASE_SAVED_OBJECT } from '../../../../saved_object_types';
+import { buildCommentUserActionItem } from '../../../../services/user_actions/helpers';
 import {
   escapeHatch,
   transformNewComment,
@@ -20,7 +21,7 @@ import {
 } from '../../utils';
 import { RouteDeps } from '../../types';
 
-export function initPostCommentApi({ caseService, router }: RouteDeps) {
+export function initPostCommentApi({ caseService, router, userActionService }: RouteDeps) {
   router.post(
     {
       path: '/api/cases/{case_id}/comments',
@@ -33,25 +34,28 @@ export function initPostCommentApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const query = pipe(
           CommentRequestRt.decode(request.body),
           fold(throwErrors(Boom.badRequest), identity)
         );
 
         const myCase = await caseService.getCase({
-          client: context.core.savedObjects.client,
+          client,
           caseId: request.params.case_id,
         });
 
-        const createdBy = await caseService.getUser({ request, response });
+        const { username, full_name, email } = await caseService.getUser({ request, response });
         const createdDate = new Date().toISOString();
 
         const newComment = await caseService.postNewComment({
-          client: context.core.savedObjects.client,
+          client,
           attributes: transformNewComment({
             createdDate,
             ...query,
-            ...createdBy,
+            username,
+            full_name,
+            email,
           }),
           references: [
             {
@@ -62,16 +66,19 @@ export function initPostCommentApi({ caseService, router }: RouteDeps) {
           ],
         });
 
-        const updateCase = {
-          comment_ids: [...myCase.attributes.comment_ids, newComment.id],
-        };
-
-        await caseService.patchCase({
-          client: context.core.savedObjects.client,
-          caseId: request.params.case_id,
-          updatedAttributes: {
-            ...updateCase,
-          },
+        await userActionService.postUserActions({
+          client,
+          actions: [
+            buildCommentUserActionItem({
+              action: 'create',
+              actionAt: createdDate,
+              actionBy: { username, full_name, email },
+              caseId: myCase.id,
+              commentId: newComment.id,
+              fields: ['comment'],
+              newValue: query.comment,
+            }),
+          ],
         });
 
         return response.ok({
diff --git a/x-pack/plugins/case/server/routes/api/cases/configure/patch_configure.ts b/x-pack/plugins/case/server/routes/api/cases/configure/patch_configure.ts
index 1542394fc438d..3a1b9d5059cbc 100644
--- a/x-pack/plugins/case/server/routes/api/cases/configure/patch_configure.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/configure/patch_configure.ts
@@ -48,8 +48,7 @@ export function initPatchCaseConfigure({ caseConfigureService, caseService, rout
           );
         }
 
-        const updatedBy = await caseService.getUser({ request, response });
-        const { email, full_name, username } = updatedBy;
+        const { username, full_name, email } = await caseService.getUser({ request, response });
 
         const updateDate = new Date().toISOString();
         const patch = await caseConfigureService.patch({
diff --git a/x-pack/plugins/case/server/routes/api/cases/configure/post_configure.ts b/x-pack/plugins/case/server/routes/api/cases/configure/post_configure.ts
index c839d36dcf4df..2a23abf0cbf21 100644
--- a/x-pack/plugins/case/server/routes/api/cases/configure/post_configure.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/configure/post_configure.ts
@@ -42,8 +42,7 @@ export function initPostCaseConfigure({ caseConfigureService, caseService, route
             )
           );
         }
-        const updatedBy = await caseService.getUser({ request, response });
-        const { email, full_name, username } = updatedBy;
+        const { email, full_name, username } = await caseService.getUser({ request, response });
 
         const creationDate = new Date().toISOString();
         const post = await caseConfigureService.post({
diff --git a/x-pack/plugins/case/server/routes/api/cases/delete_cases.ts b/x-pack/plugins/case/server/routes/api/cases/delete_cases.ts
index 559a477a83a6c..8b0384c12edce 100644
--- a/x-pack/plugins/case/server/routes/api/cases/delete_cases.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/delete_cases.ts
@@ -5,10 +5,12 @@
  */
 
 import { schema } from '@kbn/config-schema';
+
+import { buildCaseUserActionItem } from '../../../services/user_actions/helpers';
 import { RouteDeps } from '../types';
 import { wrapError } from '../utils';
 
-export function initDeleteCasesApi({ caseService, router }: RouteDeps) {
+export function initDeleteCasesApi({ caseService, router, userActionService }: RouteDeps) {
   router.delete(
     {
       path: '/api/cases',
@@ -20,10 +22,11 @@ export function initDeleteCasesApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         await Promise.all(
           request.query.ids.map(id =>
             caseService.deleteCase({
-              client: context.core.savedObjects.client,
+              client,
               caseId: id,
             })
           )
@@ -31,7 +34,7 @@ export function initDeleteCasesApi({ caseService, router }: RouteDeps) {
         const comments = await Promise.all(
           request.query.ids.map(id =>
             caseService.getAllCaseComments({
-              client: context.core.savedObjects.client,
+              client,
               caseId: id,
             })
           )
@@ -43,7 +46,7 @@ export function initDeleteCasesApi({ caseService, router }: RouteDeps) {
               Promise.all(
                 c.saved_objects.map(({ id }) =>
                   caseService.deleteComment({
-                    client: context.core.savedObjects.client,
+                    client,
                     commentId: id,
                   })
                 )
@@ -51,6 +54,22 @@ export function initDeleteCasesApi({ caseService, router }: RouteDeps) {
             )
           );
         }
+        const { username, full_name, email } = await caseService.getUser({ request, response });
+        const deleteDate = new Date().toISOString();
+
+        await userActionService.postUserActions({
+          client,
+          actions: request.query.ids.map(id =>
+            buildCaseUserActionItem({
+              action: 'create',
+              actionAt: deleteDate,
+              actionBy: { username, full_name, email },
+              caseId: id,
+              fields: ['comment', 'description', 'status', 'tags', 'title'],
+            })
+          ),
+        });
+
         return response.ok({ body: 'true' });
       } catch (error) {
         return response.customError(wrapError(error));
diff --git a/x-pack/plugins/case/server/routes/api/cases/find_cases.ts b/x-pack/plugins/case/server/routes/api/cases/find_cases.ts
index 76a1992c64270..e7b2044f2badf 100644
--- a/x-pack/plugins/case/server/routes/api/cases/find_cases.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/find_cases.ts
@@ -13,7 +13,7 @@ import { identity } from 'fp-ts/lib/function';
 import { isEmpty } from 'lodash';
 import { CasesFindResponseRt, CasesFindRequestRt, throwErrors } from '../../../../common/api';
 import { transformCases, sortToSnake, wrapError, escapeHatch } from '../utils';
-import { RouteDeps } from '../types';
+import { RouteDeps, TotalCommentByCase } from '../types';
 import { CASE_SAVED_OBJECT } from '../../../saved_object_types';
 
 const combineFilters = (filters: string[], operator: 'OR' | 'AND'): string =>
@@ -97,9 +97,44 @@ export function initFindCasesApi({ caseService, router }: RouteDeps) {
           caseService.findCases(argsOpenCases),
           caseService.findCases(argsClosedCases),
         ]);
+
+        const totalCommentsFindByCases = await Promise.all(
+          cases.saved_objects.map(c =>
+            caseService.getAllCaseComments({
+              client,
+              caseId: c.id,
+              options: {
+                fields: [],
+                page: 1,
+                perPage: 1,
+              },
+            })
+          )
+        );
+
+        const totalCommentsByCases = totalCommentsFindByCases.reduce<TotalCommentByCase[]>(
+          (acc, itemFind) => {
+            if (itemFind.saved_objects.length > 0) {
+              const caseId =
+                itemFind.saved_objects[0].references.find(r => r.type === CASE_SAVED_OBJECT)?.id ??
+                null;
+              if (caseId != null) {
+                return [...acc, { caseId, totalComments: itemFind.total }];
+              }
+            }
+            return [...acc];
+          },
+          []
+        );
+
         return response.ok({
           body: CasesFindResponseRt.encode(
-            transformCases(cases, openCases.total ?? 0, closesCases.total ?? 0)
+            transformCases(
+              cases,
+              openCases.total ?? 0,
+              closesCases.total ?? 0,
+              totalCommentsByCases
+            )
           ),
         });
       } catch (error) {
diff --git a/x-pack/plugins/case/server/routes/api/cases/get_case.ts b/x-pack/plugins/case/server/routes/api/cases/get_case.ts
index 1415513bca346..e947118a39e8e 100644
--- a/x-pack/plugins/case/server/routes/api/cases/get_case.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/get_case.ts
@@ -25,10 +25,11 @@ export function initGetCaseApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const includeComments = JSON.parse(request.query.includeComments);
 
         const theCase = await caseService.getCase({
-          client: context.core.savedObjects.client,
+          client,
           caseId: request.params.case_id,
         });
 
@@ -37,7 +38,7 @@ export function initGetCaseApi({ caseService, router }: RouteDeps) {
         }
 
         const theComments = await caseService.getAllCaseComments({
-          client: context.core.savedObjects.client,
+          client,
           caseId: request.params.case_id,
         });
 
diff --git a/x-pack/plugins/case/server/routes/api/cases/helpers.ts b/x-pack/plugins/case/server/routes/api/cases/helpers.ts
index 3bf46cadc83c8..747b5195da7ec 100644
--- a/x-pack/plugins/case/server/routes/api/cases/helpers.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/helpers.ts
@@ -4,10 +4,57 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { difference, get } from 'lodash';
+import { get } from 'lodash';
 
 import { CaseAttributes, CasePatchRequest } from '../../../../common/api';
 
+interface CompareArrays {
+  addedItems: string[];
+  deletedItems: string[];
+}
+export const compareArrays = ({
+  originalValue,
+  updatedValue,
+}: {
+  originalValue: string[];
+  updatedValue: string[];
+}): CompareArrays => {
+  const result: CompareArrays = {
+    addedItems: [],
+    deletedItems: [],
+  };
+  originalValue.forEach(origVal => {
+    if (!updatedValue.includes(origVal)) {
+      result.deletedItems = [...result.deletedItems, origVal];
+    }
+  });
+  updatedValue.forEach(updatedVal => {
+    if (!originalValue.includes(updatedVal)) {
+      result.addedItems = [...result.addedItems, updatedVal];
+    }
+  });
+
+  return result;
+};
+
+export const isTwoArraysDifference = (
+  originalValue: unknown,
+  updatedValue: unknown
+): CompareArrays | null => {
+  if (
+    originalValue != null &&
+    updatedValue != null &&
+    Array.isArray(updatedValue) &&
+    Array.isArray(originalValue)
+  ) {
+    const compObj = compareArrays({ originalValue, updatedValue });
+    if (compObj.addedItems.length > 0 || compObj.deletedItems.length > 0) {
+      return compObj;
+    }
+  }
+  return null;
+};
+
 export const getCaseToUpdate = (
   currentCase: CaseAttributes,
   queryCase: CasePatchRequest
@@ -15,12 +62,7 @@ export const getCaseToUpdate = (
   Object.entries(queryCase).reduce(
     (acc, [key, value]) => {
       const currentValue = get(currentCase, key);
-      if (
-        currentValue != null &&
-        Array.isArray(value) &&
-        Array.isArray(currentValue) &&
-        difference(value, currentValue).length !== 0
-      ) {
+      if (isTwoArraysDifference(value, currentValue)) {
         return {
           ...acc,
           [key]: value,
diff --git a/x-pack/plugins/case/server/routes/api/cases/patch_cases.test.ts b/x-pack/plugins/case/server/routes/api/cases/patch_cases.test.ts
index 19ff7f0734a77..ac1e67cec52bd 100644
--- a/x-pack/plugins/case/server/routes/api/cases/patch_cases.test.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/patch_cases.test.ts
@@ -52,15 +52,16 @@ describe('PATCH cases', () => {
       {
         closed_at: '2019-11-25T21:54:48.952Z',
         closed_by: { email: 'd00d@awesome.com', full_name: 'Awesome D00d', username: 'awesome' },
-        comment_ids: ['mock-comment-1'],
         comments: [],
         created_at: '2019-11-25T21:54:48.952Z',
         created_by: { email: 'testemail@elastic.co', full_name: 'elastic', username: 'elastic' },
         description: 'This is a brand new case of a bad meanie defacing data',
         id: 'mock-id-1',
+        external_service: null,
         status: 'closed',
         tags: ['defacement'],
         title: 'Super Bad Security Issue',
+        totalComment: 0,
         updated_at: '2019-11-25T21:54:48.952Z',
         updated_by: { email: 'd00d@awesome.com', full_name: 'Awesome D00d', username: 'awesome' },
         version: 'WzE3LDFd',
@@ -94,15 +95,16 @@ describe('PATCH cases', () => {
       {
         closed_at: null,
         closed_by: null,
-        comment_ids: [],
         comments: [],
         created_at: '2019-11-25T22:32:17.947Z',
         created_by: { email: 'testemail@elastic.co', full_name: 'elastic', username: 'elastic' },
         description: 'Oh no, a bad meanie going LOLBins all over the place!',
         id: 'mock-id-4',
+        external_service: null,
         status: 'open',
         tags: ['LOLBins'],
         title: 'Another bad one',
+        totalComment: 0,
         updated_at: '2019-11-25T21:54:48.952Z',
         updated_by: { email: 'd00d@awesome.com', full_name: 'Awesome D00d', username: 'awesome' },
         version: 'WzE3LDFd',
diff --git a/x-pack/plugins/case/server/routes/api/cases/patch_cases.ts b/x-pack/plugins/case/server/routes/api/cases/patch_cases.ts
index 4aa0d8daf5b34..3d0b7bc79f88b 100644
--- a/x-pack/plugins/case/server/routes/api/cases/patch_cases.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/patch_cases.ts
@@ -18,8 +18,9 @@ import {
 import { escapeHatch, wrapError, flattenCaseSavedObject } from '../utils';
 import { RouteDeps } from '../types';
 import { getCaseToUpdate } from './helpers';
+import { buildCaseUserActions } from '../../../services/user_actions/helpers';
 
-export function initPatchCasesApi({ caseService, router }: RouteDeps) {
+export function initPatchCasesApi({ caseService, router, userActionService }: RouteDeps) {
   router.patch(
     {
       path: '/api/cases',
@@ -29,12 +30,13 @@ export function initPatchCasesApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const query = pipe(
           CasesPatchRequestRt.decode(request.body),
           fold(throwErrors(Boom.badRequest), identity)
         );
         const myCases = await caseService.getCases({
-          client: context.core.savedObjects.client,
+          client,
           caseIds: query.cases.map(q => q.id),
         });
         let nonExistingCases: CasePatchRequest[] = [];
@@ -72,11 +74,10 @@ export function initPatchCasesApi({ caseService, router }: RouteDeps) {
           return Object.keys(updateCaseAttributes).length > 0;
         });
         if (updateFilterCases.length > 0) {
-          const updatedBy = await caseService.getUser({ request, response });
-          const { email, full_name, username } = updatedBy;
+          const { username, full_name, email } = await caseService.getUser({ request, response });
           const updatedDt = new Date().toISOString();
           const updatedCases = await caseService.patchCases({
-            client: context.core.savedObjects.client,
+            client,
             cases: updateFilterCases.map(thisCase => {
               const { id: caseId, version, ...updateCaseAttributes } = thisCase;
               let closedInfo = {};
@@ -103,6 +104,7 @@ export function initPatchCasesApi({ caseService, router }: RouteDeps) {
               };
             }),
           });
+
           const returnUpdatedCase = myCases.saved_objects
             .filter(myCase =>
               updatedCases.saved_objects.some(updatedCase => updatedCase.id === myCase.id)
@@ -116,6 +118,17 @@ export function initPatchCasesApi({ caseService, router }: RouteDeps) {
                 references: myCase.references,
               });
             });
+
+          await userActionService.postUserActions({
+            client,
+            actions: buildCaseUserActions({
+              originalCases: myCases.saved_objects,
+              updatedCases: updatedCases.saved_objects,
+              actionDate: updatedDt,
+              actionBy: { email, full_name, username },
+            }),
+          });
+
           return response.ok({
             body: CasesResponseRt.encode(returnUpdatedCase),
           });
diff --git a/x-pack/plugins/case/server/routes/api/cases/post_case.ts b/x-pack/plugins/case/server/routes/api/cases/post_case.ts
index 9e854c3178e1e..75be68013bcd4 100644
--- a/x-pack/plugins/case/server/routes/api/cases/post_case.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/post_case.ts
@@ -12,9 +12,10 @@ import { identity } from 'fp-ts/lib/function';
 import { flattenCaseSavedObject, transformNewCase, wrapError, escapeHatch } from '../utils';
 
 import { CaseRequestRt, throwErrors, CaseResponseRt } from '../../../../common/api';
+import { buildCaseUserActionItem } from '../../../services/user_actions/helpers';
 import { RouteDeps } from '../types';
 
-export function initPostCaseApi({ caseService, router }: RouteDeps) {
+export function initPostCaseApi({ caseService, router, userActionService }: RouteDeps) {
   router.post(
     {
       path: '/api/cases',
@@ -24,21 +25,39 @@ export function initPostCaseApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const query = pipe(
           CaseRequestRt.decode(request.body),
           fold(throwErrors(Boom.badRequest), identity)
         );
 
-        const createdBy = await caseService.getUser({ request, response });
+        const { username, full_name, email } = await caseService.getUser({ request, response });
         const createdDate = new Date().toISOString();
         const newCase = await caseService.postNewCase({
-          client: context.core.savedObjects.client,
+          client,
           attributes: transformNewCase({
             createdDate,
             newCase: query,
-            ...createdBy,
+            username,
+            full_name,
+            email,
           }),
         });
+
+        await userActionService.postUserActions({
+          client,
+          actions: [
+            buildCaseUserActionItem({
+              action: 'create',
+              actionAt: createdDate,
+              actionBy: { username, full_name, email },
+              caseId: newCase.id,
+              fields: ['description', 'status', 'tags', 'title'],
+              newValue: JSON.stringify(query),
+            }),
+          ],
+        });
+
         return response.ok({ body: CaseResponseRt.encode(flattenCaseSavedObject(newCase, [])) });
       } catch (error) {
         return response.customError(wrapError(error));
diff --git a/x-pack/plugins/case/server/routes/api/cases/push_case.ts b/x-pack/plugins/case/server/routes/api/cases/push_case.ts
new file mode 100644
index 0000000000000..6ae3df180d9e4
--- /dev/null
+++ b/x-pack/plugins/case/server/routes/api/cases/push_case.ts
@@ -0,0 +1,176 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import Boom from 'boom';
+import { pipe } from 'fp-ts/lib/pipeable';
+import { fold } from 'fp-ts/lib/Either';
+import { identity } from 'fp-ts/lib/function';
+
+import { flattenCaseSavedObject, wrapError, escapeHatch } from '../utils';
+
+import { CaseExternalServiceRequestRt, CaseResponseRt, throwErrors } from '../../../../common/api';
+import { buildCaseUserActionItem } from '../../../services/user_actions/helpers';
+import { RouteDeps } from '../types';
+
+export function initPushCaseUserActionApi({
+  caseConfigureService,
+  caseService,
+  router,
+  userActionService,
+}: RouteDeps) {
+  router.post(
+    {
+      path: '/api/cases/{case_id}/_push',
+      validate: {
+        params: schema.object({
+          case_id: schema.string(),
+        }),
+        body: escapeHatch,
+      },
+    },
+    async (context, request, response) => {
+      try {
+        const client = context.core.savedObjects.client;
+        const caseId = request.params.case_id;
+        const query = pipe(
+          CaseExternalServiceRequestRt.decode(request.body),
+          fold(throwErrors(Boom.badRequest), identity)
+        );
+        const { username, full_name, email } = await caseService.getUser({ request, response });
+        const pushedDate = new Date().toISOString();
+
+        const [myCase, myCaseConfigure, totalCommentsFindByCases] = await Promise.all([
+          caseService.getCase({
+            client,
+            caseId: request.params.case_id,
+          }),
+          caseConfigureService.find({ client }),
+          caseService.getAllCaseComments({
+            client,
+            caseId,
+            options: {
+              fields: [],
+              page: 1,
+              perPage: 1,
+            },
+          }),
+        ]);
+
+        if (myCase.attributes.status === 'closed') {
+          throw Boom.conflict(
+            `This case ${myCase.attributes.title} is closed. You can not pushed if the case is closed.`
+          );
+        }
+
+        const comments = await caseService.getAllCaseComments({
+          client,
+          caseId,
+          options: {
+            fields: [],
+            page: 1,
+            perPage: totalCommentsFindByCases.total,
+          },
+        });
+
+        const externalService = {
+          pushed_at: pushedDate,
+          pushed_by: { username, full_name, email },
+          ...query,
+        };
+
+        const [updatedCase, updatedComments] = await Promise.all([
+          caseService.patchCase({
+            client,
+            caseId,
+            updatedAttributes: {
+              ...(myCaseConfigure.saved_objects[0].attributes.closure_type === 'close-by-pushing'
+                ? {
+                    status: 'closed',
+                    closed_at: pushedDate,
+                    closed_by: { email, full_name, username },
+                  }
+                : {}),
+              external_service: externalService,
+              updated_at: pushedDate,
+              updated_by: { username, full_name, email },
+            },
+            version: myCase.version,
+          }),
+          caseService.patchComments({
+            client,
+            comments: comments.saved_objects.map(comment => ({
+              commentId: comment.id,
+              updatedAttributes: {
+                pushed_at: pushedDate,
+                pushed_by: { username, full_name, email },
+                updated_at: pushedDate,
+                updated_by: { username, full_name, email },
+              },
+              version: comment.version,
+            })),
+          }),
+          userActionService.postUserActions({
+            client,
+            actions: [
+              ...(myCaseConfigure.saved_objects[0].attributes.closure_type === 'close-by-pushing'
+                ? [
+                    buildCaseUserActionItem({
+                      action: 'update',
+                      actionAt: pushedDate,
+                      actionBy: { username, full_name, email },
+                      caseId,
+                      fields: ['status'],
+                      newValue: 'closed',
+                      oldValue: myCase.attributes.status,
+                    }),
+                  ]
+                : []),
+              buildCaseUserActionItem({
+                action: 'push-to-service',
+                actionAt: pushedDate,
+                actionBy: { username, full_name, email },
+                caseId,
+                fields: ['pushed'],
+                newValue: JSON.stringify(externalService),
+              }),
+            ],
+          }),
+        ]);
+
+        return response.ok({
+          body: CaseResponseRt.encode(
+            flattenCaseSavedObject(
+              {
+                ...myCase,
+                ...updatedCase,
+                attributes: { ...myCase.attributes, ...updatedCase?.attributes },
+                references: myCase.references,
+              },
+              comments.saved_objects.map(origComment => {
+                const updatedComment = updatedComments.saved_objects.find(
+                  c => c.id === origComment.id
+                );
+                return {
+                  ...origComment,
+                  ...updatedComment,
+                  attributes: {
+                    ...origComment.attributes,
+                    ...updatedComment?.attributes,
+                  },
+                  version: updatedComment?.version ?? origComment.version,
+                  references: origComment?.references ?? [],
+                };
+              })
+            )
+          ),
+        });
+      } catch (error) {
+        return response.customError(wrapError(error));
+      }
+    }
+  );
+}
diff --git a/x-pack/plugins/case/server/routes/api/cases/reporters/get_reporters.ts b/x-pack/plugins/case/server/routes/api/cases/reporters/get_reporters.ts
index 519bb198f5f9e..56862a96e0563 100644
--- a/x-pack/plugins/case/server/routes/api/cases/reporters/get_reporters.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/reporters/get_reporters.ts
@@ -16,8 +16,9 @@ export function initGetReportersApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const reporters = await caseService.getReporters({
-          client: context.core.savedObjects.client,
+          client,
         });
         return response.ok({ body: UsersRt.encode(reporters) });
       } catch (error) {
diff --git a/x-pack/plugins/case/server/routes/api/cases/status/get_status.ts b/x-pack/plugins/case/server/routes/api/cases/status/get_status.ts
index b4fc90d702604..f7431729d398c 100644
--- a/x-pack/plugins/case/server/routes/api/cases/status/get_status.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/status/get_status.ts
@@ -18,8 +18,9 @@ export function initGetCasesStatusApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const argsOpenCases = {
-          client: context.core.savedObjects.client,
+          client,
           options: {
             fields: [],
             page: 1,
@@ -29,7 +30,7 @@ export function initGetCasesStatusApi({ caseService, router }: RouteDeps) {
         };
 
         const argsClosedCases = {
-          client: context.core.savedObjects.client,
+          client,
           options: {
             fields: [],
             page: 1,
diff --git a/x-pack/plugins/case/server/routes/api/cases/tags/get_tags.ts b/x-pack/plugins/case/server/routes/api/cases/tags/get_tags.ts
index ca51f421f4f56..55e8fe2af128c 100644
--- a/x-pack/plugins/case/server/routes/api/cases/tags/get_tags.ts
+++ b/x-pack/plugins/case/server/routes/api/cases/tags/get_tags.ts
@@ -15,8 +15,9 @@ export function initGetTagsApi({ caseService, router }: RouteDeps) {
     },
     async (context, request, response) => {
       try {
+        const client = context.core.savedObjects.client;
         const tags = await caseService.getTags({
-          client: context.core.savedObjects.client,
+          client,
         });
         return response.ok({ body: tags });
       } catch (error) {
diff --git a/x-pack/plugins/case/server/routes/api/cases/user_actions/get_all_user_actions.ts b/x-pack/plugins/case/server/routes/api/cases/user_actions/get_all_user_actions.ts
new file mode 100644
index 0000000000000..2d4f16e46d561
--- /dev/null
+++ b/x-pack/plugins/case/server/routes/api/cases/user_actions/get_all_user_actions.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+
+import { CaseUserActionsResponseRt } from '../../../../../common/api';
+import { CASE_SAVED_OBJECT, CASE_COMMENT_SAVED_OBJECT } from '../../../../saved_object_types';
+import { RouteDeps } from '../../types';
+import { wrapError } from '../../utils';
+
+export function initGetAllUserActionsApi({ userActionService, router }: RouteDeps) {
+  router.get(
+    {
+      path: '/api/cases/{case_id}/user_actions',
+      validate: {
+        params: schema.object({
+          case_id: schema.string(),
+        }),
+      },
+    },
+    async (context, request, response) => {
+      try {
+        const client = context.core.savedObjects.client;
+        const userActions = await userActionService.getUserActions({
+          client,
+          caseId: request.params.case_id,
+        });
+        return response.ok({
+          body: CaseUserActionsResponseRt.encode(
+            userActions.saved_objects.map(ua => ({
+              ...ua.attributes,
+              action_id: ua.id,
+              case_id: ua.references.find(r => r.type === CASE_SAVED_OBJECT)?.id ?? '',
+              comment_id: ua.references.find(r => r.type === CASE_COMMENT_SAVED_OBJECT)?.id ?? null,
+            }))
+          ),
+        });
+      } catch (error) {
+        return response.customError(wrapError(error));
+      }
+    }
+  );
+}
diff --git a/x-pack/plugins/case/server/routes/api/index.ts b/x-pack/plugins/case/server/routes/api/index.ts
index 60ee57a0efea7..ced88fabf3160 100644
--- a/x-pack/plugins/case/server/routes/api/index.ts
+++ b/x-pack/plugins/case/server/routes/api/index.ts
@@ -9,6 +9,11 @@ import { initFindCasesApi } from '././cases/find_cases';
 import { initGetCaseApi } from './cases/get_case';
 import { initPatchCasesApi } from './cases/patch_cases';
 import { initPostCaseApi } from './cases/post_case';
+import { initPushCaseUserActionApi } from './cases/push_case';
+import { initGetReportersApi } from './cases/reporters/get_reporters';
+import { initGetCasesStatusApi } from './cases/status/get_status';
+import { initGetTagsApi } from './cases/tags/get_tags';
+import { initGetAllUserActionsApi } from './cases/user_actions/get_all_user_actions';
 
 import { initDeleteCommentApi } from './cases/comments/delete_comment';
 import { initDeleteAllCommentsApi } from './cases/comments/delete_all_comments';
@@ -18,18 +23,13 @@ import { initGetCommentApi } from './cases/comments/get_comment';
 import { initPatchCommentApi } from './cases/comments/patch_comment';
 import { initPostCommentApi } from './cases/comments/post_comment';
 
-import { initGetReportersApi } from './cases/reporters/get_reporters';
-
-import { initGetCasesStatusApi } from './cases/status/get_status';
-
-import { initGetTagsApi } from './cases/tags/get_tags';
-
-import { RouteDeps } from './types';
 import { initCaseConfigureGetActionConnector } from './cases/configure/get_connectors';
 import { initGetCaseConfigure } from './cases/configure/get_configure';
 import { initPatchCaseConfigure } from './cases/configure/patch_configure';
 import { initPostCaseConfigure } from './cases/configure/post_configure';
 
+import { RouteDeps } from './types';
+
 export function initCaseApi(deps: RouteDeps) {
   // Cases
   initDeleteCasesApi(deps);
@@ -37,6 +37,8 @@ export function initCaseApi(deps: RouteDeps) {
   initGetCaseApi(deps);
   initPatchCasesApi(deps);
   initPostCaseApi(deps);
+  initPushCaseUserActionApi(deps);
+  initGetAllUserActionsApi(deps);
   // Comments
   initDeleteCommentApi(deps);
   initDeleteAllCommentsApi(deps);
diff --git a/x-pack/plugins/case/server/routes/api/types.ts b/x-pack/plugins/case/server/routes/api/types.ts
index 7af3e7b70d96f..e532a7b618b5c 100644
--- a/x-pack/plugins/case/server/routes/api/types.ts
+++ b/x-pack/plugins/case/server/routes/api/types.ts
@@ -5,11 +5,16 @@
  */
 
 import { IRouter } from 'src/core/server';
-import { CaseConfigureServiceSetup, CaseServiceSetup } from '../../services';
+import {
+  CaseConfigureServiceSetup,
+  CaseServiceSetup,
+  CaseUserActionServiceSetup,
+} from '../../services';
 
 export interface RouteDeps {
   caseConfigureService: CaseConfigureServiceSetup;
   caseService: CaseServiceSetup;
+  userActionService: CaseUserActionServiceSetup;
   router: IRouter;
 }
 
@@ -18,3 +23,8 @@ export enum SortFieldCase {
   createdAt = 'created_at',
   status = 'status',
 }
+
+export interface TotalCommentByCase {
+  caseId: string;
+  totalComments: number;
+}
diff --git a/x-pack/plugins/case/server/routes/api/utils.ts b/x-pack/plugins/case/server/routes/api/utils.ts
index 19dbb024d1e0b..9d90eb8ef4a6d 100644
--- a/x-pack/plugins/case/server/routes/api/utils.ts
+++ b/x-pack/plugins/case/server/routes/api/utils.ts
@@ -22,7 +22,8 @@ import {
   CommentsResponse,
   CommentAttributes,
 } from '../../../common/api';
-import { SortFieldCase } from './types';
+
+import { SortFieldCase, TotalCommentByCase } from './types';
 
 export const transformNewCase = ({
   createdDate,
@@ -37,11 +38,11 @@ export const transformNewCase = ({
   newCase: CaseRequest;
   username: string;
 }): CaseAttributes => ({
-  closed_at: newCase.status === 'closed' ? createdDate : null,
-  closed_by: newCase.status === 'closed' ? { email, full_name, username } : null,
-  comment_ids: [],
+  closed_at: null,
+  closed_by: null,
   created_at: createdDate,
   created_by: { email, full_name, username },
+  external_service: null,
   updated_at: null,
   updated_by: null,
   ...newCase,
@@ -64,6 +65,8 @@ export const transformNewComment = ({
   comment,
   created_at: createdDate,
   created_by: { email, full_name, username },
+  pushed_at: null,
+  pushed_by: null,
   updated_at: null,
   updated_by: null,
 });
@@ -81,30 +84,41 @@ export function wrapError(error: any): CustomHttpResponseOptions<ResponseError>
 export const transformCases = (
   cases: SavedObjectsFindResponse<CaseAttributes>,
   countOpenCases: number,
-  countClosedCases: number
+  countClosedCases: number,
+  totalCommentByCase: TotalCommentByCase[]
 ): CasesFindResponse => ({
   page: cases.page,
   per_page: cases.per_page,
   total: cases.total,
-  cases: flattenCaseSavedObjects(cases.saved_objects),
+  cases: flattenCaseSavedObjects(cases.saved_objects, totalCommentByCase),
   count_open_cases: countOpenCases,
   count_closed_cases: countClosedCases,
 });
 
 export const flattenCaseSavedObjects = (
-  savedObjects: SavedObjectsFindResponse<CaseAttributes>['saved_objects']
+  savedObjects: SavedObjectsFindResponse<CaseAttributes>['saved_objects'],
+  totalCommentByCase: TotalCommentByCase[]
 ): CaseResponse[] =>
   savedObjects.reduce((acc: CaseResponse[], savedObject: SavedObject<CaseAttributes>) => {
-    return [...acc, flattenCaseSavedObject(savedObject, [])];
+    return [
+      ...acc,
+      flattenCaseSavedObject(
+        savedObject,
+        [],
+        totalCommentByCase.find(tc => tc.caseId === savedObject.id)?.totalComments ?? 0
+      ),
+    ];
   }, []);
 
 export const flattenCaseSavedObject = (
   savedObject: SavedObject<CaseAttributes>,
-  comments: Array<SavedObject<CommentAttributes>> = []
+  comments: Array<SavedObject<CommentAttributes>> = [],
+  totalComment: number = 0
 ): CaseResponse => ({
   id: savedObject.id,
   version: savedObject.version ?? '0',
   comments: flattenCommentSavedObjects(comments),
+  totalComment,
   ...savedObject.attributes,
 });
 
diff --git a/x-pack/plugins/case/server/saved_object_types/cases.ts b/x-pack/plugins/case/server/saved_object_types/cases.ts
index 8eab040b9ca9c..a4c5dab0feeb7 100644
--- a/x-pack/plugins/case/server/saved_object_types/cases.ts
+++ b/x-pack/plugins/case/server/saved_object_types/cases.ts
@@ -30,9 +30,6 @@ export const caseSavedObjectType: SavedObjectsType = {
           },
         },
       },
-      comment_ids: {
-        type: 'keyword',
-      },
       created_at: {
         type: 'date',
       },
@@ -52,6 +49,41 @@ export const caseSavedObjectType: SavedObjectsType = {
       description: {
         type: 'text',
       },
+      external_service: {
+        properties: {
+          pushed_at: {
+            type: 'date',
+          },
+          pushed_by: {
+            properties: {
+              username: {
+                type: 'keyword',
+              },
+              full_name: {
+                type: 'keyword',
+              },
+              email: {
+                type: 'keyword',
+              },
+            },
+          },
+          connector_id: {
+            type: 'keyword',
+          },
+          connector_name: {
+            type: 'keyword',
+          },
+          external_id: {
+            type: 'keyword',
+          },
+          external_title: {
+            type: 'text',
+          },
+          external_url: {
+            type: 'text',
+          },
+        },
+      },
       title: {
         type: 'keyword',
       },
@@ -61,6 +93,7 @@ export const caseSavedObjectType: SavedObjectsType = {
       tags: {
         type: 'keyword',
       },
+
       updated_at: {
         type: 'date',
       },
diff --git a/x-pack/plugins/case/server/saved_object_types/comments.ts b/x-pack/plugins/case/server/saved_object_types/comments.ts
index f52da886e7611..8776dd39b11fa 100644
--- a/x-pack/plugins/case/server/saved_object_types/comments.ts
+++ b/x-pack/plugins/case/server/saved_object_types/comments.ts
@@ -33,6 +33,19 @@ export const caseCommentSavedObjectType: SavedObjectsType = {
           },
         },
       },
+      pushed_at: {
+        type: 'date',
+      },
+      pushed_by: {
+        properties: {
+          username: {
+            type: 'keyword',
+          },
+          full_name: {
+            type: 'keyword',
+          },
+        },
+      },
       updated_at: {
         type: 'date',
       },
diff --git a/x-pack/plugins/case/server/saved_object_types/configure.ts b/x-pack/plugins/case/server/saved_object_types/configure.ts
index 8ea6f6bba7d4f..d66c38b6ea8ff 100644
--- a/x-pack/plugins/case/server/saved_object_types/configure.ts
+++ b/x-pack/plugins/case/server/saved_object_types/configure.ts
@@ -19,6 +19,9 @@ export const caseConfigureSavedObjectType: SavedObjectsType = {
       },
       created_by: {
         properties: {
+          email: {
+            type: 'keyword',
+          },
           username: {
             type: 'keyword',
           },
@@ -30,6 +33,9 @@ export const caseConfigureSavedObjectType: SavedObjectsType = {
       connector_id: {
         type: 'keyword',
       },
+      connector_name: {
+        type: 'keyword',
+      },
       closure_type: {
         type: 'keyword',
       },
@@ -38,6 +44,9 @@ export const caseConfigureSavedObjectType: SavedObjectsType = {
       },
       updated_by: {
         properties: {
+          email: {
+            type: 'keyword',
+          },
           username: {
             type: 'keyword',
           },
diff --git a/x-pack/plugins/case/server/saved_object_types/index.ts b/x-pack/plugins/case/server/saved_object_types/index.ts
index 978b3d35ee5c6..0e4b9fa3e2eee 100644
--- a/x-pack/plugins/case/server/saved_object_types/index.ts
+++ b/x-pack/plugins/case/server/saved_object_types/index.ts
@@ -7,3 +7,4 @@
 export { caseSavedObjectType, CASE_SAVED_OBJECT } from './cases';
 export { caseConfigureSavedObjectType, CASE_CONFIGURE_SAVED_OBJECT } from './configure';
 export { caseCommentSavedObjectType, CASE_COMMENT_SAVED_OBJECT } from './comments';
+export { caseUserActionSavedObjectType, CASE_USER_ACTION_SAVED_OBJECT } from './user_actions';
diff --git a/x-pack/plugins/case/server/saved_object_types/user_actions.ts b/x-pack/plugins/case/server/saved_object_types/user_actions.ts
new file mode 100644
index 0000000000000..b61bfafc3b33c
--- /dev/null
+++ b/x-pack/plugins/case/server/saved_object_types/user_actions.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SavedObjectsType } from 'src/core/server';
+
+export const CASE_USER_ACTION_SAVED_OBJECT = 'cases-user-actions';
+
+export const caseUserActionSavedObjectType: SavedObjectsType = {
+  name: CASE_USER_ACTION_SAVED_OBJECT,
+  hidden: false,
+  namespaceAgnostic: false,
+  mappings: {
+    properties: {
+      action_field: {
+        type: 'keyword',
+      },
+      action: {
+        type: 'keyword',
+      },
+      action_at: {
+        type: 'date',
+      },
+      action_by: {
+        properties: {
+          email: {
+            type: 'keyword',
+          },
+          username: {
+            type: 'keyword',
+          },
+          full_name: {
+            type: 'keyword',
+          },
+        },
+      },
+      new_value: {
+        type: 'text',
+      },
+      old_value: {
+        type: 'text',
+      },
+    },
+  },
+};
diff --git a/x-pack/plugins/case/server/services/index.ts b/x-pack/plugins/case/server/services/index.ts
index 4bbffddf63251..09d726228d309 100644
--- a/x-pack/plugins/case/server/services/index.ts
+++ b/x-pack/plugins/case/server/services/index.ts
@@ -24,11 +24,17 @@ import { readReporters } from './reporters/read_reporters';
 import { readTags } from './tags/read_tags';
 
 export { CaseConfigureService, CaseConfigureServiceSetup } from './configure';
+export { CaseUserActionService, CaseUserActionServiceSetup } from './user_actions';
 
-interface ClientArgs {
+export interface ClientArgs {
   client: SavedObjectsClientContract;
 }
 
+interface PushedArgs {
+  pushed_at: string;
+  pushed_by: User;
+}
+
 interface GetCaseArgs extends ClientArgs {
   caseId: string;
 }
@@ -37,7 +43,7 @@ interface GetCasesArgs extends ClientArgs {
   caseIds: string[];
 }
 
-interface GetCommentsArgs extends GetCaseArgs {
+interface FindCommentsArgs extends GetCaseArgs {
   options?: SavedObjectFindOptions;
 }
 
@@ -47,6 +53,7 @@ interface FindCasesArgs extends ClientArgs {
 interface GetCommentArgs extends ClientArgs {
   commentId: string;
 }
+
 interface PostCaseArgs extends ClientArgs {
   attributes: CaseAttributes;
 }
@@ -58,7 +65,7 @@ interface PostCommentArgs extends ClientArgs {
 
 interface PatchCase {
   caseId: string;
-  updatedAttributes: Partial<CaseAttributes>;
+  updatedAttributes: Partial<CaseAttributes & PushedArgs>;
   version?: string;
 }
 type PatchCaseArgs = PatchCase & ClientArgs;
@@ -68,10 +75,20 @@ interface PatchCasesArgs extends ClientArgs {
 }
 interface UpdateCommentArgs extends ClientArgs {
   commentId: string;
-  updatedAttributes: Partial<CommentAttributes>;
+  updatedAttributes: Partial<CommentAttributes & PushedArgs>;
   version?: string;
 }
 
+interface PatchComment {
+  commentId: string;
+  updatedAttributes: Partial<CommentAttributes & PushedArgs>;
+  version?: string;
+}
+
+interface PatchComments extends ClientArgs {
+  comments: PatchComment[];
+}
+
 interface GetUserArgs {
   request: KibanaRequest;
   response: KibanaResponseFactory;
@@ -84,7 +101,7 @@ export interface CaseServiceSetup {
   deleteCase(args: GetCaseArgs): Promise<{}>;
   deleteComment(args: GetCommentArgs): Promise<{}>;
   findCases(args: FindCasesArgs): Promise<SavedObjectsFindResponse<CaseAttributes>>;
-  getAllCaseComments(args: GetCommentsArgs): Promise<SavedObjectsFindResponse<CommentAttributes>>;
+  getAllCaseComments(args: FindCommentsArgs): Promise<SavedObjectsFindResponse<CommentAttributes>>;
   getCase(args: GetCaseArgs): Promise<SavedObject<CaseAttributes>>;
   getCases(args: GetCasesArgs): Promise<SavedObjectsBulkResponse<CaseAttributes>>;
   getComment(args: GetCommentArgs): Promise<SavedObject<CommentAttributes>>;
@@ -96,6 +113,7 @@ export interface CaseServiceSetup {
   patchCase(args: PatchCaseArgs): Promise<SavedObjectsUpdateResponse<CaseAttributes>>;
   patchCases(args: PatchCasesArgs): Promise<SavedObjectsBulkUpdateResponse<CaseAttributes>>;
   patchComment(args: UpdateCommentArgs): Promise<SavedObjectsUpdateResponse<CommentAttributes>>;
+  patchComments(args: PatchComments): Promise<SavedObjectsBulkUpdateResponse<CommentAttributes>>;
 }
 
 export class CaseService {
@@ -157,7 +175,7 @@ export class CaseService {
         throw error;
       }
     },
-    getAllCaseComments: async ({ client, caseId, options }: GetCommentsArgs) => {
+    getAllCaseComments: async ({ client, caseId, options }: FindCommentsArgs) => {
       try {
         this.log.debug(`Attempting to GET all comments for case ${caseId}`);
         return await client.find({
@@ -261,5 +279,25 @@ export class CaseService {
         throw error;
       }
     },
+    patchComments: async ({ client, comments }: PatchComments) => {
+      try {
+        this.log.debug(
+          `Attempting to UPDATE comments ${comments.map(c => c.commentId).join(', ')}`
+        );
+        return await client.bulkUpdate(
+          comments.map(c => ({
+            type: CASE_COMMENT_SAVED_OBJECT,
+            id: c.commentId,
+            attributes: c.updatedAttributes,
+            version: c.version,
+          }))
+        );
+      } catch (error) {
+        this.log.debug(
+          `Error on UPDATE comments ${comments.map(c => c.commentId).join(', ')}: ${error}`
+        );
+        throw error;
+      }
+    },
   });
 }
diff --git a/x-pack/plugins/case/server/services/user_actions/helpers.ts b/x-pack/plugins/case/server/services/user_actions/helpers.ts
new file mode 100644
index 0000000000000..59d193f0f30d5
--- /dev/null
+++ b/x-pack/plugins/case/server/services/user_actions/helpers.ts
@@ -0,0 +1,195 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SavedObject, SavedObjectsUpdateResponse } from 'kibana/server';
+import { get } from 'lodash';
+
+import {
+  CaseUserActionAttributes,
+  UserAction,
+  UserActionField,
+  CaseAttributes,
+  User,
+} from '../../../common/api';
+import { isTwoArraysDifference } from '../../routes/api/cases/helpers';
+import { UserActionItem } from '.';
+import { CASE_SAVED_OBJECT, CASE_COMMENT_SAVED_OBJECT } from '../../saved_object_types';
+
+export const transformNewUserAction = ({
+  actionField,
+  action,
+  actionAt,
+  email,
+  full_name,
+  newValue = null,
+  oldValue = null,
+  username,
+}: {
+  actionField: UserActionField;
+  action: UserAction;
+  actionAt: string;
+  email?: string;
+  full_name?: string;
+  newValue?: string | null;
+  oldValue?: string | null;
+  username: string;
+}): CaseUserActionAttributes => ({
+  action_field: actionField,
+  action,
+  action_at: actionAt,
+  action_by: { email, full_name, username },
+  new_value: newValue,
+  old_value: oldValue,
+});
+
+interface BuildCaseUserAction {
+  action: UserAction;
+  actionAt: string;
+  actionBy: User;
+  caseId: string;
+  fields: UserActionField | unknown[];
+  newValue?: string | unknown;
+  oldValue?: string | unknown;
+}
+
+interface BuildCommentUserActionItem extends BuildCaseUserAction {
+  commentId: string;
+}
+
+export const buildCommentUserActionItem = ({
+  action,
+  actionAt,
+  actionBy,
+  caseId,
+  commentId,
+  fields,
+  newValue,
+  oldValue,
+}: BuildCommentUserActionItem): UserActionItem => ({
+  attributes: transformNewUserAction({
+    actionField: fields as UserActionField,
+    action,
+    actionAt,
+    ...actionBy,
+    newValue: newValue as string,
+    oldValue: oldValue as string,
+  }),
+  references: [
+    {
+      type: CASE_SAVED_OBJECT,
+      name: `associated-${CASE_SAVED_OBJECT}`,
+      id: caseId,
+    },
+    {
+      type: CASE_COMMENT_SAVED_OBJECT,
+      name: `associated-${CASE_COMMENT_SAVED_OBJECT}`,
+      id: commentId,
+    },
+  ],
+});
+
+export const buildCaseUserActionItem = ({
+  action,
+  actionAt,
+  actionBy,
+  caseId,
+  fields,
+  newValue,
+  oldValue,
+}: BuildCaseUserAction): UserActionItem => ({
+  attributes: transformNewUserAction({
+    actionField: fields as UserActionField,
+    action,
+    actionAt,
+    ...actionBy,
+    newValue: newValue as string,
+    oldValue: oldValue as string,
+  }),
+  references: [
+    {
+      type: CASE_SAVED_OBJECT,
+      name: `associated-${CASE_SAVED_OBJECT}`,
+      id: caseId,
+    },
+  ],
+});
+
+const userActionFieldsAllowed: UserActionField = [
+  'comment',
+  'description',
+  'tags',
+  'title',
+  'status',
+];
+
+export const buildCaseUserActions = ({
+  actionDate,
+  actionBy,
+  originalCases,
+  updatedCases,
+}: {
+  actionDate: string;
+  actionBy: User;
+  originalCases: Array<SavedObject<CaseAttributes>>;
+  updatedCases: Array<SavedObjectsUpdateResponse<CaseAttributes>>;
+}): UserActionItem[] =>
+  updatedCases.reduce<UserActionItem[]>((acc, updatedItem) => {
+    const originalItem = originalCases.find(oItem => oItem.id === updatedItem.id);
+    if (originalItem != null) {
+      let userActions: UserActionItem[] = [];
+      const updatedFields = Object.keys(updatedItem.attributes) as UserActionField;
+      updatedFields.forEach(field => {
+        if (userActionFieldsAllowed.includes(field)) {
+          const origValue = get(originalItem, ['attributes', field]);
+          const updatedValue = get(updatedItem, ['attributes', field]);
+          const compareValues = isTwoArraysDifference(origValue, updatedValue);
+          if (compareValues != null) {
+            if (compareValues.addedItems.length > 0) {
+              userActions = [
+                ...userActions,
+                buildCaseUserActionItem({
+                  action: 'add',
+                  actionAt: actionDate,
+                  actionBy,
+                  caseId: updatedItem.id,
+                  fields: [field],
+                  newValue: compareValues.addedItems.join(', '),
+                }),
+              ];
+            }
+            if (compareValues.deletedItems.length > 0) {
+              userActions = [
+                ...userActions,
+                buildCaseUserActionItem({
+                  action: 'delete',
+                  actionAt: actionDate,
+                  actionBy,
+                  caseId: updatedItem.id,
+                  fields: [field],
+                  newValue: compareValues.deletedItems.join(', '),
+                }),
+              ];
+            }
+          } else if (origValue !== updatedValue) {
+            userActions = [
+              ...userActions,
+              buildCaseUserActionItem({
+                action: 'update',
+                actionAt: actionDate,
+                actionBy,
+                caseId: updatedItem.id,
+                fields: [field],
+                newValue: updatedValue,
+                oldValue: origValue,
+              }),
+            ];
+          }
+        }
+      });
+      return [...acc, ...userActions];
+    }
+    return acc;
+  }, []);
diff --git a/x-pack/plugins/case/server/services/user_actions/index.ts b/x-pack/plugins/case/server/services/user_actions/index.ts
new file mode 100644
index 0000000000000..0e9babf9d81af
--- /dev/null
+++ b/x-pack/plugins/case/server/services/user_actions/index.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import {
+  SavedObjectsFindResponse,
+  Logger,
+  SavedObjectsBulkResponse,
+  SavedObjectReference,
+} from 'kibana/server';
+
+import { CaseUserActionAttributes } from '../../../common/api';
+import { CASE_USER_ACTION_SAVED_OBJECT, CASE_SAVED_OBJECT } from '../../saved_object_types';
+import { ClientArgs } from '..';
+
+interface GetCaseUserActionArgs extends ClientArgs {
+  caseId: string;
+}
+
+export interface UserActionItem {
+  attributes: CaseUserActionAttributes;
+  references: SavedObjectReference[];
+}
+
+interface PostCaseUserActionArgs extends ClientArgs {
+  actions: UserActionItem[];
+}
+
+export interface CaseUserActionServiceSetup {
+  getUserActions(
+    args: GetCaseUserActionArgs
+  ): Promise<SavedObjectsFindResponse<CaseUserActionAttributes>>;
+  postUserActions(
+    args: PostCaseUserActionArgs
+  ): Promise<SavedObjectsBulkResponse<CaseUserActionAttributes>>;
+}
+
+export class CaseUserActionService {
+  constructor(private readonly log: Logger) {}
+  public setup = async (): Promise<CaseUserActionServiceSetup> => ({
+    getUserActions: async ({ client, caseId }: GetCaseUserActionArgs) => {
+      try {
+        const caseUserActionInfo = await client.find({
+          type: CASE_USER_ACTION_SAVED_OBJECT,
+          fields: [],
+          hasReference: { type: CASE_SAVED_OBJECT, id: caseId },
+          page: 1,
+          perPage: 1,
+        });
+        return await client.find({
+          type: CASE_USER_ACTION_SAVED_OBJECT,
+          hasReference: { type: CASE_SAVED_OBJECT, id: caseId },
+          page: 1,
+          perPage: caseUserActionInfo.total,
+          sortField: 'action_at',
+          sortOrder: 'asc',
+        });
+      } catch (error) {
+        this.log.debug(`Error on GET case user action: ${error}`);
+        throw error;
+      }
+    },
+    postUserActions: async ({ client, actions }: PostCaseUserActionArgs) => {
+      try {
+        this.log.debug(`Attempting to POST a new case user action`);
+        return await client.bulkCreate(
+          actions.map(action => ({ type: CASE_USER_ACTION_SAVED_OBJECT, ...action }))
+        );
+      } catch (error) {
+        this.log.debug(`Error on POST a new case user action: ${error}`);
+        throw error;
+      }
+    },
+  });
+}
diff --git a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/index.ts b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/index.ts
index 0dbdc2f3ac7e3..c76477cd8da43 100644
--- a/x-pack/plugins/encrypted_saved_objects/server/saved_objects/index.ts
+++ b/x-pack/plugins/encrypted_saved_objects/server/saved_objects/index.ts
@@ -4,14 +4,19 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CoreSetup, SavedObject, SavedObjectsBaseOptions } from 'src/core/server';
+import {
+  StartServicesAccessor,
+  SavedObject,
+  SavedObjectsBaseOptions,
+  SavedObjectsServiceSetup,
+} from 'src/core/server';
 import { EncryptedSavedObjectsService } from '../crypto';
 import { EncryptedSavedObjectsClientWrapper } from './encrypted_saved_objects_client_wrapper';
 
 interface SetupSavedObjectsParams {
   service: PublicMethodsOf<EncryptedSavedObjectsService>;
-  savedObjects: CoreSetup['savedObjects'];
-  getStartServices: CoreSetup['getStartServices'];
+  savedObjects: SavedObjectsServiceSetup;
+  getStartServices: StartServicesAccessor;
 }
 
 export interface SavedObjectsSetup {
diff --git a/x-pack/plugins/endpoint/common/generate_data.test.ts b/x-pack/plugins/endpoint/common/generate_data.test.ts
index a687d7af1c590..dfb906c7af606 100644
--- a/x-pack/plugins/endpoint/common/generate_data.test.ts
+++ b/x-pack/plugins/endpoint/common/generate_data.test.ts
@@ -21,8 +21,8 @@ describe('data generator', () => {
     const generator1 = new EndpointDocGenerator('seed');
     const generator2 = new EndpointDocGenerator('seed');
     const timestamp = new Date().getTime();
-    const metadata1 = generator1.generateEndpointMetadata(timestamp);
-    const metadata2 = generator2.generateEndpointMetadata(timestamp);
+    const metadata1 = generator1.generateHostMetadata(timestamp);
+    const metadata2 = generator2.generateHostMetadata(timestamp);
     expect(metadata1).toEqual(metadata2);
   });
 
@@ -30,14 +30,14 @@ describe('data generator', () => {
     const generator1 = new EndpointDocGenerator('seed');
     const generator2 = new EndpointDocGenerator('different seed');
     const timestamp = new Date().getTime();
-    const metadata1 = generator1.generateEndpointMetadata(timestamp);
-    const metadata2 = generator2.generateEndpointMetadata(timestamp);
+    const metadata1 = generator1.generateHostMetadata(timestamp);
+    const metadata2 = generator2.generateHostMetadata(timestamp);
     expect(metadata1).not.toEqual(metadata2);
   });
 
-  it('creates endpoint metadata documents', () => {
+  it('creates host metadata documents', () => {
     const timestamp = new Date().getTime();
-    const metadata = generator.generateEndpointMetadata(timestamp);
+    const metadata = generator.generateHostMetadata(timestamp);
     expect(metadata['@timestamp']).toEqual(timestamp);
     expect(metadata.event.created).toEqual(timestamp);
     expect(metadata.endpoint).not.toBeNull();
diff --git a/x-pack/plugins/endpoint/common/generate_data.ts b/x-pack/plugins/endpoint/common/generate_data.ts
index 18977ac0d2016..75351bb3bf07d 100644
--- a/x-pack/plugins/endpoint/common/generate_data.ts
+++ b/x-pack/plugins/endpoint/common/generate_data.ts
@@ -6,7 +6,7 @@
 
 import uuid from 'uuid';
 import seedrandom from 'seedrandom';
-import { AlertEvent, EndpointEvent, EndpointMetadata, OSFields, HostFields } from './types';
+import { AlertEvent, EndpointEvent, HostMetadata, OSFields, HostFields } from './types';
 
 export type Event = AlertEvent | EndpointEvent;
 
@@ -104,8 +104,8 @@ export class EndpointDocGenerator {
     this.commonInfo = this.createHostData();
   }
 
-  // This function will create new values for all the host fields, so documents from a different endpoint can be created
-  // This provides a convenient way to make documents from multiple endpoints that are all tied to a single seed value
+  // This function will create new values for all the host fields, so documents from a different host can be created
+  // This provides a convenient way to make documents from multiple hosts that are all tied to a single seed value
   public randomizeHostData() {
     this.commonInfo = this.createHostData();
   }
@@ -129,7 +129,7 @@ export class EndpointDocGenerator {
     };
   }
 
-  public generateEndpointMetadata(ts = new Date().getTime()): EndpointMetadata {
+  public generateHostMetadata(ts = new Date().getTime()): HostMetadata {
     return {
       '@timestamp': ts,
       event: {
@@ -325,7 +325,7 @@ export class EndpointDocGenerator {
     for (let i = 0; i < generations; i++) {
       const newParents: EndpointEvent[] = [];
       parents.forEach(element => {
-        const numChildren = this.randomN(maxChildrenPerNode);
+        const numChildren = this.randomN(maxChildrenPerNode + 1);
         for (let j = 0; j < numChildren; j++) {
           timestamp = timestamp + 1000;
           const child = this.generateEvent({
diff --git a/x-pack/plugins/endpoint/common/types.ts b/x-pack/plugins/endpoint/common/types.ts
index 92bec4f72a387..7e4cf3d700ec8 100644
--- a/x-pack/plugins/endpoint/common/types.ts
+++ b/x-pack/plugins/endpoint/common/types.ts
@@ -83,10 +83,10 @@ export interface AlertResultList {
   prev: string | null;
 }
 
-export interface EndpointResultList {
-  /* the endpoints restricted by the page size */
-  endpoints: EndpointMetadata[];
-  /* the total number of unique endpoints in the index */
+export interface HostResultList {
+  /* the hosts restricted by the page size */
+  hosts: HostMetadata[];
+  /* the total number of unique hosts in the index */
   total: number;
   /* the page size requested */
   request_page_size: number;
@@ -243,7 +243,7 @@ interface AlertMetadata {
  */
 export type AlertData = AlertEvent & AlertMetadata;
 
-export interface EndpointMetadata {
+export type HostMetadata = Immutable<{
   '@timestamp': number;
   event: {
     created: number;
@@ -258,7 +258,7 @@ export interface EndpointMetadata {
     version: string;
   };
   host: HostFields;
-}
+}>;
 
 /**
  * Represents `total` response from Elasticsearch after ES 7.0.
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/components/header_nav.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/components/header_nav.tsx
index f7d6551f9093b..1bafcbec93f5f 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/components/header_nav.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/components/header_nav.tsx
@@ -24,11 +24,11 @@ export const navTabs: NavTabs[] = [
     href: '/',
   },
   {
-    id: 'management',
-    name: i18n.translate('xpack.endpoint.headerNav.management', {
-      defaultMessage: 'Management',
+    id: 'hosts',
+    name: i18n.translate('xpack.endpoint.headerNav.hosts', {
+      defaultMessage: 'Hosts',
     }),
-    href: '/management',
+    href: '/hosts',
   },
   {
     id: 'alerts',
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/index.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/index.tsx
index cec51f570f95d..884646369b4b1 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/index.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/index.tsx
@@ -11,15 +11,17 @@ import { I18nProvider, FormattedMessage } from '@kbn/i18n/react';
 import { Route, Switch, BrowserRouter } from 'react-router-dom';
 import { Provider } from 'react-redux';
 import { Store } from 'redux';
+import { useObservable } from 'react-use';
 import { KibanaContextProvider } from '../../../../../../src/plugins/kibana_react/public';
 import { RouteCapture } from './view/route_capture';
 import { EndpointPluginStartDependencies } from '../../plugin';
 import { appStoreFactory } from './store';
 import { AlertIndex } from './view/alerts';
-import { ManagementList } from './view/managing';
+import { HostList } from './view/hosts';
 import { PolicyList } from './view/policy';
 import { PolicyDetails } from './view/policy';
 import { HeaderNavigation } from './components/header_nav';
+import { EuiThemeProvider } from '../../../../../legacy/common/eui_styled_components';
 
 /**
  * This module will be loaded asynchronously to reduce the bundle size of your plugin's main bundle.
@@ -48,43 +50,54 @@ interface RouterProps {
 }
 
 const AppRoot: React.FunctionComponent<RouterProps> = React.memo(
-  ({ basename, store, coreStart: { http, notifications }, depsStart: { data } }) => (
-    <Provider store={store}>
-      <I18nProvider>
-        <KibanaContextProvider services={{ http, notifications, data }}>
-          <BrowserRouter basename={basename}>
-            <RouteCapture>
-              <HeaderNavigation basename={basename} />
-              <Switch>
-                <Route
-                  exact
-                  path="/"
-                  render={() => (
-                    <h1 data-test-subj="welcomeTitle">
-                      <FormattedMessage
-                        id="xpack.endpoint.welcomeTitle"
-                        defaultMessage="Hello World"
-                      />
-                    </h1>
-                  )}
-                />
-                <Route path="/management" component={ManagementList} />
-                <Route path="/alerts" component={AlertIndex} />
-                <Route path="/policy" exact component={PolicyList} />
-                <Route path="/policy/:id" exact component={PolicyDetails} />
-                <Route
-                  render={() => (
-                    <FormattedMessage
-                      id="xpack.endpoint.notFound"
-                      defaultMessage="Page Not Found"
+  ({
+    basename,
+    store,
+    coreStart: { http, notifications, uiSettings, application },
+    depsStart: { data },
+  }) => {
+    const isDarkMode = useObservable<boolean>(uiSettings.get$('theme:darkMode'));
+
+    return (
+      <Provider store={store}>
+        <I18nProvider>
+          <KibanaContextProvider services={{ http, notifications, application, data }}>
+            <EuiThemeProvider darkMode={isDarkMode}>
+              <BrowserRouter basename={basename}>
+                <RouteCapture>
+                  <HeaderNavigation basename={basename} />
+                  <Switch>
+                    <Route
+                      exact
+                      path="/"
+                      render={() => (
+                        <h1 data-test-subj="welcomeTitle">
+                          <FormattedMessage
+                            id="xpack.endpoint.welcomeTitle"
+                            defaultMessage="Hello World"
+                          />
+                        </h1>
+                      )}
+                    />
+                    <Route path="/hosts" component={HostList} />
+                    <Route path="/alerts" component={AlertIndex} />
+                    <Route path="/policy" exact component={PolicyList} />
+                    <Route path="/policy/:id" exact component={PolicyDetails} />
+                    <Route
+                      render={() => (
+                        <FormattedMessage
+                          id="xpack.endpoint.notFound"
+                          defaultMessage="Page Not Found"
+                        />
+                      )}
                     />
-                  )}
-                />
-              </Switch>
-            </RouteCapture>
-          </BrowserRouter>
-        </KibanaContextProvider>
-      </I18nProvider>
-    </Provider>
-  )
+                  </Switch>
+                </RouteCapture>
+              </BrowserRouter>
+            </EuiThemeProvider>
+          </KibanaContextProvider>
+        </I18nProvider>
+      </Provider>
+    );
+  }
 );
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/services/ingest.test.ts b/x-pack/plugins/endpoint/public/applications/endpoint/services/ingest.test.ts
new file mode 100644
index 0000000000000..a2c1dfbe09a48
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/services/ingest.test.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { httpServiceMock } from '../../../../../../../src/core/public/mocks';
+import { sendGetDatasource, sendGetEndpointSpecificDatasources } from './ingest';
+
+describe('ingest service', () => {
+  let http: ReturnType<typeof httpServiceMock.createStartContract>;
+
+  beforeEach(() => {
+    http = httpServiceMock.createStartContract();
+  });
+
+  describe('sendGetEndpointSpecificDatasources()', () => {
+    it('auto adds kuery to api request', async () => {
+      await sendGetEndpointSpecificDatasources(http);
+      expect(http.get).toHaveBeenCalledWith('/api/ingest_manager/datasources', {
+        query: {
+          kuery: 'datasources.package.name: endpoint',
+        },
+      });
+    });
+    it('supports additional KQL to be defined on input for query params', async () => {
+      await sendGetEndpointSpecificDatasources(http, {
+        query: { kuery: 'someValueHere', page: 1, perPage: 10 },
+      });
+      expect(http.get).toHaveBeenCalledWith('/api/ingest_manager/datasources', {
+        query: {
+          kuery: 'someValueHere and datasources.package.name: endpoint',
+          perPage: 10,
+          page: 1,
+        },
+      });
+    });
+  });
+  describe('sendGetDatasource()', () => {
+    it('builds correct API path', async () => {
+      await sendGetDatasource(http, '123');
+      expect(http.get).toHaveBeenCalledWith('/api/ingest_manager/datasources/123', undefined);
+    });
+    it('supports http options', async () => {
+      await sendGetDatasource(http, '123', { query: { page: 1 } });
+      expect(http.get).toHaveBeenCalledWith('/api/ingest_manager/datasources/123', {
+        query: {
+          page: 1,
+        },
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/services/ingest.ts b/x-pack/plugins/endpoint/public/applications/endpoint/services/ingest.ts
new file mode 100644
index 0000000000000..fbb92f8bbe915
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/services/ingest.ts
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HttpFetchOptions, HttpStart } from 'kibana/public';
+import { GetDatasourcesRequest } from '../../../../../ingest_manager/common/types/rest_spec';
+import { PolicyData } from '../types';
+
+const INGEST_API_ROOT = `/api/ingest_manager`;
+const INGEST_API_DATASOURCES = `${INGEST_API_ROOT}/datasources`;
+
+// FIXME: Import from ingest after - https://github.com/elastic/kibana/issues/60677
+export interface GetDatasourcesResponse {
+  items: PolicyData[];
+  total: number;
+  page: number;
+  perPage: number;
+  success: boolean;
+}
+
+// FIXME: Import from Ingest after - https://github.com/elastic/kibana/issues/60677
+export interface GetDatasourceResponse {
+  item: PolicyData;
+  success: boolean;
+}
+
+/**
+ * Retrieves a list of endpoint specific datasources (those created with a `package.name` of
+ * `endpoint`) from Ingest
+ * @param http
+ * @param options
+ */
+export const sendGetEndpointSpecificDatasources = (
+  http: HttpStart,
+  options: HttpFetchOptions & Partial<GetDatasourcesRequest> = {}
+): Promise<GetDatasourcesResponse> => {
+  return http.get<GetDatasourcesResponse>(INGEST_API_DATASOURCES, {
+    ...options,
+    query: {
+      ...options.query,
+      kuery: `${
+        options?.query?.kuery ? options.query.kuery + ' and ' : ''
+      }datasources.package.name: endpoint`,
+    },
+  });
+};
+
+/**
+ * Retrieves a single datasource based on ID from ingest
+ * @param http
+ * @param datasourceId
+ * @param options
+ */
+export const sendGetDatasource = (
+  http: HttpStart,
+  datasourceId: string,
+  options?: HttpFetchOptions
+) => {
+  return http.get<GetDatasourceResponse>(`${INGEST_API_DATASOURCES}/${datasourceId}`, options);
+};
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/action.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/action.ts
index 85215238dbefc..2dce8ead38584 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/action.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/action.ts
@@ -4,14 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ManagementAction } from './managing';
+import { HostAction } from './hosts';
 import { AlertAction } from './alerts';
 import { RoutingAction } from './routing';
 import { PolicyListAction } from './policy_list';
 import { PolicyDetailsAction } from './policy_details';
 
 export type AppAction =
-  | ManagementAction
+  | HostAction
   | AlertAction
   | RoutingAction
   | PolicyListAction
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/action.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/action.ts
new file mode 100644
index 0000000000000..dee35aa3b895a
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/action.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HostListPagination, ServerApiError } from '../../types';
+import { HostResultList, HostMetadata } from '../../../../../common/types';
+
+interface ServerReturnedHostList {
+  type: 'serverReturnedHostList';
+  payload: HostResultList;
+}
+
+interface ServerReturnedHostDetails {
+  type: 'serverReturnedHostDetails';
+  payload: HostMetadata;
+}
+
+interface ServerFailedToReturnHostDetails {
+  type: 'serverFailedToReturnHostDetails';
+  payload: ServerApiError;
+}
+
+interface UserPaginatedHostList {
+  type: 'userPaginatedHostList';
+  payload: HostListPagination;
+}
+
+// Why is FakeActionWithNoPayload here, see: https://github.com/elastic/endpoint-app-team/issues/273
+interface FakeActionWithNoPayload {
+  type: 'fakeActionWithNoPayLoad';
+}
+
+export type HostAction =
+  | ServerReturnedHostList
+  | ServerReturnedHostDetails
+  | ServerFailedToReturnHostDetails
+  | UserPaginatedHostList
+  | FakeActionWithNoPayload;
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/index.test.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/index.test.ts
new file mode 100644
index 0000000000000..9aff66cdfb75e
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/index.test.ts
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createStore, Dispatch, Store } from 'redux';
+import { HostAction, hostListReducer } from './index';
+import { HostListState } from '../../types';
+import { listData } from './selectors';
+import { mockHostResultList } from './mock_host_result_list';
+
+describe('HostList store concerns', () => {
+  let store: Store<HostListState>;
+  let dispatch: Dispatch<HostAction>;
+  const createTestStore = () => {
+    store = createStore(hostListReducer);
+    dispatch = store.dispatch;
+  };
+
+  const loadDataToStore = () => {
+    dispatch({
+      type: 'serverReturnedHostList',
+      payload: mockHostResultList({ request_page_size: 1, request_page_index: 1, total: 10 }),
+    });
+  };
+
+  describe('# Reducers', () => {
+    beforeEach(() => {
+      createTestStore();
+    });
+
+    test('it creates default state', () => {
+      expect(store.getState()).toEqual({
+        hosts: [],
+        pageSize: 10,
+        pageIndex: 0,
+        total: 0,
+        loading: false,
+      });
+    });
+
+    test('it handles `serverReturnedHostList', () => {
+      const payload = mockHostResultList({
+        request_page_size: 1,
+        request_page_index: 1,
+        total: 10,
+      });
+      dispatch({
+        type: 'serverReturnedHostList',
+        payload,
+      });
+
+      const currentState = store.getState();
+      expect(currentState.hosts).toEqual(payload.hosts);
+      expect(currentState.pageSize).toEqual(payload.request_page_size);
+      expect(currentState.pageIndex).toEqual(payload.request_page_index);
+      expect(currentState.total).toEqual(payload.total);
+    });
+  });
+
+  describe('# Selectors', () => {
+    beforeEach(() => {
+      createTestStore();
+      loadDataToStore();
+    });
+
+    test('it selects `hostListData`', () => {
+      const currentState = store.getState();
+      expect(listData(currentState)).toEqual(currentState.hosts);
+    });
+  });
+});
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/index.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/index.ts
new file mode 100644
index 0000000000000..e80d7a82dc8cb
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/index.ts
@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { hostListReducer } from './reducer';
+export { HostAction } from './action';
+export { hostMiddlewareFactory } from './middleware';
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/middleware.test.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/middleware.test.ts
similarity index 63%
rename from x-pack/plugins/endpoint/public/applications/endpoint/store/managing/middleware.test.ts
rename to x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/middleware.test.ts
index 459a1789a58da..a1973a38b6534 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/middleware.test.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/middleware.test.ts
@@ -7,51 +7,40 @@ import { CoreStart, HttpSetup } from 'kibana/public';
 import { applyMiddleware, createStore, Dispatch, Store } from 'redux';
 import { coreMock } from '../../../../../../../../src/core/public/mocks';
 import { History, createBrowserHistory } from 'history';
-import { managementListReducer, managementMiddlewareFactory } from './index';
-import { EndpointMetadata, EndpointResultList } from '../../../../../common/types';
-import { EndpointDocGenerator } from '../../../../../common/generate_data';
-import { ManagementListState } from '../../types';
+import { hostListReducer, hostMiddlewareFactory } from './index';
+import { HostResultList } from '../../../../../common/types';
+import { HostListState } from '../../types';
 import { AppAction } from '../action';
 import { listData } from './selectors';
 import { DepsStartMock, depsStartMock } from '../../mocks';
+import { mockHostResultList } from './mock_host_result_list';
 
-describe('endpoint list saga', () => {
+describe('host list middleware', () => {
   const sleep = (ms = 100) => new Promise(wakeup => setTimeout(wakeup, ms));
   let fakeCoreStart: jest.Mocked<CoreStart>;
   let depsStart: DepsStartMock;
   let fakeHttpServices: jest.Mocked<HttpSetup>;
-  let store: Store<ManagementListState>;
+  let store: Store<HostListState>;
   let getState: typeof store['getState'];
   let dispatch: Dispatch<AppAction>;
 
-  const generator = new EndpointDocGenerator();
-  // https://github.com/elastic/endpoint-app-team/issues/131
-  const generateEndpoint = (): EndpointMetadata => {
-    return generator.generateEndpointMetadata();
-  };
-
   let history: History<never>;
-  const getEndpointListApiResponse = (): EndpointResultList => {
-    return {
-      endpoints: [generateEndpoint()],
-      request_page_size: 1,
-      request_page_index: 1,
-      total: 10,
-    };
+  const getEndpointListApiResponse = (): HostResultList => {
+    return mockHostResultList({ request_page_size: 1, request_page_index: 1, total: 10 });
   };
   beforeEach(() => {
     fakeCoreStart = coreMock.createStart({ basePath: '/mock' });
     depsStart = depsStartMock();
     fakeHttpServices = fakeCoreStart.http as jest.Mocked<HttpSetup>;
     store = createStore(
-      managementListReducer,
-      applyMiddleware(managementMiddlewareFactory(fakeCoreStart, depsStart))
+      hostListReducer,
+      applyMiddleware(hostMiddlewareFactory(fakeCoreStart, depsStart))
     );
     getState = store.getState;
     dispatch = store.dispatch;
     history = createBrowserHistory();
   });
-  test('it handles `userChangedUrl`', async () => {
+  test('handles `userChangedUrl`', async () => {
     const apiResponse = getEndpointListApiResponse();
     fakeHttpServices.post.mockResolvedValue(apiResponse);
     expect(fakeHttpServices.post).not.toHaveBeenCalled();
@@ -60,7 +49,7 @@ describe('endpoint list saga', () => {
       type: 'userChangedUrl',
       payload: {
         ...history.location,
-        pathname: '/management',
+        pathname: '/hosts',
       },
     });
     await sleep();
@@ -69,6 +58,6 @@ describe('endpoint list saga', () => {
         paging_properties: [{ page_index: 0 }, { page_size: 10 }],
       }),
     });
-    expect(listData(getState())).toEqual(apiResponse.endpoints);
+    expect(listData(getState())).toEqual(apiResponse.hosts);
   });
 });
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/middleware.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/middleware.ts
similarity index 59%
rename from x-pack/plugins/endpoint/public/applications/endpoint/store/managing/middleware.ts
rename to x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/middleware.ts
index 1131e8d769fcf..9481b6633f12e 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/middleware.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/middleware.ts
@@ -5,39 +5,30 @@
  */
 
 import { MiddlewareFactory } from '../../types';
-import {
-  pageIndex,
-  pageSize,
-  isOnManagementPage,
-  hasSelectedHost,
-  uiQueryParams,
-} from './selectors';
-import { ManagementListState } from '../../types';
+import { pageIndex, pageSize, isOnHostPage, hasSelectedHost, uiQueryParams } from './selectors';
+import { HostListState } from '../../types';
 import { AppAction } from '../action';
 
-export const managementMiddlewareFactory: MiddlewareFactory<ManagementListState> = coreStart => {
+export const hostMiddlewareFactory: MiddlewareFactory<HostListState> = coreStart => {
   return ({ getState, dispatch }) => next => async (action: AppAction) => {
     next(action);
     const state = getState();
     if (
       (action.type === 'userChangedUrl' &&
-        isOnManagementPage(state) &&
+        isOnHostPage(state) &&
         hasSelectedHost(state) !== true) ||
-      action.type === 'userPaginatedManagementList'
+      action.type === 'userPaginatedHostList'
     ) {
-      const managementPageIndex = pageIndex(state);
-      const managementPageSize = pageSize(state);
+      const hostPageIndex = pageIndex(state);
+      const hostPageSize = pageSize(state);
       const response = await coreStart.http.post('/api/endpoint/metadata', {
         body: JSON.stringify({
-          paging_properties: [
-            { page_index: managementPageIndex },
-            { page_size: managementPageSize },
-          ],
+          paging_properties: [{ page_index: hostPageIndex }, { page_size: hostPageSize }],
         }),
       });
-      response.request_page_index = managementPageIndex;
+      response.request_page_index = hostPageIndex;
       dispatch({
-        type: 'serverReturnedManagementList',
+        type: 'serverReturnedHostList',
         payload: response,
       });
     }
@@ -46,12 +37,12 @@ export const managementMiddlewareFactory: MiddlewareFactory<ManagementListState>
       try {
         const response = await coreStart.http.get(`/api/endpoint/metadata/${selectedHost}`);
         dispatch({
-          type: 'serverReturnedManagementDetails',
+          type: 'serverReturnedHostDetails',
           payload: response,
         });
       } catch (error) {
         dispatch({
-          type: 'serverFailedToReturnManagementDetails',
+          type: 'serverFailedToReturnHostDetails',
           payload: error,
         });
       }
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/mock_host_result_list.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/mock_host_result_list.ts
similarity index 82%
rename from x-pack/plugins/endpoint/public/applications/endpoint/store/managing/mock_host_result_list.ts
rename to x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/mock_host_result_list.ts
index 61833d1dfb957..db39ecf448312 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/mock_host_result_list.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/mock_host_result_list.ts
@@ -4,14 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EndpointResultList } from '../../../../../common/types';
+import { HostResultList } from '../../../../../common/types';
 import { EndpointDocGenerator } from '../../../../../common/generate_data';
 
 export const mockHostResultList: (options?: {
   total?: number;
   request_page_size?: number;
   request_page_index?: number;
-}) => EndpointResultList = (options = {}) => {
+}) => HostResultList = (options = {}) => {
   const {
     total = 1,
     request_page_size: requestPageSize = 10,
@@ -24,13 +24,13 @@ export const mockHostResultList: (options?: {
   // total - numberToSkip is the count of non-skipped ones, but return no more than a pageSize, and no less than 0
   const actualCountToReturn = Math.max(Math.min(total - numberToSkip, requestPageSize), 0);
 
-  const endpoints = [];
+  const hosts = [];
   for (let index = 0; index < actualCountToReturn; index++) {
     const generator = new EndpointDocGenerator('seed');
-    endpoints.push(generator.generateEndpointMetadata());
+    hosts.push(generator.generateHostMetadata());
   }
-  const mock: EndpointResultList = {
-    endpoints,
+  const mock: HostResultList = {
+    hosts,
     total,
     request_page_size: requestPageSize,
     request_page_index: requestPageIndex,
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/reducer.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/reducer.ts
similarity index 66%
rename from x-pack/plugins/endpoint/public/applications/endpoint/store/managing/reducer.ts
rename to x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/reducer.ts
index 582aa6b7138c9..fd70317a9f37e 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/reducer.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/reducer.ts
@@ -5,12 +5,12 @@
  */
 
 import { Reducer } from 'redux';
-import { ManagementListState } from '../../types';
+import { HostListState } from '../../types';
 import { AppAction } from '../action';
 
-const initialState = (): ManagementListState => {
+const initialState = (): HostListState => {
   return {
-    endpoints: [],
+    hosts: [],
     pageSize: 10,
     pageIndex: 0,
     total: 0,
@@ -21,38 +21,36 @@ const initialState = (): ManagementListState => {
   };
 };
 
-export const managementListReducer: Reducer<ManagementListState, AppAction> = (
+export const hostListReducer: Reducer<HostListState, AppAction> = (
   state = initialState(),
   action
 ) => {
-  if (action.type === 'serverReturnedManagementList') {
+  if (action.type === 'serverReturnedHostList') {
     const {
-      endpoints,
+      hosts,
       total,
       request_page_size: pageSize,
       request_page_index: pageIndex,
     } = action.payload;
     return {
       ...state,
-      endpoints,
+      hosts,
       total,
       pageSize,
       pageIndex,
       loading: false,
     };
-  } else if (action.type === 'serverReturnedManagementDetails') {
+  } else if (action.type === 'serverReturnedHostDetails') {
     return {
       ...state,
       details: action.payload,
     };
-  } else if (action.type === 'serverFailedToReturnManagementDetails') {
+  } else if (action.type === 'serverFailedToReturnHostDetails') {
     return {
       ...state,
       detailsError: action.payload,
     };
-  } else if (action.type === 'userExitedManagementList') {
-    return initialState();
-  } else if (action.type === 'userPaginatedManagementList') {
+  } else if (action.type === 'userPaginatedHostList') {
     return {
       ...state,
       ...action.payload,
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/selectors.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/selectors.ts
new file mode 100644
index 0000000000000..ebe310cb51190
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/hosts/selectors.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import querystring from 'querystring';
+import { createSelector } from 'reselect';
+import { Immutable } from '../../../../../common/types';
+import { HostListState, HostIndexUIQueryParams } from '../../types';
+
+export const listData = (state: HostListState) => state.hosts;
+
+export const pageIndex = (state: HostListState) => state.pageIndex;
+
+export const pageSize = (state: HostListState) => state.pageSize;
+
+export const totalHits = (state: HostListState) => state.total;
+
+export const isLoading = (state: HostListState) => state.loading;
+
+export const detailsError = (state: HostListState) => state.detailsError;
+
+export const detailsData = (state: HostListState) => {
+  return state.details;
+};
+
+export const isOnHostPage = (state: HostListState) =>
+  state.location ? state.location.pathname === '/hosts' : false;
+
+export const uiQueryParams: (
+  state: HostListState
+) => Immutable<HostIndexUIQueryParams> = createSelector(
+  (state: HostListState) => state.location,
+  (location: HostListState['location']) => {
+    const data: HostIndexUIQueryParams = {};
+    if (location) {
+      // Removes the `?` from the beginning of query string if it exists
+      const query = querystring.parse(location.search.slice(1));
+
+      const keys: Array<keyof HostIndexUIQueryParams> = ['selected_host'];
+
+      for (const key of keys) {
+        const value = query[key];
+        if (typeof value === 'string') {
+          data[key] = value;
+        } else if (Array.isArray(value)) {
+          data[key] = value[value.length - 1];
+        }
+      }
+    }
+    return data;
+  }
+);
+
+export const hasSelectedHost: (state: HostListState) => boolean = createSelector(
+  uiQueryParams,
+  ({ selected_host: selectedHost }) => {
+    return selectedHost !== undefined;
+  }
+);
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/index.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/index.ts
index c051be2bb83cb..efa79b163d3b6 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/index.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/index.ts
@@ -16,7 +16,7 @@ import {
 import { CoreStart } from 'kibana/public';
 import { appReducer } from './reducer';
 import { alertMiddlewareFactory } from './alerts/middleware';
-import { managementMiddlewareFactory } from './managing';
+import { hostMiddlewareFactory } from './hosts';
 import { policyListMiddlewareFactory } from './policy_list';
 import { policyDetailsMiddlewareFactory } from './policy_details';
 import { GlobalState } from '../types';
@@ -69,8 +69,8 @@ export const appStoreFactory: (middlewareDeps?: {
     middleware = composeWithReduxDevTools(
       applyMiddleware(
         substateMiddlewareFactory(
-          globalState => globalState.managementList,
-          managementMiddlewareFactory(coreStart, depsStart)
+          globalState => globalState.hostList,
+          hostMiddlewareFactory(coreStart, depsStart)
         ),
         substateMiddlewareFactory(
           globalState => globalState.policyList,
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/action.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/action.ts
deleted file mode 100644
index a42e23e57d107..0000000000000
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/action.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { ManagementListPagination, ServerApiError } from '../../types';
-import { EndpointResultList, EndpointMetadata } from '../../../../../common/types';
-
-interface ServerReturnedManagementList {
-  type: 'serverReturnedManagementList';
-  payload: EndpointResultList;
-}
-
-interface ServerReturnedManagementDetails {
-  type: 'serverReturnedManagementDetails';
-  payload: EndpointMetadata;
-}
-
-interface ServerFailedToReturnManagementDetails {
-  type: 'serverFailedToReturnManagementDetails';
-  payload: ServerApiError;
-}
-
-interface UserExitedManagementList {
-  type: 'userExitedManagementList';
-}
-
-interface UserPaginatedManagementList {
-  type: 'userPaginatedManagementList';
-  payload: ManagementListPagination;
-}
-
-export type ManagementAction =
-  | ServerReturnedManagementList
-  | ServerReturnedManagementDetails
-  | ServerFailedToReturnManagementDetails
-  | UserExitedManagementList
-  | UserPaginatedManagementList;
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/index.test.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/index.test.ts
deleted file mode 100644
index e435fded13f4c..0000000000000
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/index.test.ts
+++ /dev/null
@@ -1,93 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { createStore, Dispatch, Store } from 'redux';
-import { ManagementAction, managementListReducer } from './index';
-import { EndpointMetadata } from '../../../../../common/types';
-import { EndpointDocGenerator } from '../../../../../common/generate_data';
-import { ManagementListState } from '../../types';
-import { listData } from './selectors';
-
-describe('endpoint_list store concerns', () => {
-  let store: Store<ManagementListState>;
-  let dispatch: Dispatch<ManagementAction>;
-  const generator = new EndpointDocGenerator();
-  const createTestStore = () => {
-    store = createStore(managementListReducer);
-    dispatch = store.dispatch;
-  };
-  const generateEndpoint = (): EndpointMetadata => {
-    return generator.generateEndpointMetadata();
-  };
-  const loadDataToStore = () => {
-    dispatch({
-      type: 'serverReturnedManagementList',
-      payload: {
-        endpoints: [generateEndpoint()],
-        request_page_size: 1,
-        request_page_index: 1,
-        total: 10,
-      },
-    });
-  };
-
-  describe('# Reducers', () => {
-    beforeEach(() => {
-      createTestStore();
-    });
-
-    test('it creates default state', () => {
-      expect(store.getState()).toEqual({
-        endpoints: [],
-        pageSize: 10,
-        pageIndex: 0,
-        total: 0,
-        loading: false,
-      });
-    });
-
-    test('it handles `serverReturnedManagementList', () => {
-      const payload = {
-        endpoints: [generateEndpoint()],
-        request_page_size: 1,
-        request_page_index: 1,
-        total: 10,
-      };
-      dispatch({
-        type: 'serverReturnedManagementList',
-        payload,
-      });
-
-      const currentState = store.getState();
-      expect(currentState.endpoints).toEqual(payload.endpoints);
-      expect(currentState.pageSize).toEqual(payload.request_page_size);
-      expect(currentState.pageIndex).toEqual(payload.request_page_index);
-      expect(currentState.total).toEqual(payload.total);
-    });
-
-    test('it handles `userExitedManagementListPage`', () => {
-      loadDataToStore();
-
-      expect(store.getState().total).toEqual(10);
-
-      dispatch({ type: 'userExitedManagementList' });
-      expect(store.getState().endpoints.length).toEqual(0);
-      expect(store.getState().pageIndex).toEqual(0);
-    });
-  });
-
-  describe('# Selectors', () => {
-    beforeEach(() => {
-      createTestStore();
-      loadDataToStore();
-    });
-
-    test('it selects `managementListData`', () => {
-      const currentState = store.getState();
-      expect(listData(currentState)).toEqual(currentState.endpoints);
-    });
-  });
-});
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/selectors.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/selectors.ts
deleted file mode 100644
index a7776f09fe2b8..0000000000000
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/managing/selectors.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import querystring from 'querystring';
-import { createSelector } from 'reselect';
-import { Immutable } from '../../../../../common/types';
-import { ManagementListState, ManagingIndexUIQueryParams } from '../../types';
-
-export const listData = (state: ManagementListState) => state.endpoints;
-
-export const pageIndex = (state: ManagementListState) => state.pageIndex;
-
-export const pageSize = (state: ManagementListState) => state.pageSize;
-
-export const totalHits = (state: ManagementListState) => state.total;
-
-export const isLoading = (state: ManagementListState) => state.loading;
-
-export const detailsError = (state: ManagementListState) => state.detailsError;
-
-export const detailsData = (state: ManagementListState) => {
-  return state.details;
-};
-
-export const isOnManagementPage = (state: ManagementListState) =>
-  state.location ? state.location.pathname === '/management' : false;
-
-export const uiQueryParams: (
-  state: ManagementListState
-) => Immutable<ManagingIndexUIQueryParams> = createSelector(
-  (state: ManagementListState) => state.location,
-  (location: ManagementListState['location']) => {
-    const data: ManagingIndexUIQueryParams = {};
-    if (location) {
-      // Removes the `?` from the beginning of query string if it exists
-      const query = querystring.parse(location.search.slice(1));
-
-      const keys: Array<keyof ManagingIndexUIQueryParams> = ['selected_host'];
-
-      for (const key of keys) {
-        const value = query[key];
-        if (typeof value === 'string') {
-          data[key] = value;
-        } else if (Array.isArray(value)) {
-          data[key] = value[value.length - 1];
-        }
-      }
-    }
-    return data;
-  }
-);
-
-export const hasSelectedHost: (state: ManagementListState) => boolean = createSelector(
-  uiQueryParams,
-  ({ selected_host: selectedHost }) => {
-    return selectedHost !== undefined;
-  }
-);
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/middleware.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/middleware.ts
index 92a1c036c0211..39d7eb93569e2 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/middleware.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/middleware.ts
@@ -6,8 +6,11 @@
 
 import { MiddlewareFactory, PolicyDetailsState } from '../../types';
 import { selectPolicyIdFromParams, isOnPolicyDetailsPage } from './selectors';
+import { sendGetDatasource } from '../../services/ingest';
 
 export const policyDetailsMiddlewareFactory: MiddlewareFactory<PolicyDetailsState> = coreStart => {
+  const http = coreStart.http;
+
   return ({ getState, dispatch }) => next => async action => {
     next(action);
     const state = getState();
@@ -15,8 +18,7 @@ export const policyDetailsMiddlewareFactory: MiddlewareFactory<PolicyDetailsStat
     if (action.type === 'userChangedUrl' && isOnPolicyDetailsPage(state)) {
       const id = selectPolicyIdFromParams(state);
 
-      const { getFakeDatasourceDetailsApiResponse } = await import('../policy_list/fake_data');
-      const policyItem = await getFakeDatasourceDetailsApiResponse(id);
+      const { item: policyItem } = await sendGetDatasource(http, id);
 
       dispatch({
         type: 'serverReturnedPolicyDetailsData',
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/reducer.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/reducer.ts
index 1d37e4aa24b65..7a0c8ca8c610a 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/reducer.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_details/reducer.ts
@@ -10,17 +10,7 @@ import { AppAction } from '../action';
 
 const initialPolicyDetailsState = (): PolicyDetailsState => {
   return {
-    policyItem: {
-      name: '',
-      total: 0,
-      pending: 0,
-      failed: 0,
-      id: '',
-      created_by: '',
-      created: '',
-      updated_by: '',
-      updated: '',
-    },
+    policyItem: undefined,
     isLoading: false,
   };
 };
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/action.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/action.ts
index 5ac2a4328b00a..3f4f3f39e9be0 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/action.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/action.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { PolicyData } from '../../types';
+import { PolicyData, ServerApiError } from '../../types';
 
 interface ServerReturnedPolicyListData {
   type: 'serverReturnedPolicyListData';
@@ -16,6 +16,11 @@ interface ServerReturnedPolicyListData {
   };
 }
 
+interface ServerFailedToReturnPolicyListData {
+  type: 'serverFailedToReturnPolicyListData';
+  payload: ServerApiError;
+}
+
 interface UserPaginatedPolicyListTable {
   type: 'userPaginatedPolicyListTable';
   payload: {
@@ -24,4 +29,7 @@ interface UserPaginatedPolicyListTable {
   };
 }
 
-export type PolicyListAction = ServerReturnedPolicyListData | UserPaginatedPolicyListTable;
+export type PolicyListAction =
+  | ServerReturnedPolicyListData
+  | UserPaginatedPolicyListTable
+  | ServerFailedToReturnPolicyListData;
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/fake_data.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/fake_data.ts
deleted file mode 100644
index 2312d3397f7be..0000000000000
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/fake_data.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-// !!!! Should be deleted when https://github.com/elastic/endpoint-app-team/issues/150
-// is implemented
-
-const dateOffsets = [
-  0,
-  1000,
-  300000, // 5 minutes
-  3.6e6, // 1 hour
-  86340000, // 23h, 59m
-  9e7, // 25h
-  9e7 * 5, // 5d
-];
-
-const randomNumbers = [5, 50, 500, 5000, 50000];
-
-const getRandomDateIsoString = () => {
-  const randomIndex = Math.floor(Math.random() * Math.floor(dateOffsets.length));
-  return new Date(Date.now() - dateOffsets[randomIndex]).toISOString();
-};
-
-const getRandomNumber = () => {
-  const randomIndex = Math.floor(Math.random() * Math.floor(randomNumbers.length));
-  return randomNumbers[randomIndex];
-};
-
-const policyItem = (id: string) => {
-  return {
-    name: `policy with some protections  ${id}`,
-    total: getRandomNumber(),
-    pending: getRandomNumber(),
-    failed: getRandomNumber(),
-    id: `${id}`,
-    created_by: `admin ABC`,
-    created: getRandomDateIsoString(),
-    updated_by: 'admin 123',
-    updated: getRandomDateIsoString(),
-  };
-};
-
-export const getFakeDatasourceApiResponse = async (page: number, pageSize: number) => {
-  await new Promise(resolve => setTimeout(resolve, 500));
-
-  // Emulates the API response - see PR:
-  // https://github.com/elastic/kibana/pull/56567/files#diff-431549a8739efe0c56763f164c32caeeR25
-  return {
-    items: Array.from({ length: pageSize }, (x, i) => policyItem(`${i + 1}`)),
-    success: true,
-    total: pageSize * 10,
-    page,
-    perPage: pageSize,
-  };
-};
-
-export const getFakeDatasourceDetailsApiResponse = async (id: string) => {
-  await new Promise(resolve => setTimeout(resolve, 500));
-  return policyItem(id);
-};
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/middleware.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/middleware.ts
index f8e2b7d07c389..ebfee5dbe6a7e 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/middleware.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/middleware.ts
@@ -5,8 +5,11 @@
  */
 
 import { MiddlewareFactory, PolicyListState } from '../../types';
+import { GetDatasourcesResponse, sendGetEndpointSpecificDatasources } from '../../services/ingest';
 
 export const policyListMiddlewareFactory: MiddlewareFactory<PolicyListState> = coreStart => {
+  const http = coreStart.http;
+
   return ({ getState, dispatch }) => next => async action => {
     next(action);
 
@@ -26,10 +29,24 @@ export const policyListMiddlewareFactory: MiddlewareFactory<PolicyListState> = c
         pageIndex = state.pageIndex;
       }
 
-      // Need load data from API and remove fake data below
-      // Refactor tracked via: https://github.com/elastic/endpoint-app-team/issues/150
-      const { getFakeDatasourceApiResponse } = await import('./fake_data');
-      const { items: policyItems, total } = await getFakeDatasourceApiResponse(pageIndex, pageSize);
+      let response: GetDatasourcesResponse;
+
+      try {
+        response = await sendGetEndpointSpecificDatasources(http, {
+          query: {
+            perPage: pageSize,
+            page: pageIndex + 1,
+          },
+        });
+      } catch (err) {
+        dispatch({
+          type: 'serverFailedToReturnPolicyListData',
+          payload: err.body ?? err,
+        });
+        return;
+      }
+
+      const { items: policyItems, total } = response;
 
       dispatch({
         type: 'serverReturnedPolicyListData',
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/reducer.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/reducer.ts
index 77f536d413ae3..b964f4f023866 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/reducer.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/reducer.ts
@@ -12,6 +12,7 @@ const initialPolicyListState = (): PolicyListState => {
   return {
     policyItems: [],
     isLoading: false,
+    apiError: undefined,
     pageIndex: 0,
     pageSize: 10,
     total: 0,
@@ -30,12 +31,21 @@ export const policyListReducer: Reducer<PolicyListState, AppAction> = (
     };
   }
 
+  if (action.type === 'serverFailedToReturnPolicyListData') {
+    return {
+      ...state,
+      apiError: action.payload,
+      isLoading: false,
+    };
+  }
+
   if (
     action.type === 'userPaginatedPolicyListTable' ||
     (action.type === 'userNavigatedToPage' && action.payload === 'policyListPage')
   ) {
     return {
       ...state,
+      apiError: undefined,
       isLoading: true,
     };
   }
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/selectors.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/selectors.ts
index b9c2edbf5d55b..7ca25e81ce75a 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/selectors.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/policy_list/selectors.ts
@@ -15,3 +15,5 @@ export const selectPageSize = (state: PolicyListState) => state.pageSize;
 export const selectTotal = (state: PolicyListState) => state.total;
 
 export const selectIsLoading = (state: PolicyListState) => state.isLoading;
+
+export const selectApiError = (state: PolicyListState) => state.apiError;
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/store/reducer.ts b/x-pack/plugins/endpoint/public/applications/endpoint/store/reducer.ts
index e655a8d5e46db..c8b2d08676724 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/store/reducer.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/store/reducer.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { combineReducers, Reducer } from 'redux';
-import { managementListReducer } from './managing';
+import { hostListReducer } from './hosts';
 import { AppAction } from './action';
 import { alertListReducer } from './alerts';
 import { GlobalState } from '../types';
@@ -12,7 +12,7 @@ import { policyListReducer } from './policy_list';
 import { policyDetailsReducer } from './policy_details';
 
 export const appReducer: Reducer<GlobalState, AppAction> = combineReducers({
-  managementList: managementListReducer,
+  hostList: hostListReducer,
   alertList: alertListReducer,
   policyList: policyListReducer,
   policyDetails: policyDetailsReducer,
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/types.ts b/x-pack/plugins/endpoint/public/applications/endpoint/types.ts
index 91be6e4936dbe..dae2c93c9dd04 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/types.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/types.ts
@@ -7,7 +7,7 @@
 import { Dispatch, MiddlewareAPI } from 'redux';
 import { IIndexPattern } from 'src/plugins/data/public';
 import {
-  EndpointMetadata,
+  HostMetadata,
   AlertData,
   AlertResultList,
   Immutable,
@@ -16,6 +16,7 @@ import {
 import { EndpointPluginStartDependencies } from '../../plugin';
 import { AppAction } from './store/action';
 import { CoreStart } from '../../../../../../src/core/public';
+import { Datasource } from '../../../../ingest_manager/common/types/models';
 
 export { AppAction };
 export type MiddlewareFactory<S = GlobalState> = (
@@ -25,22 +26,22 @@ export type MiddlewareFactory<S = GlobalState> = (
   api: MiddlewareAPI<Dispatch<AppAction>, S>
 ) => (next: Dispatch<AppAction>) => (action: AppAction) => unknown;
 
-export interface ManagementListState {
-  endpoints: EndpointMetadata[];
-  total: number;
+export interface HostListState {
+  hosts: HostMetadata[];
   pageSize: number;
   pageIndex: number;
+  total: number;
   loading: boolean;
   detailsError?: ServerApiError;
-  details?: Immutable<EndpointMetadata>;
+  details?: Immutable<HostMetadata>;
   location?: Immutable<EndpointAppLocation>;
 }
 
-export interface ManagementListPagination {
+export interface HostListPagination {
   pageIndex: number;
   pageSize: number;
 }
-export interface ManagingIndexUIQueryParams {
+export interface HostIndexUIQueryParams {
   selected_host?: string;
 }
 
@@ -50,18 +51,10 @@ export interface ServerApiError {
   message: string;
 }
 
-// REFACTOR to use Types from Ingest Manager - see: https://github.com/elastic/endpoint-app-team/issues/150
-export interface PolicyData {
-  name: string;
-  total: number;
-  pending: number;
-  failed: number;
-  id: string;
-  created_by: string;
-  created: string;
-  updated_by: string;
-  updated: string;
-}
+/**
+ * An Endpoint Policy.
+ */
+export type PolicyData = Datasource;
 
 /**
  * Policy list store state
@@ -69,6 +62,8 @@ export interface PolicyData {
 export interface PolicyListState {
   /** Array of policy items  */
   policyItems: PolicyData[];
+  /** API error if loading data failed */
+  apiError?: ServerApiError;
   /** total number of policies */
   total: number;
   /** Number of policies per page */
@@ -92,7 +87,7 @@ export interface PolicyDetailsState {
 }
 
 export interface GlobalState {
-  readonly managementList: ManagementListState;
+  readonly hostList: HostListState;
   readonly alertList: AlertListState;
   readonly policyList: PolicyListState;
   readonly policyDetails: PolicyDetailsState;
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/formatted_date_time.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/formatted_date_time.tsx
new file mode 100644
index 0000000000000..dcf97b4b2b226
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/formatted_date_time.tsx
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { FormattedDate, FormattedTime, FormattedRelative } from '@kbn/i18n/react';
+
+export const FormattedDateAndTime: React.FC<{ date: Date }> = ({ date }) => {
+  // If date is greater than or equal to 1h (ago), then show it as a date
+  // else, show it as relative to "now"
+  return Date.now() - date.getTime() >= 3.6e6 ? (
+    <>
+      <FormattedDate value={date} year="numeric" month="short" day="2-digit" />
+      {' @'}
+      <FormattedTime value={date} />
+    </>
+  ) : (
+    <>
+      <FormattedRelative value={date} />
+    </>
+  );
+};
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/details.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/details.tsx
similarity index 62%
rename from x-pack/plugins/endpoint/public/applications/endpoint/view/managing/details.tsx
rename to x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/details.tsx
index 9f2a732042719..37080e8568350 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/details.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/details.tsx
@@ -13,38 +13,46 @@ import {
   EuiDescriptionList,
   EuiLoadingContent,
   EuiHorizontalRule,
+  EuiHealth,
   EuiSpacer,
+  EuiListGroup,
+  EuiListGroupItem,
 } from '@elastic/eui';
 import { useHistory } from 'react-router-dom';
+import styled from 'styled-components';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
-import { useManagementListSelector } from './hooks';
+import { HostMetadata } from '../../../../../common/types';
+import { useHostListSelector } from './hooks';
 import { urlFromQueryParams } from './url_from_query_params';
-import { uiQueryParams, detailsData, detailsError } from './../../store/managing/selectors';
+import { FormattedDateAndTime } from '../formatted_date_time';
+import { uiQueryParams, detailsData, detailsError } from './../../store/hosts/selectors';
 
-const HostDetails = memo(() => {
-  const details = useManagementListSelector(detailsData);
-  if (details === undefined) {
-    return null;
+const HostIds = styled(EuiListGroupItem)`
+  margin-top: 0;
+  .euiListGroupItem__text {
+    padding: 0;
   }
+`;
 
+const HostDetails = memo(({ details }: { details: HostMetadata }) => {
   const detailsResultsUpper = useMemo(() => {
     return [
       {
-        title: i18n.translate('xpack.endpoint.management.details.os', {
+        title: i18n.translate('xpack.endpoint.host.details.os', {
           defaultMessage: 'OS',
         }),
         description: details.host.os.full,
       },
       {
-        title: i18n.translate('xpack.endpoint.management.details.lastSeen', {
+        title: i18n.translate('xpack.endpoint.host.details.lastSeen', {
           defaultMessage: 'Last Seen',
         }),
-        description: details['@timestamp'],
+        description: <FormattedDateAndTime date={new Date(details['@timestamp'])} />,
       },
       {
-        title: i18n.translate('xpack.endpoint.management.details.alerts', {
+        title: i18n.translate('xpack.endpoint.host.details.alerts', {
           defaultMessage: 'Alerts',
         }),
         description: '0',
@@ -55,62 +63,67 @@ const HostDetails = memo(() => {
   const detailsResultsLower = useMemo(() => {
     return [
       {
-        title: i18n.translate('xpack.endpoint.management.details.policy', {
+        title: i18n.translate('xpack.endpoint.host.details.policy', {
           defaultMessage: 'Policy',
         }),
         description: details.endpoint.policy.id,
       },
       {
-        title: i18n.translate('xpack.endpoint.management.details.policyStatus', {
+        title: i18n.translate('xpack.endpoint.host.details.policyStatus', {
           defaultMessage: 'Policy Status',
         }),
-        description: 'active',
+        description: <EuiHealth color="success">active</EuiHealth>,
       },
       {
-        title: i18n.translate('xpack.endpoint.management.details.ipAddress', {
+        title: i18n.translate('xpack.endpoint.host.details.ipAddress', {
           defaultMessage: 'IP Address',
         }),
-        description: details.host.ip,
+        description: (
+          <EuiListGroup flush>
+            {details.host.ip.map((ip: string, index: number) => (
+              <HostIds key={index} label={ip} />
+            ))}
+          </EuiListGroup>
+        ),
       },
       {
-        title: i18n.translate('xpack.endpoint.management.details.hostname', {
+        title: i18n.translate('xpack.endpoint.host.details.hostname', {
           defaultMessage: 'Hostname',
         }),
         description: details.host.hostname,
       },
       {
-        title: i18n.translate('xpack.endpoint.management.details.sensorVersion', {
+        title: i18n.translate('xpack.endpoint.host.details.sensorVersion', {
           defaultMessage: 'Sensor Version',
         }),
         description: details.agent.version,
       },
     ];
   }, [details.agent.version, details.endpoint.policy.id, details.host.hostname, details.host.ip]);
-
   return (
     <>
       <EuiDescriptionList
         type="column"
         listItems={detailsResultsUpper}
-        data-test-subj="managementDetailsUpperList"
+        data-test-subj="hostDetailsUpperList"
       />
       <EuiHorizontalRule margin="s" />
       <EuiDescriptionList
         type="column"
         listItems={detailsResultsLower}
-        data-test-subj="managementDetailsLowerList"
+        data-test-subj="hostDetailsLowerList"
       />
     </>
   );
 });
 
-export const ManagementDetails = () => {
+export const HostDetailsFlyout = () => {
   const history = useHistory();
   const { notifications } = useKibana();
-  const queryParams = useManagementListSelector(uiQueryParams);
+  const queryParams = useHostListSelector(uiQueryParams);
   const { selected_host: selectedHost, ...queryParamsWithoutSelectedHost } = queryParams;
-  const details = useManagementListSelector(detailsData);
-  const error = useManagementListSelector(detailsError);
+  const details = useHostListSelector(detailsData);
+  const error = useHostListSelector(detailsError);
 
   const handleFlyoutClose = useCallback(() => {
     history.push(urlFromQueryParams(queryParamsWithoutSelectedHost));
@@ -121,13 +134,13 @@ export const ManagementDetails = () => {
       notifications.toasts.danger({
         title: (
           <FormattedMessage
-            id="xpack.endpoint.managementDetails.errorTitle"
+            id="xpack.endpoint.host.details.errorTitle"
             defaultMessage="Could not find host"
           />
         ),
         body: (
           <FormattedMessage
-            id="xpack.endpoint.managementDetails.errorBody"
+            id="xpack.endpoint.host.details.errorBody"
             defaultMessage="Please exit the flyout and select an available host."
           />
         ),
@@ -137,10 +150,10 @@ export const ManagementDetails = () => {
   }, [error, notifications.toasts]);
 
   return (
-    <EuiFlyout onClose={handleFlyoutClose} data-test-subj="managementDetailsFlyout">
+    <EuiFlyout onClose={handleFlyoutClose} data-test-subj="hostDetailsFlyout">
       <EuiFlyoutHeader hasBorder>
         <EuiTitle size="s">
-          <h2 data-test-subj="managementDetailsTitle">
+          <h2 data-test-subj="hostDetailsFlyoutTitle">
             {details === undefined ? <EuiLoadingContent lines={1} /> : details.host.hostname}
           </h2>
         </EuiTitle>
@@ -151,7 +164,7 @@ export const ManagementDetails = () => {
             <EuiLoadingContent lines={3} /> <EuiSpacer size="l" /> <EuiLoadingContent lines={3} />
           </>
         ) : (
-          <HostDetails />
+          <HostDetails details={details} />
         )}
       </EuiFlyoutBody>
     </EuiFlyout>
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/hooks.ts b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/hooks.ts
similarity index 61%
rename from x-pack/plugins/endpoint/public/applications/endpoint/view/managing/hooks.ts
rename to x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/hooks.ts
index a0720fbd8aeeb..99a0073f46c74 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/hooks.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/hooks.ts
@@ -5,12 +5,10 @@
  */
 
 import { useSelector } from 'react-redux';
-import { GlobalState, ManagementListState } from '../../types';
+import { GlobalState, HostListState } from '../../types';
 
-export function useManagementListSelector<TSelected>(
-  selector: (state: ManagementListState) => TSelected
-) {
+export function useHostListSelector<TSelected>(selector: (state: HostListState) => TSelected) {
   return useSelector(function(state: GlobalState) {
-    return selector(state.managementList);
+    return selector(state.hostList);
   });
 }
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/index.test.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/index.test.tsx
similarity index 78%
rename from x-pack/plugins/endpoint/public/applications/endpoint/view/managing/index.test.tsx
rename to x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/index.test.tsx
index 197db7bd19215..2cb2aec8b2feb 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/index.test.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/index.test.tsx
@@ -8,15 +8,16 @@ import React from 'react';
 import * as reactTestingLibrary from '@testing-library/react';
 import { Provider } from 'react-redux';
 import { I18nProvider } from '@kbn/i18n/react';
+import { EuiThemeProvider } from '../../../../../../../legacy/common/eui_styled_components';
 import { appStoreFactory } from '../../store';
 import { RouteCapture } from '../route_capture';
 import { createMemoryHistory, MemoryHistory } from 'history';
 import { Router } from 'react-router-dom';
 import { AppAction } from '../../types';
-import { ManagementList } from './index';
-import { mockHostResultList } from '../../store/managing/mock_host_result_list';
+import { HostList } from './index';
+import { mockHostResultList } from '../../store/hosts/mock_host_result_list';
 
-describe('when on the managing page', () => {
+describe('when on the hosts page', () => {
   let render: () => reactTestingLibrary.RenderResult;
   let history: MemoryHistory<never>;
   let store: ReturnType<typeof appStoreFactory>;
@@ -33,11 +34,13 @@ describe('when on the managing page', () => {
       return reactTestingLibrary.render(
         <Provider store={store}>
           <I18nProvider>
-            <Router history={history}>
-              <RouteCapture>
-                <ManagementList />
-              </RouteCapture>
-            </Router>
+            <EuiThemeProvider>
+              <Router history={history}>
+                <RouteCapture>
+                  <HostList />
+                </RouteCapture>
+              </Router>
+            </EuiThemeProvider>
           </I18nProvider>
         </Provider>
       );
@@ -55,7 +58,7 @@ describe('when on the managing page', () => {
 
   it('should show a table', async () => {
     const renderResult = render();
-    const table = await queryByTestSubjId(renderResult, 'managementListTable');
+    const table = await renderResult.findByTestId('hostListTable');
     expect(table).not.toBeNull();
   });
 
@@ -63,7 +66,7 @@ describe('when on the managing page', () => {
     it('should not show the flyout', () => {
       const renderResult = render();
       expect.assertions(1);
-      return queryByTestSubjId(renderResult, 'managementDetailsFlyout').catch(e => {
+      return renderResult.findByTestId('hostDetailsFlyout').catch(e => {
         expect(e).not.toBeNull();
       });
     });
@@ -71,14 +74,14 @@ describe('when on the managing page', () => {
       beforeEach(() => {
         reactTestingLibrary.act(() => {
           const action: AppAction = {
-            type: 'serverReturnedManagementList',
+            type: 'serverReturnedHostList',
             payload: mockHostResultList(),
           };
           store.dispatch(action);
         });
       });
 
-      it('should render the management summary row in the table', async () => {
+      it('should render the host summary row in the table', async () => {
         const renderResult = render();
         const rows = await renderResult.findAllByRole('row');
         expect(rows).toHaveLength(2);
@@ -95,7 +98,7 @@ describe('when on the managing page', () => {
         });
 
         it('should show the flyout', () => {
-          return queryByTestSubjId(renderResult, 'managementDetailsFlyout').then(flyout => {
+          return renderResult.findByTestId('hostDetailsFlyout').then(flyout => {
             expect(flyout).not.toBeNull();
           });
         });
@@ -114,7 +117,7 @@ describe('when on the managing page', () => {
     });
     it('should show the flyout', () => {
       const renderResult = render();
-      return queryByTestSubjId(renderResult, 'managementDetailsFlyout').then(flyout => {
+      return renderResult.findByTestId('hostDetailsFlyout').then(flyout => {
         expect(flyout).not.toBeNull();
       });
     });
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/index.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/index.tsx
similarity index 55%
rename from x-pack/plugins/endpoint/public/applications/endpoint/view/managing/index.tsx
rename to x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/index.tsx
index ba9a931a233b2..94625b8c66191 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/index.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/index.tsx
@@ -10,28 +10,29 @@ import { useHistory } from 'react-router-dom';
 import {
   EuiPage,
   EuiPageBody,
+  EuiPageHeader,
   EuiPageContent,
-  EuiPageContentBody,
-  EuiPageContentHeader,
-  EuiPageContentHeaderSection,
+  EuiHorizontalRule,
   EuiTitle,
   EuiBasicTable,
-  EuiTextColor,
+  EuiText,
   EuiLink,
+  EuiHealth,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
+import styled from 'styled-components';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { createStructuredSelector } from 'reselect';
-import { ManagementDetails } from './details';
-import * as selectors from '../../store/managing/selectors';
-import { ManagementAction } from '../../store/managing/action';
-import { useManagementListSelector } from './hooks';
+import { HostDetailsFlyout } from './details';
+import * as selectors from '../../store/hosts/selectors';
+import { HostAction } from '../../store/hosts/action';
+import { useHostListSelector } from './hooks';
 import { CreateStructuredSelector } from '../../types';
 import { urlFromQueryParams } from './url_from_query_params';
 
 const selector = (createStructuredSelector as CreateStructuredSelector)(selectors);
-export const ManagementList = () => {
-  const dispatch = useDispatch<(a: ManagementAction) => void>();
+export const HostList = () => {
+  const dispatch = useDispatch<(a: HostAction) => void>();
   const history = useHistory();
   const {
     listData,
@@ -41,7 +42,7 @@ export const ManagementList = () => {
     isLoading,
     uiQueryParams: queryParams,
     hasSelectedHost,
-  } = useManagementListSelector(selector);
+  } = useHostListSelector(selector);
 
   const paginationSetup = useMemo(() => {
     return {
@@ -57,7 +58,7 @@ export const ManagementList = () => {
     ({ page }: { page: { index: number; size: number } }) => {
       const { index, size } = page;
       dispatch({
-        type: 'userPaginatedManagementList',
+        type: 'userPaginatedHostList',
         payload: { pageIndex: index, pageSize: size },
       });
     },
@@ -68,7 +69,7 @@ export const ManagementList = () => {
     return [
       {
         field: '',
-        name: i18n.translate('xpack.endpoint.management.list.host', {
+        name: i18n.translate('xpack.endpoint.host.list.hostname', {
           defaultMessage: 'Hostname',
         }),
         render: ({ host: { hostname, id } }: { host: { hostname: string; id: string } }) => {
@@ -89,7 +90,7 @@ export const ManagementList = () => {
       },
       {
         field: '',
-        name: i18n.translate('xpack.endpoint.management.list.policy', {
+        name: i18n.translate('xpack.endpoint.host.list.policy', {
           defaultMessage: 'Policy',
         }),
         render: () => {
@@ -98,37 +99,38 @@ export const ManagementList = () => {
       },
       {
         field: '',
-        name: i18n.translate('xpack.endpoint.management.list.policyStatus', {
+        name: i18n.translate('xpack.endpoint.host.list.policyStatus', {
           defaultMessage: 'Policy Status',
         }),
         render: () => {
-          return 'Policy Status';
+          return <EuiHealth color="success">Policy Status</EuiHealth>;
         },
       },
       {
         field: '',
-        name: i18n.translate('xpack.endpoint.management.list.alerts', {
+        name: i18n.translate('xpack.endpoint.host.list.alerts', {
           defaultMessage: 'Alerts',
         }),
+        dataType: 'number',
         render: () => {
           return '0';
         },
       },
       {
         field: 'host.os.name',
-        name: i18n.translate('xpack.endpoint.management.list.os', {
+        name: i18n.translate('xpack.endpoint.host.list.os', {
           defaultMessage: 'Operating System',
         }),
       },
       {
         field: 'host.ip',
-        name: i18n.translate('xpack.endpoint.management.list.ip', {
+        name: i18n.translate('xpack.endpoint.host.list.ip', {
           defaultMessage: 'IP Address',
         }),
       },
       {
         field: '',
-        name: i18n.translate('xpack.endpoint.management.list.sensorVersion', {
+        name: i18n.translate('xpack.endpoint.host.list.sensorVersion', {
           defaultMessage: 'Sensor Version',
         }),
         render: () => {
@@ -137,9 +139,10 @@ export const ManagementList = () => {
       },
       {
         field: '',
-        name: i18n.translate('xpack.endpoint.management.list.lastActive', {
+        name: i18n.translate('xpack.endpoint.host.list.lastActive', {
           defaultMessage: 'Last Active',
         }),
+        dataType: 'date',
         render: () => {
           return 'xxxx';
         },
@@ -148,45 +151,59 @@ export const ManagementList = () => {
   }, [queryParams, history]);
 
   return (
-    <>
-      {hasSelectedHost && <ManagementDetails />}
-      <EuiPage>
+    <HostPage>
+      {hasSelectedHost && <HostDetailsFlyout />}
+      <EuiPage className="hostPage">
         <EuiPageBody>
-          <EuiPageContent>
-            <EuiPageContentHeader>
-              <EuiPageContentHeaderSection>
-                <EuiTitle>
-                  <h2 data-test-subj="managementViewTitle">
-                    <FormattedMessage
-                      id="xpack.endpoint.managementList.hosts"
-                      defaultMessage="Hosts"
-                    />
-                  </h2>
-                </EuiTitle>
-                <h4>
-                  <EuiTextColor color="subdued">
-                    <FormattedMessage
-                      id="xpack.endpoint.managementList.totalCount"
-                      defaultMessage="{totalItemCount} Hosts"
-                      values={{ totalItemCount }}
-                    />
-                  </EuiTextColor>
-                </h4>
-              </EuiPageContentHeaderSection>
-            </EuiPageContentHeader>
-            <EuiPageContentBody>
-              <EuiBasicTable
-                data-test-subj="managementListTable"
-                items={listData}
-                columns={columns}
-                loading={isLoading}
-                pagination={paginationSetup}
-                onChange={onTableChange}
+          <EuiPageHeader className="hostHeader">
+            <EuiTitle size="l">
+              <h1 data-test-subj="hostListTitle">
+                <FormattedMessage id="xpack.endpoint.host.hosts" defaultMessage="Hosts" />
+              </h1>
+            </EuiTitle>
+          </EuiPageHeader>
+
+          <EuiPageContent className="hostPageContent">
+            <EuiText color="subdued" size="xs">
+              <FormattedMessage
+                id="xpack.endpoint.host.list.totalCount"
+                defaultMessage="Showing: {totalItemCount, plural, one {# Host} other {# Hosts}}"
+                values={{ totalItemCount }}
               />
-            </EuiPageContentBody>
+            </EuiText>
+            <EuiHorizontalRule margin="xs" />
+            <EuiBasicTable
+              data-test-subj="hostListTable"
+              items={listData}
+              columns={columns}
+              loading={isLoading}
+              pagination={paginationSetup}
+              onChange={onTableChange}
+            />
           </EuiPageContent>
         </EuiPageBody>
       </EuiPage>
-    </>
+    </HostPage>
   );
 };
+
+const HostPage = styled.div`
+  .hostPage {
+    padding: 0;
+  }
+  .hostHeader {
+    background-color: ${props => props.theme.eui.euiColorLightestShade};
+    border-bottom: ${props => props.theme.eui.euiBorderThin};
+    padding: ${props =>
+      props.theme.eui.euiSizeXL +
+      ' ' +
+      0 +
+      props.theme.eui.euiSizeXL +
+      ' ' +
+      props.theme.eui.euiSizeL};
+    margin-bottom: 0;
+  }
+  .hostPageContent {
+    border: none;
+  }
+`;
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/url_from_query_params.ts b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/url_from_query_params.ts
similarity index 78%
rename from x-pack/plugins/endpoint/public/applications/endpoint/view/managing/url_from_query_params.ts
rename to x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/url_from_query_params.ts
index ea6a4c6f684ad..225aad8cab020 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/managing/url_from_query_params.ts
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/hosts/url_from_query_params.ts
@@ -5,10 +5,10 @@
  */
 
 import querystring from 'querystring';
-import { EndpointAppLocation, ManagingIndexUIQueryParams } from '../../types';
+import { EndpointAppLocation, HostIndexUIQueryParams } from '../../types';
 
 export function urlFromQueryParams(
-  queryParams: ManagingIndexUIQueryParams
+  queryParams: HostIndexUIQueryParams
 ): Partial<EndpointAppLocation> {
   const search = querystring.stringify(queryParams);
   return {
diff --git a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_list.tsx b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_list.tsx
index cf573da3703cc..f949efa46a2bd 100644
--- a/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_list.tsx
+++ b/x-pack/plugins/endpoint/public/applications/endpoint/view/policy/policy_list.tsx
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React, { useCallback, useMemo } from 'react';
+import React, { SyntheticEvent, useCallback, useEffect, useMemo } from 'react';
 import {
   EuiPage,
   EuiPageBody,
@@ -16,22 +16,15 @@ import {
   EuiBasicTable,
   EuiText,
   EuiTableFieldDataColumnType,
-  EuiToolTip,
   EuiLink,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import {
-  FormattedMessage,
-  FormattedDate,
-  FormattedTime,
-  FormattedNumber,
-  FormattedRelative,
-} from '@kbn/i18n/react';
+import { FormattedMessage } from '@kbn/i18n/react';
 import { useDispatch } from 'react-redux';
-import styled from 'styled-components';
 import { useHistory } from 'react-router-dom';
 import { usePageId } from '../use_page_id';
 import {
+  selectApiError,
   selectIsLoading,
   selectPageIndex,
   selectPageSize,
@@ -41,37 +34,12 @@ import {
 import { usePolicyListSelector } from './policy_hooks';
 import { PolicyListAction } from '../../store/policy_list';
 import { PolicyData } from '../../types';
-import { TruncateText } from '../../components/truncate_text';
+import { useKibana } from '../../../../../../../../src/plugins/kibana_react/public';
 
 interface TableChangeCallbackArguments {
   page: { index: number; size: number };
 }
 
-const TruncateTooltipText = styled(TruncateText)`
-  .euiToolTipAnchor {
-    display: block;
-    overflow: hidden;
-    white-space: nowrap;
-    text-overflow: ellipsis;
-  }
-`;
-
-const FormattedDateAndTime: React.FC<{ date: Date }> = ({ date }) => {
-  // If date is greater than or equal to 24h (ago), then show it as a date
-  // else, show it as relative to "now"
-  return Date.now() - date.getTime() >= 8.64e7 ? (
-    <>
-      <FormattedDate value={date} year="numeric" month="short" day="2-digit" />
-      {' @'}
-      <FormattedTime value={date} />
-    </>
-  ) : (
-    <>
-      <FormattedRelative value={date} />
-    </>
-  );
-};
-
 const PolicyLink: React.FC<{ name: string; route: string }> = ({ name, route }) => {
   const history = useHistory();
 
@@ -91,29 +59,28 @@ const renderPolicyNameLink = (value: string, _item: PolicyData) => {
   return <PolicyLink name={value} route={`/policy/${_item.id}`} />;
 };
 
-const renderDate = (date: string, _item: PolicyData) => (
-  <TruncateTooltipText>
-    <EuiToolTip content={date}>
-      <FormattedDateAndTime date={new Date(date)} />
-    </EuiToolTip>
-  </TruncateTooltipText>
-);
-
-const renderFormattedNumber = (value: number, _item: PolicyData) => (
-  <TruncateText>
-    <FormattedNumber value={value} />
-  </TruncateText>
-);
-
 export const PolicyList = React.memo(() => {
   usePageId('policyListPage');
 
+  const { services, notifications } = useKibana();
+
   const dispatch = useDispatch<(action: PolicyListAction) => void>();
   const policyItems = usePolicyListSelector(selectPolicyItems);
   const pageIndex = usePolicyListSelector(selectPageIndex);
   const pageSize = usePolicyListSelector(selectPageSize);
   const totalItemCount = usePolicyListSelector(selectTotal);
   const loading = usePolicyListSelector(selectIsLoading);
+  const apiError = usePolicyListSelector(selectApiError);
+
+  useEffect(() => {
+    if (apiError) {
+      notifications.toasts.danger({
+        title: apiError.error,
+        body: apiError.message,
+        toastLifeTimeMs: 10000,
+      });
+    }
+  }, [apiError, dispatch, notifications.toasts]);
 
   const paginationSetup = useMemo(() => {
     return {
@@ -149,67 +116,52 @@ export const PolicyList = React.memo(() => {
         truncateText: true,
       },
       {
-        field: 'total',
-        name: i18n.translate('xpack.endpoint.policyList.totalField', {
-          defaultMessage: 'Total',
+        field: 'revision',
+        name: i18n.translate('xpack.endpoint.policyList.revisionField', {
+          defaultMessage: 'Revision',
         }),
-        render: renderFormattedNumber,
         dataType: 'number',
-        truncateText: true,
-        width: '15ch',
       },
       {
-        field: 'pending',
-        name: i18n.translate('xpack.endpoint.policyList.pendingField', {
-          defaultMessage: 'Pending',
+        field: 'package',
+        name: i18n.translate('xpack.endpoint.policyList.versionField', {
+          defaultMessage: 'Version',
         }),
-        render: renderFormattedNumber,
-        dataType: 'number',
-        truncateText: true,
-        width: '15ch',
-      },
-      {
-        field: 'failed',
-        name: i18n.translate('xpack.endpoint.policyList.failedField', {
-          defaultMessage: 'Failed',
-        }),
-        render: renderFormattedNumber,
-        dataType: 'number',
-        truncateText: true,
-        width: '15ch',
-      },
-      {
-        field: 'created_by',
-        name: i18n.translate('xpack.endpoint.policyList.createdByField', {
-          defaultMessage: 'Created By',
-        }),
-        truncateText: true,
-      },
-      {
-        field: 'created',
-        name: i18n.translate('xpack.endpoint.policyList.createdField', {
-          defaultMessage: 'Created',
-        }),
-        render: renderDate,
-        truncateText: true,
+        render(pkg) {
+          return `${pkg.title}  v${pkg.version}`;
+        },
       },
       {
-        field: 'updated_by',
-        name: i18n.translate('xpack.endpoint.policyList.updatedByField', {
-          defaultMessage: 'Last Updated By',
+        field: 'description',
+        name: i18n.translate('xpack.endpoint.policyList.descriptionField', {
+          defaultMessage: 'Description',
         }),
         truncateText: true,
       },
       {
-        field: 'updated',
-        name: i18n.translate('xpack.endpoint.policyList.updatedField', {
-          defaultMessage: 'Last Updated',
+        field: 'config_id',
+        name: i18n.translate('xpack.endpoint.policyList.agentConfigField', {
+          defaultMessage: 'Agent Configuration',
         }),
-        render: renderDate,
-        truncateText: true,
+        render(version: string) {
+          return (
+            // eslint-disable-next-line @elastic/eui/href-or-on-click
+            <EuiLink
+              href={`${services.application.getUrlForApp('ingestManager')}#/configs/${version}`}
+              onClick={(ev: SyntheticEvent) => {
+                ev.preventDefault();
+                services.application.navigateToApp('ingestManager', {
+                  path: `#/configs/${version}`,
+                });
+              }}
+            >
+              {version}
+            </EuiLink>
+          );
+        },
       },
     ],
-    []
+    [services.application]
   );
 
   return (
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/models/indexed_process_tree.ts b/x-pack/plugins/endpoint/public/embeddables/resolver/models/indexed_process_tree.ts
index c9a03f0a47968..967a2c10f14c3 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/models/indexed_process_tree.ts
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/models/indexed_process_tree.ts
@@ -5,7 +5,7 @@
  */
 
 import { uniquePidForProcess, uniqueParentPidForProcess } from './process_event';
-import { IndexedProcessTree } from '../types';
+import { IndexedProcessTree, AdjacentProcessMap } from '../types';
 import { ResolverEvent } from '../../../../common/types';
 import { levelOrder as baseLevelOrder } from '../lib/tree_sequencers';
 
@@ -15,21 +15,89 @@ import { levelOrder as baseLevelOrder } from '../lib/tree_sequencers';
 export function factory(processes: ResolverEvent[]): IndexedProcessTree {
   const idToChildren = new Map<string | undefined, ResolverEvent[]>();
   const idToValue = new Map<string, ResolverEvent>();
+  const idToAdjacent = new Map<string, AdjacentProcessMap>();
+
+  function emptyAdjacencyMap(id: string): AdjacentProcessMap {
+    return {
+      self: id,
+      parent: null,
+      firstChild: null,
+      previousSibling: null,
+      nextSibling: null,
+      level: 1,
+    };
+  }
+
+  const roots: ResolverEvent[] = [];
 
   for (const process of processes) {
-    idToValue.set(uniquePidForProcess(process), process);
+    const uniqueProcessPid = uniquePidForProcess(process);
+    idToValue.set(uniqueProcessPid, process);
+
+    const currentProcessAdjacencyMap: AdjacentProcessMap =
+      idToAdjacent.get(uniqueProcessPid) || emptyAdjacencyMap(uniqueProcessPid);
+    idToAdjacent.set(uniqueProcessPid, currentProcessAdjacencyMap);
+
     const uniqueParentPid = uniqueParentPidForProcess(process);
-    const processChildren = idToChildren.get(uniqueParentPid);
-    if (processChildren) {
-      processChildren.push(process);
+    const currentProcessSiblings = idToChildren.get(uniqueParentPid);
+
+    if (currentProcessSiblings) {
+      const previousProcessId = uniquePidForProcess(
+        currentProcessSiblings[currentProcessSiblings.length - 1]
+      );
+      currentProcessSiblings.push(process);
+      /**
+       * Update adjacency maps for current and previous entries
+       */
+      idToAdjacent.get(previousProcessId)!.nextSibling = uniqueProcessPid;
+      currentProcessAdjacencyMap.previousSibling = previousProcessId;
+      if (uniqueParentPid) {
+        currentProcessAdjacencyMap.parent = uniqueParentPid;
+      }
     } else {
       idToChildren.set(uniqueParentPid, [process]);
+
+      if (uniqueParentPid) {
+        /**
+         * Get the parent's map, otherwise set an empty one
+         */
+        const parentAdjacencyMap =
+          idToAdjacent.get(uniqueParentPid) ||
+          (idToAdjacent.set(uniqueParentPid, emptyAdjacencyMap(uniqueParentPid)),
+          idToAdjacent.get(uniqueParentPid))!;
+        // set firstChild for parent
+        parentAdjacencyMap.firstChild = uniqueProcessPid;
+        // set parent for current
+        currentProcessAdjacencyMap.parent = uniqueParentPid || null;
+      } else {
+        // In this case (no unique parent id), it must be a root
+        roots.push(process);
+      }
     }
   }
 
+  /**
+   * Scan adjacency maps from the top down and assign levels
+   */
+  function traverseLevels(currentProcessMap: AdjacentProcessMap, level: number = 1): void {
+    const nextLevel = level + 1;
+    if (currentProcessMap.nextSibling) {
+      traverseLevels(idToAdjacent.get(currentProcessMap.nextSibling)!, level);
+    }
+    if (currentProcessMap.firstChild) {
+      traverseLevels(idToAdjacent.get(currentProcessMap.firstChild)!, nextLevel);
+    }
+    currentProcessMap.level = level;
+  }
+
+  for (const treeRoot of roots) {
+    traverseLevels(idToAdjacent.get(uniquePidForProcess(treeRoot))!);
+  }
+
   return {
     idToChildren,
     idToProcess: idToValue,
+    idToAdjacent,
   };
 }
 
@@ -38,8 +106,8 @@ export function factory(processes: ResolverEvent[]): IndexedProcessTree {
  */
 export function children(tree: IndexedProcessTree, process: ResolverEvent): ResolverEvent[] {
   const id = uniquePidForProcess(process);
-  const processChildren = tree.idToChildren.get(id);
-  return processChildren === undefined ? [] : processChildren;
+  const currentProcessSiblings = tree.idToChildren.get(id);
+  return currentProcessSiblings === undefined ? [] : currentProcessSiblings;
 }
 
 /**
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/store/actions.ts b/x-pack/plugins/endpoint/public/embeddables/resolver/store/actions.ts
index fec2078cc60c9..ceb5da2ca9098 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/store/actions.ts
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/store/actions.ts
@@ -43,10 +43,23 @@ interface UserChangedSelectedEvent {
 interface AppRequestedResolverData {
   readonly type: 'appRequestedResolverData';
 }
+/**
+ * When the user switches the active descendent of the Resolver.
+ */
+interface UserFocusedOnResolverNode {
+  readonly type: 'userFocusedOnResolverNode';
+  readonly payload: {
+    /**
+     * Used to identify the process node that should be brought into view.
+     */
+    readonly nodeId: string;
+  };
+}
 
 export type ResolverAction =
   | CameraAction
   | DataAction
   | UserBroughtProcessIntoView
   | UserChangedSelectedEvent
-  | AppRequestedResolverData;
+  | AppRequestedResolverData
+  | UserFocusedOnResolverNode;
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/store/data/__snapshots__/graphing.test.ts.snap b/x-pack/plugins/endpoint/public/embeddables/resolver/store/data/__snapshots__/graphing.test.ts.snap
index b88652097eb5c..00abc27b25a83 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/store/data/__snapshots__/graphing.test.ts.snap
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/store/data/__snapshots__/graphing.test.ts.snap
@@ -41,128 +41,128 @@ Object {
         -0.8164965809277259,
       ],
       Array [
-        35.35533905932738,
-        -21.228911104120876,
+        70.71067811865476,
+        -41.641325627314025,
       ],
     ],
     Array [
       Array [
-        -35.35533905932738,
-        -62.053740150507174,
+        -70.71067811865476,
+        -123.29098372008661,
       ],
       Array [
-        106.06601717798213,
-        19.595917942265423,
+        212.13203435596427,
+        40.00833246545857,
       ],
     ],
     Array [
       Array [
-        -35.35533905932738,
-        -62.053740150507174,
+        -70.71067811865476,
+        -123.29098372008661,
       ],
       Array [
         0,
-        -82.46615467370032,
+        -164.1158127664729,
       ],
     ],
     Array [
       Array [
-        106.06601717798213,
-        19.595917942265423,
+        212.13203435596427,
+        40.00833246545857,
       ],
       Array [
-        141.4213562373095,
+        282.842712474619,
         -0.8164965809277259,
       ],
     ],
     Array [
       Array [
         0,
-        -82.46615467370032,
+        -164.1158127664729,
       ],
       Array [
-        35.35533905932738,
-        -102.87856919689347,
+        70.71067811865476,
+        -204.9406418128592,
       ],
     ],
     Array [
       Array [
         0,
-        -123.2909837200866,
+        -245.76547085924548,
       ],
       Array [
-        70.71067811865476,
-        -82.46615467370032,
+        141.4213562373095,
+        -164.1158127664729,
       ],
     ],
     Array [
       Array [
         0,
-        -123.2909837200866,
+        -245.76547085924548,
       ],
       Array [
-        35.35533905932738,
-        -143.70339824327976,
+        70.71067811865476,
+        -286.5902999056318,
       ],
     ],
     Array [
       Array [
-        70.71067811865476,
-        -82.46615467370032,
+        141.4213562373095,
+        -164.1158127664729,
       ],
       Array [
-        106.06601717798213,
-        -102.87856919689347,
+        212.13203435596427,
+        -204.9406418128592,
       ],
     ],
     Array [
       Array [
-        141.4213562373095,
+        282.842712474619,
         -0.8164965809277259,
       ],
       Array [
-        176.7766952966369,
-        -21.22891110412087,
+        353.5533905932738,
+        -41.64132562731401,
       ],
     ],
     Array [
       Array [
-        141.4213562373095,
-        -41.64132562731402,
+        282.842712474619,
+        -82.4661546737003,
       ],
       Array [
-        212.13203435596427,
+        424.26406871192853,
         -0.8164965809277259,
       ],
     ],
     Array [
       Array [
-        141.4213562373095,
-        -41.64132562731402,
+        282.842712474619,
+        -82.4661546737003,
       ],
       Array [
-        176.7766952966369,
-        -62.053740150507174,
+        353.5533905932738,
+        -123.29098372008661,
       ],
     ],
     Array [
       Array [
-        212.13203435596427,
+        424.26406871192853,
         -0.8164965809277259,
       ],
       Array [
-        247.48737341529164,
-        -21.228911104120883,
+        494.9747468305833,
+        -41.64132562731404,
       ],
     ],
     Array [
       Array [
-        247.48737341529164,
-        -21.228911104120883,
+        494.9747468305833,
+        -41.64132562731404,
       ],
       Array [
-        318.1980515339464,
-        -62.05374015050717,
+        636.3961030678928,
+        -123.2909837200866,
       ],
     ],
   ],
@@ -199,7 +199,7 @@ Object {
       },
     } => Array [
       0,
-      -82.46615467370032,
+      -164.1158127664729,
     ],
     Object {
       "@timestamp": 1582233383000,
@@ -215,7 +215,7 @@ Object {
         "unique_ppid": 0,
       },
     } => Array [
-      141.4213562373095,
+      282.842712474619,
       -0.8164965809277259,
     ],
     Object {
@@ -232,8 +232,8 @@ Object {
         "unique_ppid": 1,
       },
     } => Array [
-      35.35533905932738,
-      -143.70339824327976,
+      70.71067811865476,
+      -286.5902999056318,
     ],
     Object {
       "@timestamp": 1582233383000,
@@ -249,8 +249,8 @@ Object {
         "unique_ppid": 1,
       },
     } => Array [
-      106.06601717798213,
-      -102.87856919689347,
+      212.13203435596427,
+      -204.9406418128592,
     ],
     Object {
       "@timestamp": 1582233383000,
@@ -266,8 +266,8 @@ Object {
         "unique_ppid": 2,
       },
     } => Array [
-      176.7766952966369,
-      -62.053740150507174,
+      353.5533905932738,
+      -123.29098372008661,
     ],
     Object {
       "@timestamp": 1582233383000,
@@ -283,8 +283,8 @@ Object {
         "unique_ppid": 2,
       },
     } => Array [
-      247.48737341529164,
-      -21.228911104120883,
+      494.9747468305833,
+      -41.64132562731404,
     ],
     Object {
       "@timestamp": 1582233383000,
@@ -300,8 +300,8 @@ Object {
         "unique_ppid": 6,
       },
     } => Array [
-      318.1980515339464,
-      -62.05374015050717,
+      636.3961030678928,
+      -123.2909837200866,
     ],
   },
 }
@@ -316,8 +316,8 @@ Object {
         -0.8164965809277259,
       ],
       Array [
-        70.71067811865476,
-        -41.641325627314025,
+        141.4213562373095,
+        -82.46615467370032,
       ],
     ],
   ],
@@ -353,8 +353,8 @@ Object {
         "unique_ppid": 0,
       },
     } => Array [
-      70.71067811865476,
-      -41.641325627314025,
+      141.4213562373095,
+      -82.46615467370032,
     ],
   },
 }
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/store/data/selectors.ts b/x-pack/plugins/endpoint/public/embeddables/resolver/store/data/selectors.ts
index e8007f82e30c2..5dda54d4ed029 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/store/data/selectors.ts
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/store/data/selectors.ts
@@ -13,11 +13,12 @@ import {
   EdgeLineSegment,
   ProcessWithWidthMetadata,
   Matrix3,
+  AdjacentProcessMap,
 } from '../../types';
 import { ResolverEvent } from '../../../../../common/types';
 import { Vector2 } from '../../types';
 import { add as vector2Add, applyMatrix3 } from '../../lib/vector2';
-import { isGraphableProcess } from '../../models/process_event';
+import { isGraphableProcess, uniquePidForProcess } from '../../models/process_event';
 import {
   factory as indexedProcessTreeFactory,
   children as indexedProcessTreeChildren,
@@ -27,7 +28,7 @@ import {
 } from '../../models/indexed_process_tree';
 
 const unit = 100;
-const distanceBetweenNodesInUnits = 1;
+const distanceBetweenNodesInUnits = 2;
 
 export function isLoading(state: DataState) {
   return state.isLoading;
@@ -392,17 +393,42 @@ function processPositions(
   return positions;
 }
 
-export const processNodePositionsAndEdgeLineSegments = createSelector(
+export const indexedProcessTree = createSelector(graphableProcesses, function indexedTree(
+  /* eslint-disable no-shadow */
+  graphableProcesses
+  /* eslint-enable no-shadow */
+) {
+  return indexedProcessTreeFactory(graphableProcesses);
+});
+
+export const processAdjacencies = createSelector(
+  indexedProcessTree,
   graphableProcesses,
-  function processNodePositionsAndEdgeLineSegments(
+  function selectProcessAdjacencies(
     /* eslint-disable no-shadow */
+    indexedProcessTree,
     graphableProcesses
     /* eslint-enable no-shadow */
   ) {
-    /**
-     * Index the tree, creating maps from id -> node and id -> children
-     */
-    const indexedProcessTree = indexedProcessTreeFactory(graphableProcesses);
+    const processToAdjacencyMap = new Map<ResolverEvent, AdjacentProcessMap>();
+    const { idToAdjacent } = indexedProcessTree;
+
+    for (const graphableProcess of graphableProcesses) {
+      const processPid = uniquePidForProcess(graphableProcess);
+      const adjacencyMap = idToAdjacent.get(processPid)!;
+      processToAdjacencyMap.set(graphableProcess, adjacencyMap);
+    }
+    return { processToAdjacencyMap };
+  }
+);
+
+export const processNodePositionsAndEdgeLineSegments = createSelector(
+  indexedProcessTree,
+  function processNodePositionsAndEdgeLineSegments(
+    /* eslint-disable no-shadow */
+    indexedProcessTree
+    /* eslint-enable no-shadow */
+  ) {
     /**
      * Walk the tree in reverse level order, calculating the 'width' of subtrees.
      */
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/store/middleware.ts b/x-pack/plugins/endpoint/public/embeddables/resolver/store/middleware.ts
index 23e4a4fe7d7ed..4e57212e5c0c2 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/store/middleware.ts
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/store/middleware.ts
@@ -16,6 +16,19 @@ type MiddlewareFactory<S = ResolverState> = (
 ) => (
   api: MiddlewareAPI<Dispatch<ResolverAction>, S>
 ) => (next: Dispatch<ResolverAction>) => (action: ResolverAction) => unknown;
+interface Lifecycle {
+  lifecycle: ResolverEvent[];
+}
+type ChildResponse = [Lifecycle];
+
+function flattenEvents(events: ChildResponse): ResolverEvent[] {
+  return events
+    .map((child: Lifecycle) => child.lifecycle)
+    .reduce(
+      (accumulator: ResolverEvent[], value: ResolverEvent[]) => accumulator.concat(value),
+      []
+    );
+}
 
 export const resolverMiddlewareFactory: MiddlewareFactory = context => {
   return api => next => async (action: ResolverAction) => {
@@ -47,7 +60,7 @@ export const resolverMiddlewareFactory: MiddlewareFactory = context => {
               query: { legacyEndpointID },
             }),
           ]);
-          childEvents = children.length > 0 ? children.map((child: any) => child.lifecycle) : [];
+          childEvents = children.length > 0 ? flattenEvents(children) : [];
         } else {
           const uniquePid = action.payload.selectedEvent.process.entity_id;
           const ppid = action.payload.selectedEvent.process.parent?.entity_id;
@@ -67,7 +80,7 @@ export const resolverMiddlewareFactory: MiddlewareFactory = context => {
             getAncestors(ppid),
           ]);
         }
-        childEvents = children.length > 0 ? children.map((child: any) => child.lifecycle) : [];
+        childEvents = children.length > 0 ? flattenEvents(children) : [];
         response = [...lifecycle, ...childEvents, ...relatedEvents, ...ancestors];
         api.dispatch({
           type: 'serverReturnedResolverData',
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/store/reducer.ts b/x-pack/plugins/endpoint/public/embeddables/resolver/store/reducer.ts
index 20c490b8998f9..1c66a998a4c22 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/store/reducer.ts
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/store/reducer.ts
@@ -7,11 +7,25 @@ import { Reducer, combineReducers } from 'redux';
 import { animateProcessIntoView } from './methods';
 import { cameraReducer } from './camera/reducer';
 import { dataReducer } from './data/reducer';
-import { ResolverState, ResolverAction } from '../types';
+import { ResolverState, ResolverAction, ResolverUIState } from '../types';
+
+const uiReducer: Reducer<ResolverUIState, ResolverAction> = (
+  uiState = { activeDescendentId: null },
+  action
+) => {
+  if (action.type === 'userFocusedOnResolverNode') {
+    return {
+      activeDescendentId: action.payload.nodeId,
+    };
+  } else {
+    return uiState;
+  }
+};
 
 const concernReducers = combineReducers({
   camera: cameraReducer,
   data: dataReducer,
+  ui: uiReducer,
 });
 
 export const resolverReducer: Reducer<ResolverState, ResolverAction> = (state, action) => {
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/store/selectors.ts b/x-pack/plugins/endpoint/public/embeddables/resolver/store/selectors.ts
index 708eb684ebd3e..37482916496e7 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/store/selectors.ts
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/store/selectors.ts
@@ -54,6 +54,11 @@ export const processNodePositionsAndEdgeLineSegments = composeSelectors(
   dataSelectors.processNodePositionsAndEdgeLineSegments
 );
 
+export const processAdjacencies = composeSelectors(
+  dataStateSelector,
+  dataSelectors.processAdjacencies
+);
+
 /**
  * Returns the camera state from within ResolverState
  */
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/types.ts b/x-pack/plugins/endpoint/public/embeddables/resolver/types.ts
index 4380d3ab98999..674553aba0937 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/types.ts
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/types.ts
@@ -23,6 +23,21 @@ export interface ResolverState {
    * Contains the state associated with event data (process events and possibly other event types).
    */
   readonly data: DataState;
+
+  /**
+   * Contains the state needed to maintain Resolver UI elements.
+   */
+  readonly ui: ResolverUIState;
+}
+
+/**
+ * Piece of redux state that models an animation for the camera.
+ */
+export interface ResolverUIState {
+  /**
+   * The ID attribute of the resolver's aria-activedescendent.
+   */
+  readonly activeDescendentId: string | null;
 }
 
 /**
@@ -174,9 +189,26 @@ export interface ProcessEvent {
     source_id?: number;
     process_name: string;
     process_path: string;
+    signature_status?: string;
   };
 }
 
+/**
+ * A map of Process Ids that indicate which processes are adjacent to a given process along
+ * directions in two axes: up/down and previous/next.
+ */
+export interface AdjacentProcessMap {
+  readonly self: string;
+  parent: string | null;
+  firstChild: string | null;
+  previousSibling: string | null;
+  nextSibling: string | null;
+  /**
+   * To support aria-level, this must be >= 1
+   */
+  level: number;
+}
+
 /**
  * A represention of a process tree with indices for O(1) access to children and values by id.
  */
@@ -189,6 +221,10 @@ export interface IndexedProcessTree {
    * Map of ID to process
    */
   idToProcess: Map<string, ResolverEvent>;
+  /**
+   * Map of ID to adjacent processes
+   */
+  idToAdjacent: Map<string, AdjacentProcessMap>;
 }
 
 /**
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/view/defs.tsx b/x-pack/plugins/endpoint/public/embeddables/resolver/view/defs.tsx
new file mode 100644
index 0000000000000..799f67123ba26
--- /dev/null
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/view/defs.tsx
@@ -0,0 +1,381 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { saturate, lighten } from 'polished';
+
+import {
+  htmlIdGenerator,
+  euiPaletteForTemperature,
+  euiPaletteForStatus,
+  colorPalette,
+} from '@elastic/eui';
+
+/**
+ * Generating from `colorPalette` function: This could potentially
+ * pick up a palette shift and decouple from raw hex
+ */
+const [euiColorEmptyShade, , , , , euiColor85Shade, euiColorFullShade] = colorPalette(
+  ['#ffffff', '#000000'],
+  7
+);
+
+/**
+ * Base Colors - sourced from EUI
+ */
+const resolverPalette: Record<string, string | string[]> = {
+  temperatures: euiPaletteForTemperature(7),
+  statii: euiPaletteForStatus(7),
+  fullShade: euiColorFullShade,
+  emptyShade: euiColorEmptyShade,
+};
+
+/**
+ * Defines colors by semantics like so:
+ * `danger`, `attention`, `enabled`, `disabled`
+ * Or by function like:
+ * `colorBlindBackground`, `subMenuForeground`
+ */
+type ResolverColorNames =
+  | 'ok'
+  | 'empty'
+  | 'full'
+  | 'warning'
+  | 'strokeBehindEmpty'
+  | 'resolverBackground'
+  | 'runningProcessStart'
+  | 'runningProcessEnd'
+  | 'runningTriggerStart'
+  | 'runningTriggerEnd'
+  | 'activeNoWarning'
+  | 'activeWarning'
+  | 'fullLabelBackground'
+  | 'inertDescription';
+
+export const NamedColors: Record<ResolverColorNames, string> = {
+  ok: saturate(0.5, resolverPalette.temperatures[0]),
+  empty: euiColorEmptyShade,
+  full: euiColorFullShade,
+  strokeBehindEmpty: euiColor85Shade,
+  warning: resolverPalette.statii[3],
+  resolverBackground: euiColorFullShade,
+  runningProcessStart: '#006BB4',
+  runningProcessEnd: '#017D73',
+  runningTriggerStart: '#BD281E',
+  runningTriggerEnd: '#DD0A73',
+  activeNoWarning: '#0078FF',
+  activeWarning: '#C61F38',
+  fullLabelBackground: '#3B3C41',
+  inertDescription: '#747474',
+};
+
+const idGenerator = htmlIdGenerator();
+
+/**
+ * Ids of paint servers to be referenced by fill and stroke attributes
+ */
+export const PaintServerIds = {
+  runningProcess: idGenerator('psRunningProcess'),
+  runningTrigger: idGenerator('psRunningTrigger'),
+  runningProcessCube: idGenerator('psRunningProcessCube'),
+  runningTriggerCube: idGenerator('psRunningTriggerCube'),
+  terminatedProcessCube: idGenerator('psTerminatedProcessCube'),
+  terminatedTriggerCube: idGenerator('psTerminatedTriggerCube'),
+};
+
+/**
+ * PaintServers: Where color palettes, grandients, patterns and other similar concerns
+ * are exposed to the component
+ */
+const PaintServers = memo(() => (
+  <>
+    <linearGradient
+      id={PaintServerIds.runningProcess}
+      x1="0"
+      y1="0"
+      x2="1"
+      y2="0"
+      spreadMethod="reflect"
+      gradientUnits="objectBoundingBox"
+    >
+      <stop
+        offset="0%"
+        stopColor={saturate(0.7, lighten(0.05, NamedColors.runningProcessStart))}
+        stopOpacity="1"
+      />
+      <stop
+        offset="100%"
+        stopColor={saturate(0.7, lighten(0.05, NamedColors.runningProcessEnd))}
+        stopOpacity="1"
+      />
+    </linearGradient>
+    <linearGradient
+      id={PaintServerIds.runningTrigger}
+      x1="0"
+      y1="0"
+      x2="1"
+      y2="0"
+      spreadMethod="reflect"
+      gradientUnits="objectBoundingBox"
+    >
+      <stop
+        offset="0%"
+        stopColor={saturate(0.7, lighten(0.05, NamedColors.runningTriggerStart))}
+        stopOpacity="1"
+      />
+      <stop
+        offset="100%"
+        stopColor={saturate(0.7, lighten(0.05, NamedColors.runningTriggerEnd))}
+        stopOpacity="1"
+      />
+    </linearGradient>
+    <linearGradient
+      id={PaintServerIds.runningProcessCube}
+      x1="-382.33074"
+      y1="265.24689"
+      x2="-381.88086"
+      y2="264.46019"
+      gradientTransform="matrix(88, 0, 0, -100, 33669, 26535)"
+      gradientUnits="userSpaceOnUse"
+    >
+      <stop offset="0" stopColor={NamedColors.runningProcessStart} />
+      <stop offset="1" stopColor={NamedColors.runningProcessEnd} />
+    </linearGradient>
+    <linearGradient
+      id={PaintServerIds.runningTriggerCube}
+      x1="-382.32713"
+      y1="265.24057"
+      x2="-381.88108"
+      y2="264.46057"
+      gradientTransform="matrix(88, 0, 0, -100, 33669, 26535)"
+      gradientUnits="userSpaceOnUse"
+    >
+      <stop offset="0" stopColor="#bd281f" />
+      <stop offset="1" stopColor="#dc0b72" />
+    </linearGradient>
+    <linearGradient
+      id={PaintServerIds.terminatedProcessCube}
+      x1="-382.33074"
+      y1="265.24689"
+      x2="-381.88086"
+      y2="264.46019"
+      gradientTransform="matrix(88, 0, 0, -100, 33669, 26535)"
+      gradientUnits="userSpaceOnUse"
+    >
+      <stop offset="0" stopColor="#006bb4" />
+      <stop offset="1" stopColor="#017d73" />
+    </linearGradient>
+    <linearGradient
+      id={PaintServerIds.terminatedTriggerCube}
+      x1="-382.33074"
+      y1="265.24689"
+      x2="-381.88086"
+      y2="264.46019"
+      gradientTransform="matrix(88, 0, 0, -100, 33669, 26535)"
+      gradientUnits="userSpaceOnUse"
+    >
+      <stop offset="0" stopColor="#be2820" />
+      <stop offset="1" stopColor="#dc0b72" />
+    </linearGradient>
+  </>
+));
+
+/**
+ * Ids of symbols to be linked by <use> elements
+ */
+export const SymbolIds = {
+  processNode: idGenerator('nodeSymbol'),
+  solidHexagon: idGenerator('hexagon'),
+  runningProcessCube: idGenerator('runningCube'),
+  runningTriggerCube: idGenerator('runningTriggerCube'),
+  terminatedProcessCube: idGenerator('terminatedCube'),
+  terminatedTriggerCube: idGenerator('terminatedTriggerCube'),
+};
+
+/**
+ * Defs entries that define shapes, masks and other spatial elements
+ */
+const SymbolsAndShapes = memo(() => (
+  <>
+    <symbol id={SymbolIds.processNode} viewBox="0 0 144 25" preserveAspectRatio="xMidYMid meet">
+      <rect
+        x="1"
+        y="1"
+        width="142"
+        height="23"
+        fill="inherit"
+        strokeWidth="0"
+        paintOrder="normal"
+      />
+    </symbol>
+    <symbol id={SymbolIds.solidHexagon} viewBox="0 0 200 200" preserveAspectRatio="xMidYMid meet">
+      <g transform="translate(0,-97)">
+        <path
+          transform="matrix(1.6461 0 0 1.6596 -56.401 -64.183)"
+          d="m95.148 97.617 28.238 16.221 23.609 13.713 0.071 32.566-0.071 27.302-28.167 16.344-23.68 13.59-28.238-16.221-23.609-13.713-0.07098-32.566 0.07098-27.302 28.167-16.344z"
+          fill="inherit"
+          strokeWidth="15"
+          stroke="inherit"
+        />
+      </g>
+    </symbol>
+    <symbol id={SymbolIds.runningProcessCube} viewBox="0 0 88 100">
+      <title>Running Process</title>
+      <g>
+        <polygon
+          points="0 25.839 44.23 0 88 25.839 88 74.688 44.23 100 0 74.688 0 25.839"
+          fill="#1d1e24"
+        />
+        <polygon
+          points="44.23 100 44 50 0 25.839 0 74.664 44.23 100"
+          opacity="0.25179"
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          points="27 41.077 44.089 31 61 41.077 61 60.128 44.089 70 27 60.128 27 41.077"
+          fill="#fff"
+        />
+        <polygon points="44 31 61 41.077 61 60.128 44 50 44 31" fill="#d8d8d8" />
+        <polygon points="27 60.128 27 41.077 44 31 44 50 27 60.128" fill="#959595" />
+        <polygon
+          points="0 25.839 44.23 0 88 25.839 88 74.688 44.23 100 0 74.688 0 25.839"
+          opacity="0.74744"
+          fill={`url(#${PaintServerIds.runningProcessCube})`}
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          points="88 25.839 44.23 0 0 25.839 44 50 88 25.839"
+          fill="#fff"
+          opacity="0.13893"
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          points="44.23 100 44 50 0 25.839 0 74.664 44.23 100"
+          opacity="0.25179"
+          style={{ isolation: 'isolate' }}
+        />
+      </g>
+    </symbol>
+    <symbol id={SymbolIds.runningTriggerCube} viewBox="0 0 88 100">
+      <title>Running Trigger Process</title>
+      <g>
+        <polygon
+          points="0 25.839 44.23 0 88 25.839 88 74.688 44.23 100 0 74.688 0 25.839"
+          fill="#1d1e24"
+        />
+        <polygon
+          points="44.23 100 44 50 0 25.839 0 74.664 44.23 100"
+          opacity="0.25179"
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          points="27 41.077 44.089 31 61 41.077 61 60.128 44.089 70 27 60.128 27 41.077"
+          fill="#fff"
+        />
+        <polygon points="44 31 61 41.077 61 60.128 44 50 44 31" fill="#d8d8d8" />
+        <polygon points="27 60.128 27 41.077 44 31 44 50 27 60.128" fill="#959595" />
+        <polygon
+          points="0 25.839 44.23 0 88 25.839 88 74.688 44.23 100 0 74.688 0 25.839"
+          opacity="0.75"
+          fill={`url(#${PaintServerIds.runningTriggerCube})`}
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          points="88 25.839 44.23 0 0 25.839 44 50 88 25.839"
+          fill="#fff"
+          opacity="0.13893"
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          points="44.23 100 44 50 0 25.839 0 74.664 44.23 100"
+          opacity="0.25179"
+          style={{ isolation: 'isolate' }}
+        />
+      </g>
+    </symbol>
+    <symbol viewBox="0 0 88 100" id={SymbolIds.terminatedProcessCube}>
+      <title>Terminated Process</title>
+      <g>
+        <polygon
+          points="0 25.839 44.23 0 88 25.839 88 74.688 44.23 100 0 74.688 0 25.839"
+          fill="#1d1e24"
+        />
+        <polygon
+          points="44.23 100 44 50 0 25.839 0 74.664 44.23 100"
+          opacity="0.25179"
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          id="Path-4-Copy-15"
+          points="0 25.839 44.23 0 88 25.839 88 74.688 44.23 100 0 74.688 0 25.839"
+          opacity="0.35"
+          fill={`url(#${PaintServerIds.terminatedProcessCube})`}
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          id="Path-Copy-20"
+          points="88 25.839 44.23 0 0 25.839 44 50 88 25.839"
+          fill="#fff"
+          opacity="0.13893"
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          id="Path-Copy-21"
+          points="44.23 100 44 50 0 25.839 0 74.664 44.23 100"
+          opacity="0.25179"
+          style={{ isolation: 'isolate' }}
+        />
+      </g>
+    </symbol>
+    <svg id={SymbolIds.terminatedTriggerCube} viewBox="0 0 88 100">
+      <title>Terminated Trigger Process</title>
+      <g>
+        <polygon
+          points="0 25.839 44.23 0 88 25.839 88 74.688 44.23 100 0 74.688 0 25.839"
+          fill="#1d1e24"
+        />
+        <polygon
+          points="44.23 100 44 50 0 25.839 0 74.664 44.23 100"
+          opacity="0.25179"
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          points="0 25.839 44.23 0 88 25.839 88 74.688 44.23 100 0 74.688 0 25.839"
+          opacity="0.35"
+          fill={`url(#${PaintServerIds.terminatedTriggerCube})`}
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          points="88 25.839 44.23 0 0 25.839 44 50 88 25.839"
+          fill="#fff"
+          opacity="0.13893"
+          style={{ isolation: 'isolate' }}
+        />
+        <polygon
+          points="44.23 100 44 50 0 25.839 0 74.664 44.23 100"
+          opacity="0.25179"
+          style={{ isolation: 'isolate' }}
+        />
+      </g>
+    </svg>
+  </>
+));
+
+/**
+ * This <defs> element is used to define the reusable assets for the Resolver
+ * It confers sevral advantages, including but not limited to:
+ * 1) Freedom of form for creative assets (beyond box-model constraints)
+ * 2) Separation of concerns between creative assets and more functional areas of the app
+ * 3) <use> elements can be handled by compositor (faster)
+ */
+export const SymbolDefinitions = memo(() => (
+  <svg>
+    <defs>
+      <PaintServers />
+      <SymbolsAndShapes />
+    </defs>
+  </svg>
+));
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/view/edge_line.tsx b/x-pack/plugins/endpoint/public/embeddables/resolver/view/edge_line.tsx
index 3386ed4a448d5..fbd40dda9adfd 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/view/edge_line.tsx
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/view/edge_line.tsx
@@ -66,7 +66,7 @@ export const EdgeLine = styled(
          */
         transform: `translateY(-50%) rotateZ(${angle(screenStart, screenEnd)}rad)`,
       };
-      return <div className={className} style={style} />;
+      return <div role="presentation" className={className} style={style} />;
     }
   )
 )`
@@ -74,4 +74,5 @@ export const EdgeLine = styled(
   height: 3px;
   background-color: #d4d4d4;
   color: #333333;
+  contain: strict;
 `;
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/view/index.tsx b/x-pack/plugins/endpoint/public/embeddables/resolver/view/index.tsx
index eab22f993d0a8..22e9d05ad98ff 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/view/index.tsx
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/view/index.tsx
@@ -14,6 +14,7 @@ import { Panel } from './panel';
 import { GraphControls } from './graph_controls';
 import { ProcessEventDot } from './process_event_dot';
 import { useCamera } from './use_camera';
+import { SymbolDefinitions, NamedColors } from './defs';
 import { ResolverAction } from '../types';
 import { ResolverEvent } from '../../../../common/types';
 
@@ -33,6 +34,14 @@ const StyledGraphControls = styled(GraphControls)`
   right: 5px;
 `;
 
+const StyledResolverContainer = styled.div`
+  display: flex;
+  flex-grow: 1;
+  contain: layout;
+`;
+
+const bgColor = NamedColors.resolverBackground;
+
 export const Resolver = styled(
   React.memo(function Resolver({
     className,
@@ -46,6 +55,8 @@ export const Resolver = styled(
     );
 
     const dispatch: (action: ResolverAction) => unknown = useDispatch();
+    const { processToAdjacencyMap } = useSelector(selectors.processAdjacencies);
+
     const { projectionMatrix, ref, onMouseDown } = useCamera();
     const isLoading = useSelector(selectors.isLoading);
 
@@ -62,29 +73,35 @@ export const Resolver = styled(
             <EuiLoadingSpinner size="xl" />
           </div>
         ) : (
-          <>
-            <div className="resolver-graph" onMouseDown={onMouseDown} ref={ref}>
-              {Array.from(processNodePositions).map(([processEvent, position], index) => (
-                <ProcessEventDot
-                  key={index}
-                  position={position}
-                  projectionMatrix={projectionMatrix}
-                  event={processEvent}
-                />
-              ))}
-              {edgeLineSegments.map(([startPosition, endPosition], index) => (
-                <EdgeLine
-                  key={index}
-                  startPosition={startPosition}
-                  endPosition={endPosition}
-                  projectionMatrix={projectionMatrix}
-                />
-              ))}
-            </div>
-            <StyledPanel />
-            <StyledGraphControls />
-          </>
+          <StyledResolverContainer
+            className="resolver-graph kbn-resetFocusState"
+            onMouseDown={onMouseDown}
+            ref={ref}
+            role="tree"
+            tabIndex={0}
+          >
+            {edgeLineSegments.map(([startPosition, endPosition], index) => (
+              <EdgeLine
+                key={index}
+                startPosition={startPosition}
+                endPosition={endPosition}
+                projectionMatrix={projectionMatrix}
+              />
+            ))}
+            {Array.from(processNodePositions).map(([processEvent, position], index) => (
+              <ProcessEventDot
+                key={index}
+                position={position}
+                projectionMatrix={projectionMatrix}
+                event={processEvent}
+                adjacentNodeMap={processToAdjacencyMap.get(processEvent)}
+              />
+            ))}
+          </StyledResolverContainer>
         )}
+        <StyledPanel />
+        <StyledGraphControls />
+        <SymbolDefinitions />
       </div>
     );
   })
@@ -111,4 +128,6 @@ export const Resolver = styled(
    * Prevent partially visible components from showing up outside the bounds of Resolver.
    */
   overflow: hidden;
+  contain: strict;
+  background-color: ${bgColor};
 `;
diff --git a/x-pack/plugins/endpoint/public/embeddables/resolver/view/process_event_dot.tsx b/x-pack/plugins/endpoint/public/embeddables/resolver/view/process_event_dot.tsx
index 2241df97291ae..f3086be1598a8 100644
--- a/x-pack/plugins/endpoint/public/embeddables/resolver/view/process_event_dot.tsx
+++ b/x-pack/plugins/endpoint/public/embeddables/resolver/view/process_event_dot.tsx
@@ -4,12 +4,52 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
+import React, { useCallback, useMemo } from 'react';
 import styled from 'styled-components';
+import { i18n } from '@kbn/i18n';
+import { htmlIdGenerator, EuiKeyboardAccessible } from '@elastic/eui';
 import { applyMatrix3 } from '../lib/vector2';
-import { Vector2, Matrix3 } from '../types';
+import { Vector2, Matrix3, AdjacentProcessMap, ResolverProcessType } from '../types';
+import { SymbolIds, NamedColors, PaintServerIds } from './defs';
 import { ResolverEvent } from '../../../../common/types';
+import { useResolverDispatch } from './use_resolver_dispatch';
 import * as eventModel from '../../../../common/models/event';
+import * as processModel from '../models/process_event';
+
+const nodeAssets = {
+  runningProcessCube: {
+    cubeSymbol: `#${SymbolIds.runningProcessCube}`,
+    labelFill: `url(#${PaintServerIds.runningProcess})`,
+    descriptionFill: NamedColors.activeNoWarning,
+    descriptionText: i18n.translate('xpack.endpoint.resolver.runningProcess', {
+      defaultMessage: 'Running Process',
+    }),
+  },
+  runningTriggerCube: {
+    cubeSymbol: `#${SymbolIds.runningTriggerCube}`,
+    labelFill: `url(#${PaintServerIds.runningTrigger})`,
+    descriptionFill: NamedColors.activeWarning,
+    descriptionText: i18n.translate('xpack.endpoint.resolver.runningTrigger', {
+      defaultMessage: 'Running Trigger',
+    }),
+  },
+  terminatedProcessCube: {
+    cubeSymbol: `#${SymbolIds.terminatedProcessCube}`,
+    labelFill: NamedColors.fullLabelBackground,
+    descriptionFill: NamedColors.inertDescription,
+    descriptionText: i18n.translate('xpack.endpoint.resolver.terminatedProcess', {
+      defaultMessage: 'Terminated Process',
+    }),
+  },
+  terminatedTriggerCube: {
+    cubeSymbol: `#${SymbolIds.terminatedTriggerCube}`,
+    labelFill: NamedColors.fullLabelBackground,
+    descriptionFill: NamedColors.inertDescription,
+    descriptionText: i18n.translate('xpack.endpoint.resolver.terminatedTrigger', {
+      defaultMessage: 'Terminated Trigger',
+    }),
+  },
+};
 
 /**
  * A placeholder view for a process node.
@@ -21,6 +61,7 @@ export const ProcessEventDot = styled(
       position,
       event,
       projectionMatrix,
+      adjacentNodeMap,
     }: {
       /**
        * A `className` string provided by `styled`
@@ -38,39 +79,205 @@ export const ProcessEventDot = styled(
        * projectionMatrix which can be used to convert `position` to screen coordinates.
        */
       projectionMatrix: Matrix3;
+      /**
+       * map of what nodes are "adjacent" to this one in "up, down, previous, next" directions
+       */
+      adjacentNodeMap?: AdjacentProcessMap;
     }) => {
       /**
        * Convert the position, which is in 'world' coordinates, to screen coordinates.
        */
       const [left, top] = applyMatrix3(position, projectionMatrix);
-      const style = {
-        left: (left - 20).toString() + 'px',
-        top: (top - 20).toString() + 'px',
-      };
+
+      const [magFactorX] = projectionMatrix;
+
+      const selfId = adjacentNodeMap?.self;
+
+      const nodeViewportStyle = useMemo(
+        () => ({
+          left: `${left}px`,
+          top: `${top}px`,
+          // Width of symbol viewport scaled to fit
+          width: `${360 * magFactorX}px`,
+          // Height according to symbol viewbox AR
+          height: `${120 * magFactorX}px`,
+          // Adjusted to position/scale with camera
+          transform: `translateX(-${0.172413 * 360 * magFactorX + 10}px) translateY(-${0.73684 *
+            120 *
+            magFactorX}px)`,
+        }),
+        [left, magFactorX, top]
+      );
+
+      const markerBaseSize = 15;
+      const markerSize = markerBaseSize;
+      const markerPositionOffset = -markerBaseSize / 2;
+
+      const labelYOffset = markerPositionOffset + 0.25 * markerSize - 0.5;
+
+      const labelYHeight = markerSize / 1.7647;
+
+      const levelAttribute = adjacentNodeMap?.level
+        ? {
+            'aria-level': adjacentNodeMap.level,
+          }
+        : {};
+
+      const flowToAttribute = adjacentNodeMap?.nextSibling
+        ? {
+            'aria-flowto': adjacentNodeMap.nextSibling,
+          }
+        : {};
+
+      const nodeType = getNodeType(event);
+      const clickTargetRef: { current: SVGAnimationElement | null } = React.createRef();
+      const { cubeSymbol, labelFill, descriptionFill, descriptionText } = nodeAssets[nodeType];
+      const resolverNodeIdGenerator = htmlIdGenerator('resolverNode');
+      const [nodeId, labelId, descriptionId] = [
+        !!selfId ? resolverNodeIdGenerator(String(selfId)) : resolverNodeIdGenerator(),
+        resolverNodeIdGenerator(),
+        resolverNodeIdGenerator(),
+      ] as string[];
+
+      const dispatch = useResolverDispatch();
+
+      const handleFocus = useCallback(
+        (focusEvent: React.FocusEvent<SVGSVGElement>) => {
+          dispatch({
+            type: 'userFocusedOnResolverNode',
+            payload: {
+              nodeId,
+            },
+          });
+          focusEvent.currentTarget.setAttribute('aria-current', 'true');
+        },
+        [dispatch, nodeId]
+      );
+
+      const handleClick = useCallback(
+        (clickEvent: React.MouseEvent<SVGSVGElement, MouseEvent>) => {
+          if (clickTargetRef.current !== null) {
+            (clickTargetRef.current as any).beginElement();
+          }
+        },
+        [clickTargetRef]
+      );
+
       return (
-        <span className={className} style={style} data-test-subj={'resolverNode'}>
-          name: {eventModel.eventName(event)}
-          <br />
-          x: {position[0]}
-          <br />
-          y: {position[1]}
-        </span>
+        <EuiKeyboardAccessible>
+          <svg
+            data-test-subj={'resolverNode'}
+            className={className + ' kbn-resetFocusState'}
+            viewBox="-15 -15 90 30"
+            preserveAspectRatio="xMidYMid meet"
+            role="treeitem"
+            {...levelAttribute}
+            {...flowToAttribute}
+            aria-labelledby={labelId}
+            aria-describedby={descriptionId}
+            aria-haspopup={'true'}
+            style={nodeViewportStyle}
+            id={nodeId}
+            onClick={handleClick}
+            onFocus={handleFocus}
+            tabIndex={-1}
+          >
+            <g>
+              <use
+                role="presentation"
+                xlinkHref={cubeSymbol}
+                x={markerPositionOffset}
+                y={markerPositionOffset}
+                width={markerSize}
+                height={markerSize}
+                opacity="1"
+                className="cube"
+              >
+                <animateTransform
+                  attributeType="XML"
+                  attributeName="transform"
+                  type="scale"
+                  values="1 1; 1 .83; 1 .8; 1 .83; 1 1"
+                  dur="0.2s"
+                  begin="click"
+                  repeatCount="1"
+                  className="squish"
+                  ref={clickTargetRef}
+                />
+              </use>
+              <use
+                role="presentation"
+                xlinkHref={`#${SymbolIds.processNode}`}
+                x={markerPositionOffset + markerSize - 0.5}
+                y={labelYOffset}
+                width={(markerSize / 1.7647) * 5}
+                height={markerSize / 1.7647}
+                opacity="1"
+                fill={labelFill}
+              />
+              <text
+                x={markerPositionOffset + 0.7 * markerSize + 50 / 2}
+                y={labelYOffset + labelYHeight / 2}
+                textAnchor="middle"
+                dominantBaseline="middle"
+                fontSize="3.75"
+                fontWeight="bold"
+                fill={NamedColors.empty}
+                paintOrder="stroke"
+                tabIndex={-1}
+                style={{ letterSpacing: '-0.02px' }}
+                id={labelId}
+              >
+                {eventModel.eventName(event)}
+              </text>
+              <text
+                x={markerPositionOffset + markerSize}
+                y={labelYOffset - 1}
+                textAnchor="start"
+                dominantBaseline="middle"
+                fontSize="2.67"
+                fill={descriptionFill}
+                id={descriptionId}
+                paintOrder="stroke"
+                fontWeight="bold"
+                style={{ textTransform: 'uppercase', letterSpacing: '-0.01px' }}
+              >
+                {descriptionText}
+              </text>
+            </g>
+          </svg>
+        </EuiKeyboardAccessible>
       );
     }
   )
 )`
   position: absolute;
-  width: 40px;
-  height: 40px;
+  display: block;
   text-align: left;
   font-size: 10px;
-  /**
-   * Give the element a button-like appearance.
-   */
   user-select: none;
-  border: 1px solid black;
   box-sizing: border-box;
   border-radius: 10%;
   padding: 4px;
   white-space: nowrap;
+  will-change: left, top, width, height;
+  contain: strict;
 `;
+
+const processTypeToCube: Record<ResolverProcessType, keyof typeof nodeAssets> = {
+  processCreated: 'terminatedProcessCube',
+  processRan: 'runningProcessCube',
+  processTerminated: 'terminatedProcessCube',
+  unknownProcessEvent: 'runningProcessCube',
+  processCausedAlert: 'runningTriggerCube',
+  unknownEvent: 'runningProcessCube',
+};
+
+function getNodeType(processEvent: ResolverEvent): keyof typeof nodeAssets {
+  const processType = processModel.eventType(processEvent);
+
+  if (processType in processTypeToCube) {
+    return processTypeToCube[processType];
+  }
+  return 'runningProcessCube';
+}
diff --git a/x-pack/plugins/endpoint/scripts/resolver_generator.ts b/x-pack/plugins/endpoint/scripts/resolver_generator.ts
index a3e56497f0790..3d11ccaad005d 100644
--- a/x-pack/plugins/endpoint/scripts/resolver_generator.ts
+++ b/x-pack/plugins/endpoint/scripts/resolver_generator.ts
@@ -32,7 +32,7 @@ async function main() {
     },
     metadataIndex: {
       alias: 'mi',
-      describe: 'index to store endpoint metadata in',
+      describe: 'index to store host metadata in',
       default: 'endpoint-agent-1',
       type: 'string',
     },
@@ -76,15 +76,15 @@ async function main() {
       type: 'number',
       default: 30,
     },
-    numEndpoints: {
+    numHosts: {
       alias: 'ne',
-      describe: 'number of different endpoints to generate alerts for',
+      describe: 'number of different hosts to generate alerts for',
       type: 'number',
       default: 1,
     },
-    alertsPerEndpoint: {
+    alertsPerHost: {
       alias: 'ape',
-      describe: 'number of resolver trees to make for each endpoint',
+      describe: 'number of resolver trees to make for each host',
       type: 'number',
       default: 1,
     },
@@ -131,14 +131,19 @@ async function main() {
       process.exit(1);
     }
   }
-
-  const generator = new EndpointDocGenerator(argv.seed);
-  for (let i = 0; i < argv.numEndpoints; i++) {
+  let seed = argv.seed;
+  if (!seed) {
+    seed = Math.random().toString();
+    // eslint-disable-next-line no-console
+    console.log('No seed supplied, using random seed: ' + seed);
+  }
+  const generator = new EndpointDocGenerator(seed);
+  for (let i = 0; i < argv.numHosts; i++) {
     await client.index({
       index: argv.metadataIndex,
-      body: generator.generateEndpointMetadata(),
+      body: generator.generateHostMetadata(),
     });
-    for (let j = 0; j < argv.alertsPerEndpoint; j++) {
+    for (let j = 0; j < argv.alertsPerHost; j++) {
       const resolverDocs = generator.generateFullResolverTree(
         argv.ancestors,
         argv.generations,
diff --git a/x-pack/plugins/endpoint/server/plugin.ts b/x-pack/plugins/endpoint/server/plugin.ts
index aef85f39e0382..4b4afd8088744 100644
--- a/x-pack/plugins/endpoint/server/plugin.ts
+++ b/x-pack/plugins/endpoint/server/plugin.ts
@@ -43,6 +43,7 @@ export class EndpointPlugin
       app: ['endpoint', 'kibana'],
       privileges: {
         all: {
+          app: ['endpoint', 'kibana'],
           api: ['resolver'],
           savedObject: {
             all: [],
@@ -51,6 +52,7 @@ export class EndpointPlugin
           ui: ['save'],
         },
         read: {
+          app: ['endpoint', 'kibana'],
           api: [],
           savedObject: {
             all: [],
diff --git a/x-pack/plugins/endpoint/server/routes/metadata.test.ts b/x-pack/plugins/endpoint/server/routes/metadata.test.ts
index ee374bc1b57d6..65e07edbcde24 100644
--- a/x-pack/plugins/endpoint/server/routes/metadata.test.ts
+++ b/x-pack/plugins/endpoint/server/routes/metadata.test.ts
@@ -18,7 +18,7 @@ import {
   httpServiceMock,
   loggingServiceMock,
 } from '../../../../../src/core/server/mocks';
-import { EndpointMetadata, EndpointResultList } from '../../common/types';
+import { HostMetadata, HostResultList } from '../../common/types';
 import { SearchResponse } from 'elasticsearch';
 import { registerEndpointRoutes } from './metadata';
 import { EndpointConfigSchema } from '../config';
@@ -49,8 +49,8 @@ describe('test endpoint route', () => {
   it('test find the latest of all endpoints', async () => {
     const mockRequest = httpServerMock.createKibanaRequest({});
 
-    const response: SearchResponse<EndpointMetadata> = (data as unknown) as SearchResponse<
-      EndpointMetadata
+    const response: SearchResponse<HostMetadata> = (data as unknown) as SearchResponse<
+      HostMetadata
     >;
     mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
     [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
@@ -72,8 +72,8 @@ describe('test endpoint route', () => {
     expect(mockScopedClient.callAsCurrentUser).toBeCalled();
     expect(routeConfig.options).toEqual({ authRequired: true });
     expect(mockResponse.ok).toBeCalled();
-    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as EndpointResultList;
-    expect(endpointResultList.endpoints.length).toEqual(2);
+    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+    expect(endpointResultList.hosts.length).toEqual(2);
     expect(endpointResultList.total).toEqual(2);
     expect(endpointResultList.request_page_index).toEqual(0);
     expect(endpointResultList.request_page_size).toEqual(10);
@@ -93,7 +93,7 @@ describe('test endpoint route', () => {
       },
     });
     mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
-      Promise.resolve((data as unknown) as SearchResponse<EndpointMetadata>)
+      Promise.resolve((data as unknown) as SearchResponse<HostMetadata>)
     );
     [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
       path.startsWith('/api/endpoint/metadata')
@@ -117,8 +117,8 @@ describe('test endpoint route', () => {
     });
     expect(routeConfig.options).toEqual({ authRequired: true });
     expect(mockResponse.ok).toBeCalled();
-    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as EndpointResultList;
-    expect(endpointResultList.endpoints.length).toEqual(2);
+    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+    expect(endpointResultList.hosts.length).toEqual(2);
     expect(endpointResultList.total).toEqual(2);
     expect(endpointResultList.request_page_index).toEqual(10);
     expect(endpointResultList.request_page_size).toEqual(10);
@@ -140,7 +140,7 @@ describe('test endpoint route', () => {
       },
     });
     mockScopedClient.callAsCurrentUser.mockImplementationOnce(() =>
-      Promise.resolve((data as unknown) as SearchResponse<EndpointMetadata>)
+      Promise.resolve((data as unknown) as SearchResponse<HostMetadata>)
     );
     [routeConfig, routeHandler] = routerMock.post.mock.calls.find(([{ path }]) =>
       path.startsWith('/api/endpoint/metadata')
@@ -177,8 +177,8 @@ describe('test endpoint route', () => {
     });
     expect(routeConfig.options).toEqual({ authRequired: true });
     expect(mockResponse.ok).toBeCalled();
-    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as EndpointResultList;
-    expect(endpointResultList.endpoints.length).toEqual(2);
+    const endpointResultList = mockResponse.ok.mock.calls[0][0]?.body as HostResultList;
+    expect(endpointResultList.hosts.length).toEqual(2);
     expect(endpointResultList.total).toEqual(2);
     expect(endpointResultList.request_page_index).toEqual(10);
     expect(endpointResultList.request_page_size).toEqual(10);
@@ -234,8 +234,8 @@ describe('test endpoint route', () => {
       const mockRequest = httpServerMock.createKibanaRequest({
         params: { id: (data as any).hits.hits[0]._id },
       });
-      const response: SearchResponse<EndpointMetadata> = (data as unknown) as SearchResponse<
-        EndpointMetadata
+      const response: SearchResponse<HostMetadata> = (data as unknown) as SearchResponse<
+        HostMetadata
       >;
       mockScopedClient.callAsCurrentUser.mockImplementationOnce(() => Promise.resolve(response));
       [routeConfig, routeHandler] = routerMock.get.mock.calls.find(([{ path }]) =>
@@ -257,7 +257,7 @@ describe('test endpoint route', () => {
       expect(mockScopedClient.callAsCurrentUser).toBeCalled();
       expect(routeConfig.options).toEqual({ authRequired: true });
       expect(mockResponse.ok).toBeCalled();
-      const result = mockResponse.ok.mock.calls[0][0]?.body as EndpointMetadata;
+      const result = mockResponse.ok.mock.calls[0][0]?.body as HostMetadata;
       expect(result).toHaveProperty('endpoint');
     });
   });
diff --git a/x-pack/plugins/endpoint/server/routes/metadata.ts b/x-pack/plugins/endpoint/server/routes/metadata.ts
index 278cfac020a3b..463a071ab0c77 100644
--- a/x-pack/plugins/endpoint/server/routes/metadata.ts
+++ b/x-pack/plugins/endpoint/server/routes/metadata.ts
@@ -12,11 +12,11 @@ import {
   kibanaRequestToMetadataListESQuery,
   kibanaRequestToMetadataGetESQuery,
 } from '../services/endpoint/metadata_query_builders';
-import { EndpointMetadata, EndpointResultList } from '../../common/types';
+import { HostMetadata, HostResultList } from '../../common/types';
 import { EndpointAppContext } from '../types';
 
 interface HitSource {
-  _source: EndpointMetadata;
+  _source: HostMetadata;
 }
 
 export function registerEndpointRoutes(router: IRouter, endpointAppContext: EndpointAppContext) {
@@ -57,8 +57,8 @@ export function registerEndpointRoutes(router: IRouter, endpointAppContext: Endp
         const response = (await context.core.elasticsearch.dataClient.callAsCurrentUser(
           'search',
           queryParams
-        )) as SearchResponse<EndpointMetadata>;
-        return res.ok({ body: mapToEndpointResultList(queryParams, response) });
+        )) as SearchResponse<HostMetadata>;
+        return res.ok({ body: mapToHostResultList(queryParams, response) });
       } catch (err) {
         return res.internalError({ body: err });
       }
@@ -79,7 +79,7 @@ export function registerEndpointRoutes(router: IRouter, endpointAppContext: Endp
         const response = (await context.core.elasticsearch.dataClient.callAsCurrentUser(
           'search',
           query
-        )) as SearchResponse<EndpointMetadata>;
+        )) as SearchResponse<HostMetadata>;
 
         if (response.hits.hits.length === 0) {
           return res.notFound({ body: 'Endpoint Not Found' });
@@ -93,27 +93,27 @@ export function registerEndpointRoutes(router: IRouter, endpointAppContext: Endp
   );
 }
 
-function mapToEndpointResultList(
+function mapToHostResultList(
   queryParams: Record<string, any>,
-  searchResponse: SearchResponse<EndpointMetadata>
-): EndpointResultList {
-  const totalNumberOfEndpoints = searchResponse?.aggregations?.total?.value || 0;
+  searchResponse: SearchResponse<HostMetadata>
+): HostResultList {
+  const totalNumberOfHosts = searchResponse?.aggregations?.total?.value || 0;
   if (searchResponse.hits.hits.length > 0) {
     return {
       request_page_size: queryParams.size,
       request_page_index: queryParams.from,
-      endpoints: searchResponse.hits.hits
+      hosts: searchResponse.hits.hits
         .map(response => response.inner_hits.most_recent.hits.hits)
         .flatMap(data => data as HitSource)
         .map(entry => entry._source),
-      total: totalNumberOfEndpoints,
+      total: totalNumberOfHosts,
     };
   } else {
     return {
       request_page_size: queryParams.size,
       request_page_index: queryParams.from,
-      total: totalNumberOfEndpoints,
-      endpoints: [],
+      total: totalNumberOfHosts,
+      hosts: [],
     };
   }
 }
diff --git a/x-pack/plugins/features/common/feature.ts b/x-pack/plugins/features/common/feature.ts
index 748076b95ad77..82fcc33f5c8ce 100644
--- a/x-pack/plugins/features/common/feature.ts
+++ b/x-pack/plugins/features/common/feature.ts
@@ -4,16 +4,16 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { FeatureKibanaPrivileges, FeatureKibanaPrivilegesSet } from './feature_kibana_privileges';
+import { RecursiveReadonly } from '@kbn/utility-types';
+import { FeatureKibanaPrivileges } from './feature_kibana_privileges';
+import { SubFeatureConfig, SubFeature } from './sub_feature';
 
 /**
  * Interface for registering a feature.
  * Feature registration allows plugins to hide their applications with spaces,
  * and secure access when configured for security.
  */
-export interface Feature<
-  TPrivileges extends Partial<FeatureKibanaPrivilegesSet> = FeatureKibanaPrivilegesSet
-> {
+export interface FeatureConfig {
   /**
    * Unique identifier for this feature.
    * This identifier is also used when generating UI Capabilities.
@@ -28,6 +28,11 @@ export interface Feature<
    */
   name: string;
 
+  /**
+   * An ordinal used to sort features relative to one another for display.
+   */
+  order?: number;
+
   /**
    * Whether or not this feature should be excluded from the base privileges.
    * This is primarily helpful when migrating applications with a "legacy" privileges model
@@ -98,7 +103,15 @@ export interface Feature<
    * ```
    * @see FeatureKibanaPrivileges
    */
-  privileges: TPrivileges;
+  privileges: {
+    all: FeatureKibanaPrivileges;
+    read: FeatureKibanaPrivileges;
+  } | null;
+
+  /**
+   * Optional sub-feature privilege definitions. This can only be specified if `privileges` are are also defined.
+   */
+  subFeatures?: SubFeatureConfig[];
 
   /**
    * Optional message to display on the Role Management screen when configuring permissions for this feature.
@@ -114,7 +127,64 @@ export interface Feature<
   };
 }
 
-export type FeatureWithAllOrReadPrivileges = Feature<{
-  all?: FeatureKibanaPrivileges;
-  read?: FeatureKibanaPrivileges;
-}>;
+export class Feature {
+  public readonly subFeatures: SubFeature[];
+
+  constructor(protected readonly config: RecursiveReadonly<FeatureConfig>) {
+    this.subFeatures = (config.subFeatures ?? []).map(
+      subFeatureConfig => new SubFeature(subFeatureConfig)
+    );
+  }
+
+  public get id() {
+    return this.config.id;
+  }
+
+  public get name() {
+    return this.config.name;
+  }
+
+  public get order() {
+    return this.config.order;
+  }
+
+  public get navLinkId() {
+    return this.config.navLinkId;
+  }
+
+  public get app() {
+    return this.config.app;
+  }
+
+  public get catalogue() {
+    return this.config.catalogue;
+  }
+
+  public get management() {
+    return this.config.management;
+  }
+
+  public get icon() {
+    return this.config.icon;
+  }
+
+  public get validLicenses() {
+    return this.config.validLicenses;
+  }
+
+  public get privileges() {
+    return this.config.privileges;
+  }
+
+  public get excludeFromBasePrivileges() {
+    return this.config.excludeFromBasePrivileges ?? false;
+  }
+
+  public get reserved() {
+    return this.config.reserved;
+  }
+
+  public toRaw() {
+    return { ...this.config } as FeatureConfig;
+  }
+}
diff --git a/x-pack/plugins/features/common/feature_kibana_privileges.ts b/x-pack/plugins/features/common/feature_kibana_privileges.ts
index 1d14f3728282c..768c8c6ae1088 100644
--- a/x-pack/plugins/features/common/feature_kibana_privileges.ts
+++ b/x-pack/plugins/features/common/feature_kibana_privileges.ts
@@ -123,5 +123,3 @@ export interface FeatureKibanaPrivileges {
    */
   ui: string[];
 }
-
-export type FeatureKibanaPrivilegesSet = Record<string, FeatureKibanaPrivileges>;
diff --git a/x-pack/plugins/features/common/index.ts b/x-pack/plugins/features/common/index.ts
index 6111d7d25a61b..e359efbda20d2 100644
--- a/x-pack/plugins/features/common/index.ts
+++ b/x-pack/plugins/features/common/index.ts
@@ -5,4 +5,11 @@
  */
 
 export { FeatureKibanaPrivileges } from './feature_kibana_privileges';
-export * from './feature';
+export { Feature, FeatureConfig } from './feature';
+export {
+  SubFeature,
+  SubFeatureConfig,
+  SubFeaturePrivilegeConfig,
+  SubFeaturePrivilegeGroupConfig,
+  SubFeaturePrivilegeGroupType,
+} from './sub_feature';
diff --git a/x-pack/plugins/features/common/sub_feature.ts b/x-pack/plugins/features/common/sub_feature.ts
new file mode 100644
index 0000000000000..121bb8514c8a2
--- /dev/null
+++ b/x-pack/plugins/features/common/sub_feature.ts
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RecursiveReadonly } from '@kbn/utility-types';
+import { FeatureKibanaPrivileges } from './feature_kibana_privileges';
+
+/**
+ * Configuration for a sub-feature.
+ */
+export interface SubFeatureConfig {
+  /** Display name for this sub-feature */
+  name: string;
+
+  /** Collection of privilege groups */
+  privilegeGroups: SubFeaturePrivilegeGroupConfig[];
+}
+
+/**
+ * The type of privilege group.
+ * - `mutually_exclusive`::
+ *     Users will be able to select at most one privilege within this group.
+ *     Privileges must be specified in descending order of permissiveness (e.g. `All`, `Read`, not `Read`, `All)
+ * - `independent`::
+ *     Users will be able to select any combination of privileges within this group.
+ */
+export type SubFeaturePrivilegeGroupType = 'mutually_exclusive' | 'independent';
+
+/**
+ * Configuration for a sub-feature privilege group.
+ */
+export interface SubFeaturePrivilegeGroupConfig {
+  /**
+   * The type of privilege group.
+   * - `mutually_exclusive`::
+   *     Users will be able to select at most one privilege within this group.
+   *     Privileges must be specified in descending order of permissiveness (e.g. `All`, `Read`, not `Read`, `All)
+   * - `independent`::
+   *     Users will be able to select any combination of privileges within this group.
+   */
+  groupType: SubFeaturePrivilegeGroupType;
+
+  /**
+   * The privileges which belong to this group.
+   */
+  privileges: SubFeaturePrivilegeConfig[];
+}
+
+/**
+ * Configuration for a sub-feature privilege.
+ */
+export interface SubFeaturePrivilegeConfig
+  extends Omit<FeatureKibanaPrivileges, 'excludeFromBasePrivileges'> {
+  /**
+   * Identifier for this privilege. Must be unique across all other privileges within a feature.
+   */
+  id: string;
+
+  /**
+   * The display name for this privilege.
+   */
+  name: string;
+
+  /**
+   * Denotes which Primary Feature Privilege this sub-feature privilege should be included in.
+   * `read` is also included in `all` automatically.
+   */
+  includeIn: 'all' | 'read' | 'none';
+}
+
+export class SubFeature {
+  constructor(protected readonly config: RecursiveReadonly<SubFeatureConfig>) {}
+
+  public get name() {
+    return this.config.name;
+  }
+
+  public get privilegeGroups() {
+    return this.config.privilegeGroups;
+  }
+
+  public toRaw() {
+    return { ...this.config };
+  }
+}
diff --git a/x-pack/plugins/features/kibana.json b/x-pack/plugins/features/kibana.json
index 553e920f0e720..e38d7be892904 100644
--- a/x-pack/plugins/features/kibana.json
+++ b/x-pack/plugins/features/kibana.json
@@ -4,5 +4,5 @@
   "kibanaVersion": "kibana",
   "optionalPlugins": ["timelion"],
   "server": true,
-  "ui": false
+  "ui": true
 }
diff --git a/x-pack/plugins/features/public/features_api_client.test.ts b/x-pack/plugins/features/public/features_api_client.test.ts
new file mode 100644
index 0000000000000..e3a25ad57425c
--- /dev/null
+++ b/x-pack/plugins/features/public/features_api_client.test.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { coreMock } from 'src/core/public/mocks';
+import { FeaturesAPIClient } from './features_api_client';
+
+describe('Features API Client', () => {
+  describe('#getFeatures', () => {
+    it('returns an array of Features', async () => {
+      const rawFeatures = [
+        {
+          id: 'feature-a',
+        },
+        {
+          id: 'feature-b',
+        },
+        {
+          id: 'feature-c',
+        },
+        {
+          id: 'feature-d',
+        },
+        {
+          id: 'feature-e',
+        },
+      ];
+      const coreSetup = coreMock.createSetup();
+      coreSetup.http.get.mockResolvedValue(rawFeatures);
+
+      const client = new FeaturesAPIClient(coreSetup.http);
+      const result = await client.getFeatures();
+      expect(result.map(f => f.id)).toEqual([
+        'feature-a',
+        'feature-b',
+        'feature-c',
+        'feature-d',
+        'feature-e',
+      ]);
+    });
+  });
+});
diff --git a/x-pack/plugins/features/public/features_api_client.ts b/x-pack/plugins/features/public/features_api_client.ts
new file mode 100644
index 0000000000000..b93c9bf917d79
--- /dev/null
+++ b/x-pack/plugins/features/public/features_api_client.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HttpSetup } from 'src/core/public';
+import { FeatureConfig, Feature } from '.';
+
+export class FeaturesAPIClient {
+  constructor(private readonly http: HttpSetup) {}
+
+  public async getFeatures() {
+    const features = await this.http.get<FeatureConfig[]>('/api/features');
+    return features.map(config => new Feature(config));
+  }
+}
diff --git a/x-pack/plugins/features/public/index.ts b/x-pack/plugins/features/public/index.ts
index 6a2c99aad4bd8..f19c7f947d97f 100644
--- a/x-pack/plugins/features/public/index.ts
+++ b/x-pack/plugins/features/public/index.ts
@@ -4,4 +4,18 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { Feature, FeatureWithAllOrReadPrivileges, FeatureKibanaPrivileges } from '../common';
+import { PluginInitializer } from 'src/core/public';
+import { FeaturesPlugin, FeaturesPluginSetup, FeaturesPluginStart } from './plugin';
+
+export {
+  Feature,
+  FeatureConfig,
+  FeatureKibanaPrivileges,
+  SubFeatureConfig,
+  SubFeaturePrivilegeConfig,
+} from '../common';
+
+export { FeaturesPluginSetup, FeaturesPluginStart } from './plugin';
+
+export const plugin: PluginInitializer<FeaturesPluginSetup, FeaturesPluginStart> = () =>
+  new FeaturesPlugin();
diff --git a/x-pack/plugins/features/public/mocks.ts b/x-pack/plugins/features/public/mocks.ts
new file mode 100644
index 0000000000000..014883f3ce9cf
--- /dev/null
+++ b/x-pack/plugins/features/public/mocks.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FeaturesPluginStart } from './plugin';
+
+const createStart = (): jest.Mocked<FeaturesPluginStart> => {
+  return {
+    getFeatures: jest.fn(),
+  };
+};
+
+export const featuresPluginMock = {
+  createStart,
+};
diff --git a/x-pack/plugins/features/public/plugin.test.ts b/x-pack/plugins/features/public/plugin.test.ts
new file mode 100644
index 0000000000000..aab712d647508
--- /dev/null
+++ b/x-pack/plugins/features/public/plugin.test.ts
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FeaturesPlugin } from './plugin';
+
+import { coreMock, httpServiceMock } from 'src/core/public/mocks';
+
+jest.mock('./features_api_client', () => {
+  const instance = {
+    getFeatures: jest.fn(),
+  };
+  return {
+    FeaturesAPIClient: jest.fn().mockImplementation(() => instance),
+  };
+});
+
+import { FeaturesAPIClient } from './features_api_client';
+
+describe('Features Plugin', () => {
+  describe('#setup', () => {
+    it('returns expected public contract', () => {
+      const plugin = new FeaturesPlugin();
+      expect(plugin.setup(coreMock.createSetup())).toMatchInlineSnapshot(`undefined`);
+    });
+  });
+
+  describe('#start', () => {
+    it('returns expected public contract', () => {
+      const plugin = new FeaturesPlugin();
+      plugin.setup(coreMock.createSetup());
+
+      expect(plugin.start()).toMatchInlineSnapshot(`
+        Object {
+          "getFeatures": [Function],
+        }
+      `);
+    });
+
+    it('#getFeatures calls the underlying FeaturesAPIClient', () => {
+      const plugin = new FeaturesPlugin();
+      const apiClient = new FeaturesAPIClient(httpServiceMock.createSetupContract());
+
+      plugin.setup(coreMock.createSetup());
+
+      const start = plugin.start();
+      start.getFeatures();
+      expect(apiClient.getFeatures).toHaveBeenCalledTimes(1);
+    });
+  });
+});
diff --git a/x-pack/plugins/features/public/plugin.ts b/x-pack/plugins/features/public/plugin.ts
new file mode 100644
index 0000000000000..c168384dae78f
--- /dev/null
+++ b/x-pack/plugins/features/public/plugin.ts
@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Plugin, CoreSetup } from 'src/core/public';
+import { FeaturesAPIClient } from './features_api_client';
+
+export class FeaturesPlugin implements Plugin<FeaturesPluginSetup, FeaturesPluginStart> {
+  private apiClient?: FeaturesAPIClient;
+
+  public setup(core: CoreSetup) {
+    this.apiClient = new FeaturesAPIClient(core.http);
+  }
+
+  public start() {
+    return {
+      getFeatures: () => this.apiClient!.getFeatures(),
+    };
+  }
+
+  public stop() {}
+}
+
+export type FeaturesPluginSetup = ReturnType<FeaturesPlugin['setup']>;
+export type FeaturesPluginStart = ReturnType<FeaturesPlugin['start']>;
diff --git a/x-pack/plugins/features/server/__snapshots__/oss_features.test.ts.snap b/x-pack/plugins/features/server/__snapshots__/oss_features.test.ts.snap
new file mode 100644
index 0000000000000..ee94d0d40b853
--- /dev/null
+++ b/x-pack/plugins/features/server/__snapshots__/oss_features.test.ts.snap
@@ -0,0 +1,458 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`buildOSSFeatures returns the advancedSettings feature augmented with appropriate sub feature privileges 1`] = `
+Array [
+  Object {
+    "privilege": Object {
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "advanced_settings",
+      ],
+      "management": Object {
+        "kibana": Array [
+          "settings",
+        ],
+      },
+      "savedObject": Object {
+        "all": Array [
+          "config",
+        ],
+        "read": Array [],
+      },
+      "ui": Array [
+        "save",
+      ],
+    },
+    "privilegeId": "all",
+  },
+  Object {
+    "privilege": Object {
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "advanced_settings",
+      ],
+      "management": Object {
+        "kibana": Array [
+          "settings",
+        ],
+      },
+      "savedObject": Object {
+        "all": Array [],
+        "read": Array [],
+      },
+      "ui": Array [],
+    },
+    "privilegeId": "read",
+  },
+]
+`;
+
+exports[`buildOSSFeatures returns the dashboard feature augmented with appropriate sub feature privileges 1`] = `
+Array [
+  Object {
+    "privilege": Object {
+      "api": Array [],
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "dashboard",
+      ],
+      "management": Object {},
+      "savedObject": Object {
+        "all": Array [
+          "dashboard",
+          "url",
+          "query",
+        ],
+        "read": Array [
+          "index-pattern",
+          "search",
+          "visualization",
+          "timelion-sheet",
+          "canvas-workpad",
+          "lens",
+          "map",
+        ],
+      },
+      "ui": Array [
+        "createNew",
+        "show",
+        "showWriteControls",
+        "saveQuery",
+        "createShortUrl",
+      ],
+    },
+    "privilegeId": "all",
+  },
+  Object {
+    "privilege": Object {
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "dashboard",
+      ],
+      "savedObject": Object {
+        "all": Array [],
+        "read": Array [
+          "index-pattern",
+          "search",
+          "visualization",
+          "timelion-sheet",
+          "canvas-workpad",
+          "map",
+          "dashboard",
+          "query",
+        ],
+      },
+      "ui": Array [
+        "show",
+      ],
+    },
+    "privilegeId": "read",
+  },
+]
+`;
+
+exports[`buildOSSFeatures returns the dev_tools feature augmented with appropriate sub feature privileges 1`] = `
+Array [
+  Object {
+    "privilege": Object {
+      "api": Array [
+        "console",
+      ],
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "console",
+        "searchprofiler",
+        "grokdebugger",
+      ],
+      "savedObject": Object {
+        "all": Array [],
+        "read": Array [],
+      },
+      "ui": Array [
+        "show",
+        "save",
+      ],
+    },
+    "privilegeId": "all",
+  },
+  Object {
+    "privilege": Object {
+      "api": Array [
+        "console",
+      ],
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "console",
+        "searchprofiler",
+        "grokdebugger",
+      ],
+      "savedObject": Object {
+        "all": Array [],
+        "read": Array [],
+      },
+      "ui": Array [
+        "show",
+      ],
+    },
+    "privilegeId": "read",
+  },
+]
+`;
+
+exports[`buildOSSFeatures returns the discover feature augmented with appropriate sub feature privileges 1`] = `
+Array [
+  Object {
+    "privilege": Object {
+      "api": Array [],
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "discover",
+      ],
+      "management": Object {},
+      "savedObject": Object {
+        "all": Array [
+          "search",
+          "query",
+          "url",
+        ],
+        "read": Array [
+          "index-pattern",
+        ],
+      },
+      "ui": Array [
+        "show",
+        "save",
+        "saveQuery",
+        "createShortUrl",
+      ],
+    },
+    "privilegeId": "all",
+  },
+  Object {
+    "privilege": Object {
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "discover",
+      ],
+      "savedObject": Object {
+        "all": Array [],
+        "read": Array [
+          "index-pattern",
+          "search",
+          "query",
+        ],
+      },
+      "ui": Array [
+        "show",
+      ],
+    },
+    "privilegeId": "read",
+  },
+]
+`;
+
+exports[`buildOSSFeatures returns the indexPatterns feature augmented with appropriate sub feature privileges 1`] = `
+Array [
+  Object {
+    "privilege": Object {
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "index_patterns",
+      ],
+      "management": Object {
+        "kibana": Array [
+          "index_patterns",
+        ],
+      },
+      "savedObject": Object {
+        "all": Array [
+          "index-pattern",
+        ],
+        "read": Array [],
+      },
+      "ui": Array [
+        "save",
+      ],
+    },
+    "privilegeId": "all",
+  },
+  Object {
+    "privilege": Object {
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "index_patterns",
+      ],
+      "management": Object {
+        "kibana": Array [
+          "index_patterns",
+        ],
+      },
+      "savedObject": Object {
+        "all": Array [],
+        "read": Array [
+          "index-pattern",
+        ],
+      },
+      "ui": Array [],
+    },
+    "privilegeId": "read",
+  },
+]
+`;
+
+exports[`buildOSSFeatures returns the savedObjectsManagement feature augmented with appropriate sub feature privileges 1`] = `
+Array [
+  Object {
+    "privilege": Object {
+      "api": Array [
+        "copySavedObjectsToSpaces",
+      ],
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "saved_objects",
+      ],
+      "management": Object {
+        "kibana": Array [
+          "objects",
+        ],
+      },
+      "savedObject": Object {
+        "all": Array [
+          "foo",
+          "bar",
+        ],
+        "read": Array [],
+      },
+      "ui": Array [
+        "read",
+        "edit",
+        "delete",
+        "copyIntoSpace",
+      ],
+    },
+    "privilegeId": "all",
+  },
+  Object {
+    "privilege": Object {
+      "api": Array [
+        "copySavedObjectsToSpaces",
+      ],
+      "app": Array [
+        "kibana",
+      ],
+      "catalogue": Array [
+        "saved_objects",
+      ],
+      "management": Object {
+        "kibana": Array [
+          "objects",
+        ],
+      },
+      "savedObject": Object {
+        "all": Array [],
+        "read": Array [
+          "foo",
+          "bar",
+        ],
+      },
+      "ui": Array [
+        "read",
+      ],
+    },
+    "privilegeId": "read",
+  },
+]
+`;
+
+exports[`buildOSSFeatures returns the timelion feature augmented with appropriate sub feature privileges 1`] = `
+Array [
+  Object {
+    "privilege": Object {
+      "app": Array [
+        "timelion",
+        "kibana",
+      ],
+      "catalogue": Array [
+        "timelion",
+      ],
+      "savedObject": Object {
+        "all": Array [
+          "timelion-sheet",
+        ],
+        "read": Array [
+          "index-pattern",
+        ],
+      },
+      "ui": Array [
+        "save",
+      ],
+    },
+    "privilegeId": "all",
+  },
+  Object {
+    "privilege": Object {
+      "app": Array [
+        "timelion",
+        "kibana",
+      ],
+      "catalogue": Array [
+        "timelion",
+      ],
+      "savedObject": Object {
+        "all": Array [],
+        "read": Array [
+          "index-pattern",
+          "timelion-sheet",
+        ],
+      },
+      "ui": Array [],
+    },
+    "privilegeId": "read",
+  },
+]
+`;
+
+exports[`buildOSSFeatures returns the visualize feature augmented with appropriate sub feature privileges 1`] = `
+Array [
+  Object {
+    "privilege": Object {
+      "api": Array [],
+      "app": Array [
+        "kibana",
+        "lens",
+      ],
+      "catalogue": Array [
+        "visualize",
+      ],
+      "management": Object {},
+      "savedObject": Object {
+        "all": Array [
+          "visualization",
+          "query",
+          "lens",
+          "url",
+        ],
+        "read": Array [
+          "index-pattern",
+          "search",
+        ],
+      },
+      "ui": Array [
+        "show",
+        "delete",
+        "save",
+        "saveQuery",
+        "createShortUrl",
+      ],
+    },
+    "privilegeId": "all",
+  },
+  Object {
+    "privilege": Object {
+      "app": Array [
+        "kibana",
+        "lens",
+      ],
+      "catalogue": Array [
+        "visualize",
+      ],
+      "savedObject": Object {
+        "all": Array [],
+        "read": Array [
+          "index-pattern",
+          "search",
+          "visualization",
+          "query",
+          "lens",
+        ],
+      },
+      "ui": Array [
+        "show",
+      ],
+    },
+    "privilegeId": "read",
+  },
+]
+`;
diff --git a/x-pack/plugins/features/server/feature_registry.test.ts b/x-pack/plugins/features/server/feature_registry.test.ts
index 7b25035892668..5b4f7728c9f31 100644
--- a/x-pack/plugins/features/server/feature_registry.test.ts
+++ b/x-pack/plugins/features/server/feature_registry.test.ts
@@ -5,15 +5,15 @@
  */
 
 import { FeatureRegistry } from './feature_registry';
-import { Feature } from '../common/feature';
+import { FeatureConfig } from '../common/feature';
 
 describe('FeatureRegistry', () => {
   it('allows a minimal feature to be registered', () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
-      privileges: {},
+      privileges: null,
     };
 
     const featureRegistry = new FeatureRegistry();
@@ -22,18 +22,18 @@ describe('FeatureRegistry', () => {
     expect(result).toHaveLength(1);
 
     // Should be the equal, but not the same instance (i.e., a defensive copy)
-    expect(result[0]).not.toBe(feature);
-    expect(result[0]).toEqual(feature);
+    expect(result[0].toRaw()).not.toBe(feature);
+    expect(result[0].toRaw()).toEqual(feature);
   });
 
   it('allows a complex feature to be registered', () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       excludeFromBasePrivileges: true,
       icon: 'addDataApp',
       navLinkId: 'someNavLink',
-      app: ['app1', 'app2'],
+      app: ['app1'],
       validLicenses: ['standard', 'basic', 'gold', 'platinum'],
       catalogue: ['foo'],
       management: {
@@ -53,7 +53,61 @@ describe('FeatureRegistry', () => {
           api: ['someApiEndpointTag', 'anotherEndpointTag'],
           ui: ['allowsFoo', 'showBar', 'showBaz'],
         },
+        read: {
+          savedObject: {
+            all: [],
+            read: ['config', 'url'],
+          },
+          ui: [],
+        },
       },
+      subFeatures: [
+        {
+          name: 'sub-feature-1',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'foo',
+                  name: 'foo',
+                  includeIn: 'read',
+                  savedObject: {
+                    all: [],
+                    read: [],
+                  },
+                  ui: [],
+                },
+              ],
+            },
+            {
+              groupType: 'mutually_exclusive',
+              privileges: [
+                {
+                  id: 'bar',
+                  name: 'bar',
+                  includeIn: 'all',
+                  savedObject: {
+                    all: [],
+                    read: [],
+                  },
+                  ui: [],
+                },
+                {
+                  id: 'baz',
+                  name: 'baz',
+                  includeIn: 'none',
+                  savedObject: {
+                    all: [],
+                    read: [],
+                  },
+                  ui: [],
+                },
+              ],
+            },
+          ],
+        },
+      ],
       privilegesTooltip: 'some fancy tooltip',
       reserved: {
         privilege: {
@@ -79,12 +133,61 @@ describe('FeatureRegistry', () => {
     expect(result).toHaveLength(1);
 
     // Should be the equal, but not the same instance (i.e., a defensive copy)
-    expect(result[0]).not.toBe(feature);
-    expect(result[0]).toEqual(feature);
+    expect(result[0].toRaw()).not.toBe(feature);
+    expect(result[0].toRaw()).toEqual(feature);
+  });
+
+  it(`requires a value for privileges`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+    } as any;
+
+    const featureRegistry = new FeatureRegistry();
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"child \\"privileges\\" fails because [\\"privileges\\" is required]"`
+    );
+  });
+
+  it(`does not allow sub-features to be registered when no primary privileges are not registered`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+      privileges: null,
+      subFeatures: [
+        {
+          name: 'my sub feature',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'my-sub-priv',
+                  name: 'my sub priv',
+                  includeIn: 'none',
+                  savedObject: {
+                    all: [],
+                    read: [],
+                  },
+                  ui: [],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    };
+
+    const featureRegistry = new FeatureRegistry();
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"child \\"subFeatures\\" fails because [\\"subFeatures\\" must contain less than or equal to 0 items]"`
+    );
   });
 
   it(`automatically grants 'all' access to telemetry saved objects for the 'all' privilege`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
@@ -96,6 +199,13 @@ describe('FeatureRegistry', () => {
             read: [],
           },
         },
+        read: {
+          ui: [],
+          savedObject: {
+            all: [],
+            read: [],
+          },
+        },
       },
     };
 
@@ -103,12 +213,15 @@ describe('FeatureRegistry', () => {
     featureRegistry.register(feature);
     const result = featureRegistry.getAll();
 
-    const allPrivilege = result[0].privileges.all;
-    expect(allPrivilege.savedObject.all).toEqual(['telemetry']);
+    expect(result[0].privileges).toHaveProperty('all');
+    expect(result[0].privileges).toHaveProperty('read');
+
+    const allPrivilege = result[0].privileges?.all;
+    expect(allPrivilege?.savedObject.all).toEqual(['telemetry']);
   });
 
   it(`automatically grants 'read' access to config and url saved objects for both privileges`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
@@ -134,18 +247,21 @@ describe('FeatureRegistry', () => {
     featureRegistry.register(feature);
     const result = featureRegistry.getAll();
 
-    const allPrivilege = result[0].privileges.all;
-    const readPrivilege = result[0].privileges.read;
-    expect(allPrivilege.savedObject.read).toEqual(['config', 'url']);
-    expect(readPrivilege.savedObject.read).toEqual(['config', 'url']);
+    expect(result[0].privileges).toHaveProperty('all');
+    expect(result[0].privileges).toHaveProperty('read');
+
+    const allPrivilege = result[0].privileges?.all;
+    const readPrivilege = result[0].privileges?.read;
+    expect(allPrivilege?.savedObject.read).toEqual(['config', 'url']);
+    expect(readPrivilege?.savedObject.read).toEqual(['config', 'url']);
   });
 
   it(`automatically grants 'all' access to telemetry and 'read' to [config, url] saved objects for the reserved privilege`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
-      privileges: {},
+      privileges: null,
       reserved: {
         description: 'foo',
         privilege: {
@@ -168,7 +284,7 @@ describe('FeatureRegistry', () => {
   });
 
   it(`does not duplicate the automatic grants if specified on the incoming feature`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
@@ -194,26 +310,29 @@ describe('FeatureRegistry', () => {
     featureRegistry.register(feature);
     const result = featureRegistry.getAll();
 
-    const allPrivilege = result[0].privileges.all;
-    const readPrivilege = result[0].privileges.read;
-    expect(allPrivilege.savedObject.all).toEqual(['telemetry']);
-    expect(allPrivilege.savedObject.read).toEqual(['config', 'url']);
-    expect(readPrivilege.savedObject.read).toEqual(['config', 'url']);
+    expect(result[0].privileges).toHaveProperty('all');
+    expect(result[0].privileges).toHaveProperty('read');
+
+    const allPrivilege = result[0].privileges!.all;
+    const readPrivilege = result[0].privileges!.read;
+    expect(allPrivilege?.savedObject.all).toEqual(['telemetry']);
+    expect(allPrivilege?.savedObject.read).toEqual(['config', 'url']);
+    expect(readPrivilege?.savedObject.read).toEqual(['config', 'url']);
   });
 
   it(`does not allow duplicate features to be registered`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
-      privileges: {},
+      privileges: null,
     };
 
-    const duplicateFeature: Feature = {
+    const duplicateFeature: FeatureConfig = {
       id: 'test-feature',
       name: 'Duplicate Test Feature',
       app: [],
-      privileges: {},
+      privileges: null,
     };
 
     const featureRegistry = new FeatureRegistry();
@@ -233,7 +352,7 @@ describe('FeatureRegistry', () => {
           name: 'some feature',
           navLinkId: prohibitedChars,
           app: [],
-          privileges: {},
+          privileges: null,
         })
       ).toThrowErrorMatchingSnapshot();
     });
@@ -248,7 +367,7 @@ describe('FeatureRegistry', () => {
             kibana: [prohibitedChars],
           },
           app: [],
-          privileges: {},
+          privileges: null,
         })
       ).toThrowErrorMatchingSnapshot();
     });
@@ -261,7 +380,7 @@ describe('FeatureRegistry', () => {
           name: 'some feature',
           catalogue: [prohibitedChars],
           app: [],
-          privileges: {},
+          privileges: null,
         })
       ).toThrowErrorMatchingSnapshot();
     });
@@ -275,19 +394,20 @@ describe('FeatureRegistry', () => {
           id: prohibitedId,
           name: 'some feature',
           app: [],
-          privileges: {},
+          privileges: null,
         })
       ).toThrowErrorMatchingSnapshot();
     });
   });
 
   it('prevents features from being registered with invalid privilege names', () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: ['app1', 'app2'],
       privileges: {
         foo: {
+          name: 'Foo',
           app: ['app1', 'app2'],
           savedObject: {
             all: ['config', 'space', 'etc'],
@@ -296,7 +416,7 @@ describe('FeatureRegistry', () => {
           api: ['someApiEndpointTag', 'anotherEndpointTag'],
           ui: ['allowsFoo', 'showBar', 'showBaz'],
         },
-      },
+      } as any,
     };
 
     const featureRegistry = new FeatureRegistry();
@@ -306,7 +426,7 @@ describe('FeatureRegistry', () => {
   });
 
   it(`prevents privileges from specifying app entries that don't exist at the root level`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: ['bar'],
@@ -319,6 +439,14 @@ describe('FeatureRegistry', () => {
           ui: [],
           app: ['foo', 'bar', 'baz'],
         },
+        read: {
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: ['foo', 'bar', 'baz'],
+        },
       },
     };
 
@@ -329,12 +457,67 @@ describe('FeatureRegistry', () => {
     );
   });
 
+  it(`prevents features from specifying app entries that don't exist at the privilege level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: ['foo', 'bar', 'baz'],
+      privileges: {
+        all: {
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: ['bar'],
+        },
+        read: {
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'my sub feature',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'cool-sub-feature-privilege',
+                  name: 'cool privilege',
+                  includeIn: 'none',
+                  savedObject: {
+                    all: [],
+                    read: [],
+                  },
+                  ui: [],
+                  app: ['foo'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature test-feature specifies app entries which are not granted to any privileges: baz"`
+    );
+  });
+
   it(`prevents reserved privileges from specifying app entries that don't exist at the root level`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: ['bar'],
-      privileges: {},
+      privileges: null,
       reserved: {
         description: 'something',
         privilege: {
@@ -355,8 +538,34 @@ describe('FeatureRegistry', () => {
     );
   });
 
+  it(`prevents features from specifying app entries that don't exist at the reserved privilege level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: ['foo', 'bar', 'baz'],
+      privileges: null,
+      reserved: {
+        description: 'something',
+        privilege: {
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: ['foo', 'bar'],
+        },
+      },
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature test-feature specifies app entries which are not granted to any privileges: baz"`
+    );
+  });
+
   it(`prevents privileges from specifying catalogue entries that don't exist at the root level`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
@@ -371,6 +580,15 @@ describe('FeatureRegistry', () => {
           ui: [],
           app: [],
         },
+        read: {
+          catalogue: ['foo', 'bar', 'baz'],
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
       },
     };
 
@@ -381,13 +599,71 @@ describe('FeatureRegistry', () => {
     );
   });
 
+  it(`prevents features from specifying catalogue entries that don't exist at the privilege level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+      catalogue: ['foo', 'bar', 'baz'],
+      privileges: {
+        all: {
+          catalogue: ['foo'],
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+        read: {
+          catalogue: ['foo'],
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'my sub feature',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'cool-sub-feature-privilege',
+                  name: 'cool privilege',
+                  includeIn: 'none',
+                  savedObject: {
+                    all: [],
+                    read: [],
+                  },
+                  ui: [],
+                  catalogue: ['bar'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature test-feature specifies catalogue entries which are not granted to any privileges: baz"`
+    );
+  });
+
   it(`prevents reserved privileges from specifying catalogue entries that don't exist at the root level`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
       catalogue: ['bar'],
-      privileges: {},
+      privileges: null,
       reserved: {
         description: 'something',
         privilege: {
@@ -409,8 +685,36 @@ describe('FeatureRegistry', () => {
     );
   });
 
+  it(`prevents features from specifying catalogue entries that don't exist at the reserved privilege level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+      catalogue: ['foo', 'bar', 'baz'],
+      privileges: null,
+      reserved: {
+        description: 'something',
+        privilege: {
+          catalogue: ['foo', 'bar'],
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+      },
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature test-feature specifies catalogue entries which are not granted to any privileges: baz"`
+    );
+  });
+
   it(`prevents privileges from specifying management sections that don't exist at the root level`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
@@ -431,6 +735,18 @@ describe('FeatureRegistry', () => {
           ui: [],
           app: [],
         },
+        read: {
+          catalogue: ['bar'],
+          management: {
+            elasticsearch: ['hey'],
+          },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
       },
     };
 
@@ -441,8 +757,79 @@ describe('FeatureRegistry', () => {
     );
   });
 
+  it(`prevents features from specifying management sections that don't exist at the privilege level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+      catalogue: ['bar'],
+      management: {
+        kibana: ['hey'],
+        elasticsearch: ['hey', 'there'],
+      },
+      privileges: {
+        all: {
+          catalogue: ['bar'],
+          management: {
+            elasticsearch: ['hey'],
+          },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+        read: {
+          catalogue: ['bar'],
+          management: {
+            elasticsearch: ['hey'],
+          },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'my sub feature',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'cool-sub-feature-privilege',
+                  name: 'cool privilege',
+                  includeIn: 'none',
+                  savedObject: {
+                    all: [],
+                    read: [],
+                  },
+                  ui: [],
+                  management: {
+                    kibana: ['hey'],
+                    elasticsearch: ['hey'],
+                  },
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature test-feature specifies management entries which are not granted to any privileges: elasticsearch.there"`
+    );
+  });
+
   it(`prevents reserved privileges from specifying management entries that don't exist at the root level`, () => {
-    const feature: Feature = {
+    const feature: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
@@ -450,7 +837,7 @@ describe('FeatureRegistry', () => {
       management: {
         kibana: ['hey'],
       },
-      privileges: {},
+      privileges: null,
       reserved: {
         description: 'something',
         privilege: {
@@ -475,18 +862,52 @@ describe('FeatureRegistry', () => {
     );
   });
 
+  it(`prevents features from specifying management entries that don't exist at the reserved privilege level`, () => {
+    const feature: FeatureConfig = {
+      id: 'test-feature',
+      name: 'Test Feature',
+      app: [],
+      catalogue: ['bar'],
+      management: {
+        kibana: ['hey', 'hey-there'],
+      },
+      privileges: null,
+      reserved: {
+        description: 'something',
+        privilege: {
+          catalogue: ['bar'],
+          management: {
+            kibana: ['hey-there'],
+          },
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+          app: [],
+        },
+      },
+    };
+
+    const featureRegistry = new FeatureRegistry();
+
+    expect(() => featureRegistry.register(feature)).toThrowErrorMatchingInlineSnapshot(
+      `"Feature test-feature specifies management entries which are not granted to any privileges: kibana.hey"`
+    );
+  });
+
   it('cannot register feature after getAll has been called', () => {
-    const feature1: Feature = {
+    const feature1: FeatureConfig = {
       id: 'test-feature',
       name: 'Test Feature',
       app: [],
-      privileges: {},
+      privileges: null,
     };
-    const feature2: Feature = {
+    const feature2: FeatureConfig = {
       id: 'test-feature-2',
       name: 'Test Feature 2',
       app: [],
-      privileges: {},
+      privileges: null,
     };
 
     const featureRegistry = new FeatureRegistry();
diff --git a/x-pack/plugins/features/server/feature_registry.ts b/x-pack/plugins/features/server/feature_registry.ts
index 60a229fc58612..73a353cd27471 100644
--- a/x-pack/plugins/features/server/feature_registry.ts
+++ b/x-pack/plugins/features/server/feature_registry.ts
@@ -5,14 +5,14 @@
  */
 
 import { cloneDeep, uniq } from 'lodash';
-import { Feature, FeatureWithAllOrReadPrivileges, FeatureKibanaPrivileges } from '../common';
+import { FeatureConfig, Feature, FeatureKibanaPrivileges } from '../common';
 import { validateFeature } from './feature_schema';
 
 export class FeatureRegistry {
   private locked = false;
-  private features: Record<string, Feature> = {};
+  private features: Record<string, FeatureConfig> = {};
 
-  public register(feature: FeatureWithAllOrReadPrivileges) {
+  public register(feature: FeatureConfig) {
     if (this.locked) {
       throw new Error(
         `Features are locked, can't register new features. Attempt to register ${feature.id} failed.`
@@ -25,20 +25,21 @@ export class FeatureRegistry {
       throw new Error(`Feature with id ${feature.id} is already registered.`);
     }
 
-    const featureCopy: Feature = cloneDeep(feature as Feature);
+    const featureCopy = cloneDeep(feature);
 
-    this.features[feature.id] = applyAutomaticPrivilegeGrants(featureCopy as Feature);
+    this.features[feature.id] = applyAutomaticPrivilegeGrants(featureCopy);
   }
 
   public getAll(): Feature[] {
     this.locked = true;
-    return cloneDeep(Object.values(this.features));
+    return Object.values(this.features).map(featureConfig => new Feature(featureConfig));
   }
 }
 
-function applyAutomaticPrivilegeGrants(feature: Feature): Feature {
-  const { all: allPrivilege, read: readPrivilege } = feature.privileges;
-  const reservedPrivilege = feature.reserved ? feature.reserved.privilege : null;
+function applyAutomaticPrivilegeGrants(feature: FeatureConfig): FeatureConfig {
+  const allPrivilege = feature.privileges?.all;
+  const readPrivilege = feature.privileges?.read;
+  const reservedPrivilege = feature.reserved?.privilege;
 
   applyAutomaticAllPrivilegeGrants(allPrivilege, reservedPrivilege);
   applyAutomaticReadPrivilegeGrants(readPrivilege);
@@ -46,7 +47,9 @@ function applyAutomaticPrivilegeGrants(feature: Feature): Feature {
   return feature;
 }
 
-function applyAutomaticAllPrivilegeGrants(...allPrivileges: Array<FeatureKibanaPrivileges | null>) {
+function applyAutomaticAllPrivilegeGrants(
+  ...allPrivileges: Array<FeatureKibanaPrivileges | undefined>
+) {
   allPrivileges.forEach(allPrivilege => {
     if (allPrivilege) {
       allPrivilege.savedObject.all = uniq([...allPrivilege.savedObject.all, 'telemetry']);
@@ -56,7 +59,7 @@ function applyAutomaticAllPrivilegeGrants(...allPrivileges: Array<FeatureKibanaP
 }
 
 function applyAutomaticReadPrivilegeGrants(
-  ...readPrivileges: Array<FeatureKibanaPrivileges | null>
+  ...readPrivileges: Array<FeatureKibanaPrivileges | undefined>
 ) {
   readPrivileges.forEach(readPrivilege => {
     if (readPrivilege) {
diff --git a/x-pack/plugins/features/server/feature_schema.ts b/x-pack/plugins/features/server/feature_schema.ts
index cc12ea1b78dce..fdeceb30b4e3d 100644
--- a/x-pack/plugins/features/server/feature_schema.ts
+++ b/x-pack/plugins/features/server/feature_schema.ts
@@ -8,13 +8,15 @@ import Joi from 'joi';
 
 import { difference } from 'lodash';
 import { Capabilities as UICapabilities } from '../../../../src/core/server';
-import { FeatureWithAllOrReadPrivileges } from '../common/feature';
+import { FeatureConfig } from '../common/feature';
+import { FeatureKibanaPrivileges } from '.';
 
 // Each feature gets its own property on the UICapabilities object,
 // but that object has a few built-in properties which should not be overwritten.
 const prohibitedFeatureIds: Array<keyof UICapabilities> = ['catalogue', 'management', 'navLinks'];
 
 const featurePrivilegePartRegex = /^[a-zA-Z0-9_-]+$/;
+const subFeaturePrivilegePartRegex = /^[a-zA-Z0-9_-]+$/;
 const managementSectionIdRegex = /^[a-zA-Z0-9_-]+$/;
 export const uiCapabilitiesRegex = /^[a-zA-Z0-9:_-]+$/;
 
@@ -43,12 +45,52 @@ const privilegeSchema = Joi.object({
     .required(),
 });
 
+const subFeaturePrivilegeSchema = Joi.object({
+  id: Joi.string()
+    .regex(subFeaturePrivilegePartRegex)
+    .required(),
+  name: Joi.string().required(),
+  includeIn: Joi.string()
+    .allow('all', 'read', 'none')
+    .required(),
+  management: managementSchema,
+  catalogue: catalogueSchema,
+  api: Joi.array().items(Joi.string()),
+  app: Joi.array().items(Joi.string()),
+  savedObject: Joi.object({
+    all: Joi.array()
+      .items(Joi.string())
+      .required(),
+    read: Joi.array()
+      .items(Joi.string())
+      .required(),
+  }).required(),
+  ui: Joi.array()
+    .items(Joi.string().regex(uiCapabilitiesRegex))
+    .required(),
+});
+
+const subFeatureSchema = Joi.object({
+  name: Joi.string().required(),
+  privilegeGroups: Joi.array().items(
+    Joi.object({
+      groupType: Joi.string()
+        .valid('mutually_exclusive', 'independent')
+        .required(),
+      privileges: Joi.array()
+        .items(subFeaturePrivilegeSchema)
+        .min(1),
+    })
+  ),
+});
+
 const schema = Joi.object({
   id: Joi.string()
     .regex(featurePrivilegePartRegex)
     .invalid(...prohibitedFeatureIds)
     .required(),
   name: Joi.string().required(),
+  order: Joi.number(),
   excludeFromBasePrivileges: Joi.boolean(),
   validLicenses: Joi.array().items(
     Joi.string().valid('basic', 'standard', 'gold', 'platinum', 'enterprise', 'trial')
@@ -64,7 +106,16 @@ const schema = Joi.object({
   privileges: Joi.object({
     all: privilegeSchema,
     read: privilegeSchema,
-  }).required(),
+  })
+    .allow(null)
+    .required(),
+  subFeatures: Joi.when('privileges', {
+    is: null,
+    then: Joi.array()
+      .items(subFeatureSchema)
+      .max(0),
+    otherwise: Joi.array().items(subFeatureSchema),
+  }),
   privilegesTooltip: Joi.string(),
   reserved: Joi.object({
     privilege: privilegeSchema.required(),
@@ -72,7 +123,7 @@ const schema = Joi.object({
   }),
 });
 
-export function validateFeature(feature: FeatureWithAllOrReadPrivileges) {
+export function validateFeature(feature: FeatureConfig) {
   const validateResult = Joi.validate(feature, schema);
   if (validateResult.error) {
     throw validateResult.error;
@@ -80,17 +131,21 @@ export function validateFeature(feature: FeatureWithAllOrReadPrivileges) {
   // the following validation can't be enforced by the Joi schema, since it'd require us looking "up" the object graph for the list of valid value, which they explicitly forbid.
   const { app = [], management = {}, catalogue = [] } = feature;
 
-  const privilegeEntries = [...Object.entries(feature.privileges)];
-  if (feature.reserved) {
-    privilegeEntries.push(['reserved', feature.reserved.privilege]);
-  }
+  const unseenApps = new Set(app);
 
-  privilegeEntries.forEach(([privilegeId, privilegeDefinition]) => {
-    if (!privilegeDefinition) {
-      throw new Error('Privilege definition may not be null or undefined');
-    }
+  const managementSets = Object.entries(management).map(entry => [
+    entry[0],
+    new Set(entry[1]),
+  ]) as Array<[string, Set<string>]>;
+
+  const unseenManagement = new Map<string, Set<string>>(managementSets);
+
+  const unseenCatalogue = new Set(catalogue);
+
+  function validateAppEntry(privilegeId: string, entry: string[] = []) {
+    entry.forEach(privilegeApp => unseenApps.delete(privilegeApp));
 
-    const unknownAppEntries = difference(privilegeDefinition.app || [], app);
+    const unknownAppEntries = difference(entry, app);
     if (unknownAppEntries.length > 0) {
       throw new Error(
         `Feature privilege ${
@@ -98,8 +153,12 @@ export function validateFeature(feature: FeatureWithAllOrReadPrivileges) {
         }.${privilegeId} has unknown app entries: ${unknownAppEntries.join(', ')}`
       );
     }
+  }
+
+  function validateCatalogueEntry(privilegeId: string, entry: string[] = []) {
+    entry.forEach(privilegeCatalogue => unseenCatalogue.delete(privilegeCatalogue));
 
-    const unknownCatalogueEntries = difference(privilegeDefinition.catalogue || [], catalogue);
+    const unknownCatalogueEntries = difference(entry || [], catalogue);
     if (unknownCatalogueEntries.length > 0) {
       throw new Error(
         `Feature privilege ${
@@ -107,27 +166,113 @@ export function validateFeature(feature: FeatureWithAllOrReadPrivileges) {
         }.${privilegeId} has unknown catalogue entries: ${unknownCatalogueEntries.join(', ')}`
       );
     }
+  }
 
-    Object.entries(privilegeDefinition.management || {}).forEach(
-      ([managementSectionId, managementEntry]) => {
-        if (!management[managementSectionId]) {
-          throw new Error(
-            `Feature privilege ${feature.id}.${privilegeId} has unknown management section: ${managementSectionId}`
-          );
-        }
-
-        const unknownSectionEntries = difference(managementEntry, management[managementSectionId]);
-
-        if (unknownSectionEntries.length > 0) {
-          throw new Error(
-            `Feature privilege ${
-              feature.id
-            }.${privilegeId} has unknown management entries for section ${managementSectionId}: ${unknownSectionEntries.join(
-              ', '
-            )}`
-          );
-        }
+  function validateManagementEntry(
+    privilegeId: string,
+    managementEntry: Record<string, string[]> = {}
+  ) {
+    Object.entries(managementEntry).forEach(([managementSectionId, managementSectionEntry]) => {
+      if (unseenManagement.has(managementSectionId)) {
+        managementSectionEntry.forEach(entry => {
+          unseenManagement.get(managementSectionId)!.delete(entry);
+          if (unseenManagement.get(managementSectionId)?.size === 0) {
+            unseenManagement.delete(managementSectionId);
+          }
+        });
       }
-    );
+      if (!management[managementSectionId]) {
+        throw new Error(
+          `Feature privilege ${feature.id}.${privilegeId} has unknown management section: ${managementSectionId}`
+        );
+      }
+
+      const unknownSectionEntries = difference(
+        managementSectionEntry,
+        management[managementSectionId]
+      );
+
+      if (unknownSectionEntries.length > 0) {
+        throw new Error(
+          `Feature privilege ${
+            feature.id
+          }.${privilegeId} has unknown management entries for section ${managementSectionId}: ${unknownSectionEntries.join(
+            ', '
+          )}`
+        );
+      }
+    });
+  }
+
+  const privilegeEntries: Array<[string, FeatureKibanaPrivileges]> = [];
+  if (feature.privileges) {
+    privilegeEntries.push(...Object.entries(feature.privileges));
+  }
+  if (feature.reserved) {
+    privilegeEntries.push(['reserved', feature.reserved.privilege]);
+  }
+
+  if (privilegeEntries.length === 0) {
+    return;
+  }
+
+  privilegeEntries.forEach(([privilegeId, privilegeDefinition]) => {
+    if (!privilegeDefinition) {
+      throw new Error('Privilege definition may not be null or undefined');
+    }
+
+    validateAppEntry(privilegeId, privilegeDefinition.app);
+
+    validateCatalogueEntry(privilegeId, privilegeDefinition.catalogue);
+
+    validateManagementEntry(privilegeId, privilegeDefinition.management);
+  });
+
+  const subFeatureEntries = feature.subFeatures ?? [];
+  subFeatureEntries.forEach(subFeature => {
+    subFeature.privilegeGroups.forEach(subFeaturePrivilegeGroup => {
+      subFeaturePrivilegeGroup.privileges.forEach(subFeaturePrivilege => {
+        validateAppEntry(subFeaturePrivilege.id, subFeaturePrivilege.app);
+        validateCatalogueEntry(subFeaturePrivilege.id, subFeaturePrivilege.catalogue);
+        validateManagementEntry(subFeaturePrivilege.id, subFeaturePrivilege.management);
+      });
+    });
   });
+
+  if (unseenApps.size > 0) {
+    throw new Error(
+      `Feature ${
+        feature.id
+      } specifies app entries which are not granted to any privileges: ${Array.from(
+        unseenApps.values()
+      ).join(',')}`
+    );
+  }
+
+  if (unseenCatalogue.size > 0) {
+    throw new Error(
+      `Feature ${
+        feature.id
+      } specifies catalogue entries which are not granted to any privileges: ${Array.from(
+        unseenCatalogue.values()
+      ).join(',')}`
+    );
+  }
+
+  if (unseenManagement.size > 0) {
+    const ungrantedManagement = Array.from(unseenManagement.entries()).reduce((acc, entry) => {
+      const values = Array.from(entry[1].values()).map(
+        managementPage => `${entry[0]}.${managementPage}`
+      );
+      return [...acc, ...values];
+    }, [] as string[]);
+
+    throw new Error(
+      `Feature ${
+        feature.id
+      } specifies management entries which are not granted to any privileges: ${ungrantedManagement.join(
+        ','
+      )}`
+    );
+  }
 }
diff --git a/x-pack/plugins/features/server/index.ts b/x-pack/plugins/features/server/index.ts
index 48ef97a494f7e..48a350ae8f8fd 100644
--- a/x-pack/plugins/features/server/index.ts
+++ b/x-pack/plugins/features/server/index.ts
@@ -13,7 +13,7 @@ import { Plugin } from './plugin';
 // run-time contracts.
 export { uiCapabilitiesRegex } from './feature_schema';
 
-export { Feature, FeatureWithAllOrReadPrivileges, FeatureKibanaPrivileges } from '../common';
+export { Feature, FeatureConfig, FeatureKibanaPrivileges } from '../common';
 export { PluginSetupContract, PluginStartContract } from './plugin';
 
 export const plugin = (initializerContext: PluginInitializerContext) =>
diff --git a/x-pack/plugins/features/server/oss_features.test.ts b/x-pack/plugins/features/server/oss_features.test.ts
index 987af08fe7cda..72beff02173d2 100644
--- a/x-pack/plugins/features/server/oss_features.test.ts
+++ b/x-pack/plugins/features/server/oss_features.test.ts
@@ -5,6 +5,8 @@
  */
 
 import { buildOSSFeatures } from './oss_features';
+import { featurePrivilegeIterator } from '../../security/server/authorization';
+import { Feature } from '.';
 
 describe('buildOSSFeatures', () => {
   it('returns features including timelion', () => {
@@ -39,4 +41,17 @@ Array [
 ]
 `);
   });
+
+  const features = buildOSSFeatures({ savedObjectTypes: ['foo', 'bar'], includeTimelion: true });
+  features.forEach(featureConfig => {
+    it(`returns the ${featureConfig.id} feature augmented with appropriate sub feature privileges`, () => {
+      const privileges = [];
+      for (const featurePrivilege of featurePrivilegeIterator(new Feature(featureConfig), {
+        augmentWithSubFeaturePrivileges: true,
+      })) {
+        privileges.push(featurePrivilege);
+      }
+      expect(privileges).toMatchSnapshot();
+    });
+  });
 });
diff --git a/x-pack/plugins/features/server/oss_features.ts b/x-pack/plugins/features/server/oss_features.ts
index b48963ebb8139..3e8ce37fd1578 100644
--- a/x-pack/plugins/features/server/oss_features.ts
+++ b/x-pack/plugins/features/server/oss_features.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { i18n } from '@kbn/i18n';
-import { Feature } from '../common/feature';
+import { FeatureConfig } from '../common/feature';
 
 export interface BuildOSSFeaturesParams {
   savedObjectTypes: string[];
@@ -18,19 +18,24 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
       name: i18n.translate('xpack.features.discoverFeatureName', {
         defaultMessage: 'Discover',
       }),
+      order: 100,
       icon: 'discoverApp',
       navLinkId: 'kibana:discover',
       app: ['kibana'],
       catalogue: ['discover'],
       privileges: {
         all: {
+          app: ['kibana'],
+          catalogue: ['discover'],
           savedObject: {
-            all: ['search', 'url', 'query'],
+            all: ['search', 'query'],
             read: ['index-pattern'],
           },
-          ui: ['show', 'createShortUrl', 'save', 'saveQuery'],
+          ui: ['show', 'save', 'saveQuery'],
         },
         read: {
+          app: ['kibana'],
+          catalogue: ['discover'],
           savedObject: {
             all: [],
             read: ['index-pattern', 'search', 'query'],
@@ -38,25 +43,59 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
           ui: ['show'],
         },
       },
+      subFeatures: [
+        {
+          name: i18n.translate('xpack.features.ossFeatures.discoverShortUrlSubFeatureName', {
+            defaultMessage: 'Short URLs',
+          }),
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'url_create',
+                  name: i18n.translate(
+                    'xpack.features.ossFeatures.discoverCreateShortUrlPrivilegeName',
+                    {
+                      defaultMessage: 'Create Short URLs',
+                    }
+                  ),
+                  includeIn: 'all',
+                  savedObject: {
+                    all: ['url'],
+                    read: [],
+                  },
+                  ui: ['createShortUrl'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
     },
     {
       id: 'visualize',
       name: i18n.translate('xpack.features.visualizeFeatureName', {
         defaultMessage: 'Visualize',
       }),
+      order: 200,
       icon: 'visualizeApp',
       navLinkId: 'kibana:visualize',
       app: ['kibana', 'lens'],
       catalogue: ['visualize'],
       privileges: {
         all: {
+          app: ['kibana', 'lens'],
+          catalogue: ['visualize'],
           savedObject: {
-            all: ['visualization', 'url', 'query', 'lens'],
+            all: ['visualization', 'query', 'lens'],
             read: ['index-pattern', 'search'],
           },
-          ui: ['show', 'createShortUrl', 'delete', 'save', 'saveQuery'],
+          ui: ['show', 'delete', 'save', 'saveQuery'],
         },
         read: {
+          app: ['kibana', 'lens'],
+          catalogue: ['visualize'],
           savedObject: {
             all: [],
             read: ['index-pattern', 'search', 'visualization', 'query', 'lens'],
@@ -64,18 +103,50 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
           ui: ['show'],
         },
       },
+      subFeatures: [
+        {
+          name: i18n.translate('xpack.features.ossFeatures.visualizeShortUrlSubFeatureName', {
+            defaultMessage: 'Short URLs',
+          }),
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'url_create',
+                  name: i18n.translate(
+                    'xpack.features.ossFeatures.visualizeCreateShortUrlPrivilegeName',
+                    {
+                      defaultMessage: 'Create Short URLs',
+                    }
+                  ),
+                  includeIn: 'all',
+                  savedObject: {
+                    all: ['url'],
+                    read: [],
+                  },
+                  ui: ['createShortUrl'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
     },
     {
       id: 'dashboard',
       name: i18n.translate('xpack.features.dashboardFeatureName', {
         defaultMessage: 'Dashboard',
       }),
+      order: 300,
       icon: 'dashboardApp',
       navLinkId: 'kibana:dashboard',
       app: ['kibana'],
       catalogue: ['dashboard'],
       privileges: {
         all: {
+          app: ['kibana'],
+          catalogue: ['dashboard'],
           savedObject: {
             all: ['dashboard', 'url', 'query'],
             read: [
@@ -91,6 +162,8 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
           ui: ['createNew', 'show', 'showWriteControls', 'saveQuery'],
         },
         read: {
+          app: ['kibana'],
+          catalogue: ['dashboard'],
           savedObject: {
             all: [],
             read: [
@@ -107,18 +180,50 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
           ui: ['show'],
         },
       },
+      subFeatures: [
+        {
+          name: i18n.translate('xpack.features.ossFeatures.dashboardShortUrlSubFeatureName', {
+            defaultMessage: 'Short URLs',
+          }),
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'url_create',
+                  name: i18n.translate(
+                    'xpack.features.ossFeatures.dashboardCreateShortUrlPrivilegeName',
+                    {
+                      defaultMessage: 'Create Short URLs',
+                    }
+                  ),
+                  includeIn: 'all',
+                  savedObject: {
+                    all: ['url'],
+                    read: [],
+                  },
+                  ui: ['createShortUrl'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
     },
     {
       id: 'dev_tools',
       name: i18n.translate('xpack.features.devToolsFeatureName', {
         defaultMessage: 'Dev Tools',
       }),
+      order: 1300,
       icon: 'devToolsApp',
       navLinkId: 'kibana:dev_tools',
       app: ['kibana'],
       catalogue: ['console', 'searchprofiler', 'grokdebugger'],
       privileges: {
         all: {
+          app: ['kibana'],
+          catalogue: ['console', 'searchprofiler', 'grokdebugger'],
           api: ['console'],
           savedObject: {
             all: [],
@@ -127,6 +232,8 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
           ui: ['show', 'save'],
         },
         read: {
+          app: ['kibana'],
+          catalogue: ['console', 'searchprofiler', 'grokdebugger'],
           api: ['console'],
           savedObject: {
             all: [],
@@ -145,6 +252,7 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
       name: i18n.translate('xpack.features.advancedSettingsFeatureName', {
         defaultMessage: 'Advanced Settings',
       }),
+      order: 1500,
       icon: 'advancedSettingsApp',
       app: ['kibana'],
       catalogue: ['advanced_settings'],
@@ -153,6 +261,11 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
       },
       privileges: {
         all: {
+          app: ['kibana'],
+          catalogue: ['advanced_settings'],
+          management: {
+            kibana: ['settings'],
+          },
           savedObject: {
             all: ['config'],
             read: [],
@@ -160,6 +273,11 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
           ui: ['save'],
         },
         read: {
+          app: ['kibana'],
+          catalogue: ['advanced_settings'],
+          management: {
+            kibana: ['settings'],
+          },
           savedObject: {
             all: [],
             read: [],
@@ -173,6 +291,7 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
       name: i18n.translate('xpack.features.indexPatternFeatureName', {
         defaultMessage: 'Index Pattern Management',
       }),
+      order: 1600,
       icon: 'indexPatternApp',
       app: ['kibana'],
       catalogue: ['index_patterns'],
@@ -181,6 +300,11 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
       },
       privileges: {
         all: {
+          app: ['kibana'],
+          catalogue: ['index_patterns'],
+          management: {
+            kibana: ['index_patterns'],
+          },
           savedObject: {
             all: ['index-pattern'],
             read: [],
@@ -188,6 +312,11 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
           ui: ['save'],
         },
         read: {
+          app: ['kibana'],
+          catalogue: ['index_patterns'],
+          management: {
+            kibana: ['index_patterns'],
+          },
           savedObject: {
             all: [],
             read: ['index-pattern'],
@@ -201,6 +330,7 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
       name: i18n.translate('xpack.features.savedObjectsManagementFeatureName', {
         defaultMessage: 'Saved Objects Management',
       }),
+      order: 1700,
       icon: 'savedObjectsApp',
       app: ['kibana'],
       catalogue: ['saved_objects'],
@@ -209,6 +339,11 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
       },
       privileges: {
         all: {
+          app: ['kibana'],
+          catalogue: ['saved_objects'],
+          management: {
+            kibana: ['objects'],
+          },
           api: ['copySavedObjectsToSpaces'],
           savedObject: {
             all: [...savedObjectTypes],
@@ -217,6 +352,11 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
           ui: ['read', 'edit', 'delete', 'copyIntoSpace'],
         },
         read: {
+          app: ['kibana'],
+          catalogue: ['saved_objects'],
+          management: {
+            kibana: ['objects'],
+          },
           api: ['copySavedObjectsToSpaces'],
           savedObject: {
             all: [],
@@ -227,18 +367,21 @@ export const buildOSSFeatures = ({ savedObjectTypes, includeTimelion }: BuildOSS
       },
     },
     ...(includeTimelion ? [timelionFeature] : []),
-  ];
+  ] as FeatureConfig[];
 };
 
-const timelionFeature: Feature = {
+const timelionFeature: FeatureConfig = {
   id: 'timelion',
   name: 'Timelion',
+  order: 350,
   icon: 'timelionApp',
   navLinkId: 'timelion',
   app: ['timelion', 'kibana'],
   catalogue: ['timelion'],
   privileges: {
     all: {
+      app: ['timelion', 'kibana'],
+      catalogue: ['timelion'],
       savedObject: {
         all: ['timelion-sheet'],
         read: ['index-pattern'],
@@ -246,6 +389,8 @@ const timelionFeature: Feature = {
       ui: ['save'],
     },
     read: {
+      app: ['timelion', 'kibana'],
+      catalogue: ['timelion'],
       savedObject: {
         all: [],
         read: ['index-pattern', 'timelion-sheet'],
diff --git a/x-pack/plugins/features/server/plugin.ts b/x-pack/plugins/features/server/plugin.ts
index e77fa218c0681..cebf67243fb28 100644
--- a/x-pack/plugins/features/server/plugin.ts
+++ b/x-pack/plugins/features/server/plugin.ts
@@ -15,7 +15,7 @@ import { deepFreeze } from '../../../../src/core/utils';
 import { XPackInfo } from '../../../legacy/plugins/xpack_main/server/lib/xpack_info';
 import { PluginSetupContract as TimelionSetupContract } from '../../../../src/plugins/timelion/server';
 import { FeatureRegistry } from './feature_registry';
-import { Feature, FeatureWithAllOrReadPrivileges } from '../common/feature';
+import { Feature, FeatureConfig } from '../common/feature';
 import { uiCapabilitiesForFeatures } from './ui_capabilities_for_features';
 import { buildOSSFeatures } from './oss_features';
 import { defineRoutes } from './routes';
@@ -24,7 +24,7 @@ import { defineRoutes } from './routes';
  * Describes public Features plugin contract returned at the `setup` stage.
  */
 export interface PluginSetupContract {
-  registerFeature(feature: FeatureWithAllOrReadPrivileges): void;
+  registerFeature(feature: FeatureConfig): void;
   getFeatures(): Feature[];
   getFeaturesUICapabilities(): UICapabilities;
   registerLegacyAPI: (legacyAPI: LegacyAPI) => void;
diff --git a/x-pack/plugins/features/server/routes/index.test.ts b/x-pack/plugins/features/server/routes/index.test.ts
index b0f8417b7175d..c43e2a5195fe7 100644
--- a/x-pack/plugins/features/server/routes/index.test.ts
+++ b/x-pack/plugins/features/server/routes/index.test.ts
@@ -10,6 +10,7 @@ import { defineRoutes } from './index';
 import { httpServerMock, httpServiceMock } from '../../../../../src/core/server/mocks';
 import { XPackInfoLicense } from '../../../../legacy/plugins/xpack_main/server/lib/xpack_info_license';
 import { RequestHandler } from '../../../../../src/core/server';
+import { FeatureConfig } from '../../common';
 
 let currentLicenseLevel: string = 'gold';
 
@@ -21,7 +22,23 @@ describe('GET /api/features', () => {
       id: 'feature_1',
       name: 'Feature 1',
       app: [],
-      privileges: {},
+      privileges: null,
+    });
+
+    featureRegistry.register({
+      id: 'feature_2',
+      name: 'Feature 2',
+      order: 2,
+      app: [],
+      privileges: null,
+    });
+
+    featureRegistry.register({
+      id: 'feature_3',
+      name: 'Feature 2',
+      order: 1,
+      app: [],
+      privileges: null,
     });
 
     featureRegistry.register({
@@ -29,7 +46,7 @@ describe('GET /api/features', () => {
       name: 'Licensed Feature',
       app: ['bar-app'],
       validLicenses: ['gold'],
-      privileges: {},
+      privileges: null,
     });
 
     const routerMock = httpServiceMock.createRouter();
@@ -51,37 +68,33 @@ describe('GET /api/features', () => {
     routeHandler = routerMock.get.mock.calls[0][1];
   });
 
-  it('returns a list of available features', async () => {
+  it('returns a list of available features, sorted by their configured order', async () => {
     const mockResponse = httpServerMock.createResponseFactory();
     routeHandler(undefined as any, { query: {} } as any, mockResponse);
 
-    expect(mockResponse.ok.mock.calls).toMatchInlineSnapshot(`
-            Array [
-              Array [
-                Object {
-                  "body": Array [
-                    Object {
-                      "app": Array [],
-                      "id": "feature_1",
-                      "name": "Feature 1",
-                      "privileges": Object {},
-                    },
-                    Object {
-                      "app": Array [
-                        "bar-app",
-                      ],
-                      "id": "licensed_feature",
-                      "name": "Licensed Feature",
-                      "privileges": Object {},
-                      "validLicenses": Array [
-                        "gold",
-                      ],
-                    },
-                  ],
-                },
-              ],
-            ]
-        `);
+    expect(mockResponse.ok).toHaveBeenCalledTimes(1);
+    const [call] = mockResponse.ok.mock.calls;
+    const body = call[0]!.body as FeatureConfig[];
+
+    const features = body.map(feature => ({ id: feature.id, order: feature.order }));
+    expect(features).toEqual([
+      {
+        id: 'feature_3',
+        order: 1,
+      },
+      {
+        id: 'feature_2',
+        order: 2,
+      },
+      {
+        id: 'feature_1',
+        order: undefined,
+      },
+      {
+        id: 'licensed_feature',
+        order: undefined,
+      },
+    ]);
   });
 
   it(`by default does not return features that arent allowed by current license`, async () => {
@@ -90,22 +103,26 @@ describe('GET /api/features', () => {
     const mockResponse = httpServerMock.createResponseFactory();
     routeHandler(undefined as any, { query: {} } as any, mockResponse);
 
-    expect(mockResponse.ok.mock.calls).toMatchInlineSnapshot(`
-      Array [
-        Array [
-          Object {
-            "body": Array [
-              Object {
-                "app": Array [],
-                "id": "feature_1",
-                "name": "Feature 1",
-                "privileges": Object {},
-              },
-            ],
-          },
-        ],
-      ]
-    `);
+    expect(mockResponse.ok).toHaveBeenCalledTimes(1);
+    const [call] = mockResponse.ok.mock.calls;
+    const body = call[0]!.body as FeatureConfig[];
+
+    const features = body.map(feature => ({ id: feature.id, order: feature.order }));
+
+    expect(features).toEqual([
+      {
+        id: 'feature_3',
+        order: 1,
+      },
+      {
+        id: 'feature_2',
+        order: 2,
+      },
+      {
+        id: 'feature_1',
+        order: undefined,
+      },
+    ]);
   });
 
   it(`ignoreValidLicenses=false does not return features that arent allowed by current license`, async () => {
@@ -114,22 +131,26 @@ describe('GET /api/features', () => {
     const mockResponse = httpServerMock.createResponseFactory();
     routeHandler(undefined as any, { query: { ignoreValidLicenses: false } } as any, mockResponse);
 
-    expect(mockResponse.ok.mock.calls).toMatchInlineSnapshot(`
-      Array [
-        Array [
-          Object {
-            "body": Array [
-              Object {
-                "app": Array [],
-                "id": "feature_1",
-                "name": "Feature 1",
-                "privileges": Object {},
-              },
-            ],
-          },
-        ],
-      ]
-    `);
+    expect(mockResponse.ok).toHaveBeenCalledTimes(1);
+    const [call] = mockResponse.ok.mock.calls;
+    const body = call[0]!.body as FeatureConfig[];
+
+    const features = body.map(feature => ({ id: feature.id, order: feature.order }));
+
+    expect(features).toEqual([
+      {
+        id: 'feature_3',
+        order: 1,
+      },
+      {
+        id: 'feature_2',
+        order: 2,
+      },
+      {
+        id: 'feature_1',
+        order: undefined,
+      },
+    ]);
   });
 
   it(`ignoreValidLicenses=true returns features that arent allowed by current license`, async () => {
@@ -138,32 +159,29 @@ describe('GET /api/features', () => {
     const mockResponse = httpServerMock.createResponseFactory();
     routeHandler(undefined as any, { query: { ignoreValidLicenses: true } } as any, mockResponse);
 
-    expect(mockResponse.ok.mock.calls).toMatchInlineSnapshot(`
-      Array [
-        Array [
-          Object {
-            "body": Array [
-              Object {
-                "app": Array [],
-                "id": "feature_1",
-                "name": "Feature 1",
-                "privileges": Object {},
-              },
-              Object {
-                "app": Array [
-                  "bar-app",
-                ],
-                "id": "licensed_feature",
-                "name": "Licensed Feature",
-                "privileges": Object {},
-                "validLicenses": Array [
-                  "gold",
-                ],
-              },
-            ],
-          },
-        ],
-      ]
-    `);
+    expect(mockResponse.ok).toHaveBeenCalledTimes(1);
+    const [call] = mockResponse.ok.mock.calls;
+    const body = call[0]!.body as FeatureConfig[];
+
+    const features = body.map(feature => ({ id: feature.id, order: feature.order }));
+
+    expect(features).toEqual([
+      {
+        id: 'feature_3',
+        order: 1,
+      },
+      {
+        id: 'feature_2',
+        order: 2,
+      },
+      {
+        id: 'feature_1',
+        order: undefined,
+      },
+      {
+        id: 'licensed_feature',
+        order: undefined,
+      },
+    ]);
   });
 });
diff --git a/x-pack/plugins/features/server/routes/index.ts b/x-pack/plugins/features/server/routes/index.ts
index cf4d61ccac88b..428500c3daa88 100644
--- a/x-pack/plugins/features/server/routes/index.ts
+++ b/x-pack/plugins/features/server/routes/index.ts
@@ -31,13 +31,19 @@ export function defineRoutes({ router, featureRegistry, getLegacyAPI }: RouteDef
       const allFeatures = featureRegistry.getAll();
 
       return response.ok({
-        body: allFeatures.filter(
-          feature =>
-            request.query.ignoreValidLicenses ||
-            !feature.validLicenses ||
-            !feature.validLicenses.length ||
-            getLegacyAPI().xpackInfo.license.isOneOf(feature.validLicenses)
-        ),
+        body: allFeatures
+          .filter(
+            feature =>
+              request.query.ignoreValidLicenses ||
+              !feature.validLicenses ||
+              !feature.validLicenses.length ||
+              getLegacyAPI().xpackInfo.license.isOneOf(feature.validLicenses)
+          )
+          .sort(
+            (f1, f2) =>
+              (f1.order ?? Number.MAX_SAFE_INTEGER) - (f2.order ?? Number.MAX_SAFE_INTEGER)
+          )
+          .map(feature => feature.toRaw()),
       });
     }
   );
diff --git a/x-pack/plugins/features/server/ui_capabilities_for_features.test.ts b/x-pack/plugins/features/server/ui_capabilities_for_features.test.ts
index bb2cd82891a15..73c399878b17b 100644
--- a/x-pack/plugins/features/server/ui_capabilities_for_features.test.ts
+++ b/x-pack/plugins/features/server/ui_capabilities_for_features.test.ts
@@ -5,17 +5,31 @@
  */
 
 import { uiCapabilitiesForFeatures } from './ui_capabilities_for_features';
+import { Feature } from '.';
+import { SubFeaturePrivilegeGroupConfig } from '../common';
 
-function createFeaturePrivilege(key: string, capabilities: string[] = []) {
+function createFeaturePrivilege(capabilities: string[] = []) {
   return {
-    [key]: {
-      savedObject: {
-        all: [],
-        read: [],
-      },
-      app: [],
-      ui: [...capabilities],
+    savedObject: {
+      all: [],
+      read: [],
+    },
+    app: [],
+    ui: [...capabilities],
+  };
+}
+
+function createSubFeaturePrivilege(privilegeId: string, capabilities: string[] = []) {
+  return {
+    id: privilegeId,
+    name: `sub-feature privilege ${privilegeId}`,
+    includeIn: 'none',
+    savedObject: {
+      all: [],
+      read: [],
     },
+    app: [],
+    ui: [...capabilities],
   };
 }
 
@@ -27,14 +41,15 @@ describe('populateUICapabilities', () => {
   it('handles features with no registered capabilities', () => {
     expect(
       uiCapabilitiesForFeatures([
-        {
+        new Feature({
           id: 'newFeature',
           name: 'my new feature',
           app: ['bar-app'],
           privileges: {
-            ...createFeaturePrivilege('all'),
+            all: createFeaturePrivilege(),
+            read: createFeaturePrivilege(),
           },
-        },
+        }),
       ])
     ).toEqual({
       catalogue: {},
@@ -45,15 +60,16 @@ describe('populateUICapabilities', () => {
   it('augments the original uiCapabilities with registered feature capabilities', () => {
     expect(
       uiCapabilitiesForFeatures([
-        {
+        new Feature({
           id: 'newFeature',
           name: 'my new feature',
           navLinkId: 'newFeatureNavLink',
           app: ['bar-app'],
           privileges: {
-            ...createFeaturePrivilege('all', ['capability1', 'capability2']),
+            all: createFeaturePrivilege(['capability1', 'capability2']),
+            read: createFeaturePrivilege(),
           },
-        },
+        }),
       ])
     ).toEqual({
       catalogue: {},
@@ -67,18 +83,17 @@ describe('populateUICapabilities', () => {
   it('combines catalogue entries from multiple features', () => {
     expect(
       uiCapabilitiesForFeatures([
-        {
+        new Feature({
           id: 'newFeature',
           name: 'my new feature',
           navLinkId: 'newFeatureNavLink',
           app: ['bar-app'],
           catalogue: ['anotherFooEntry', 'anotherBarEntry'],
           privileges: {
-            ...createFeaturePrivilege('foo', ['capability1', 'capability2']),
-            ...createFeaturePrivilege('bar', ['capability3', 'capability4']),
-            ...createFeaturePrivilege('baz'),
+            all: createFeaturePrivilege(['capability1', 'capability2']),
+            read: createFeaturePrivilege(['capability3', 'capability4']),
           },
-        },
+        }),
       ])
     ).toEqual({
       catalogue: {
@@ -97,17 +112,75 @@ describe('populateUICapabilities', () => {
   it(`merges capabilities from all feature privileges`, () => {
     expect(
       uiCapabilitiesForFeatures([
-        {
+        new Feature({
+          id: 'newFeature',
+          name: 'my new feature',
+          navLinkId: 'newFeatureNavLink',
+          app: ['bar-app'],
+          privileges: {
+            all: createFeaturePrivilege(['capability1', 'capability2']),
+            read: createFeaturePrivilege(['capability3', 'capability4', 'capability5']),
+          },
+        }),
+      ])
+    ).toEqual({
+      catalogue: {},
+      newFeature: {
+        capability1: true,
+        capability2: true,
+        capability3: true,
+        capability4: true,
+        capability5: true,
+      },
+    });
+  });
+
+  it(`supports merging features with sub privileges`, () => {
+    expect(
+      uiCapabilitiesForFeatures([
+        new Feature({
           id: 'newFeature',
           name: 'my new feature',
           navLinkId: 'newFeatureNavLink',
           app: ['bar-app'],
           privileges: {
-            ...createFeaturePrivilege('foo', ['capability1', 'capability2']),
-            ...createFeaturePrivilege('bar', ['capability3', 'capability4']),
-            ...createFeaturePrivilege('baz', ['capability1', 'capability5']),
+            all: createFeaturePrivilege(['capability1', 'capability2']),
+            read: createFeaturePrivilege(['capability3', 'capability4']),
           },
-        },
+          subFeatures: [
+            {
+              name: 'sub-feature-1',
+              privilegeGroups: [
+                {
+                  groupType: 'independent',
+                  privileges: [
+                    createSubFeaturePrivilege('privilege-1', ['capability5']),
+                    createSubFeaturePrivilege('privilege-2', ['capability6']),
+                  ],
+                } as SubFeaturePrivilegeGroupConfig,
+                {
+                  groupType: 'mutually_exclusive',
+                  privileges: [
+                    createSubFeaturePrivilege('privilege-3', ['capability7']),
+                    createSubFeaturePrivilege('privilege-4', ['capability8']),
+                  ],
+                } as SubFeaturePrivilegeGroupConfig,
+              ],
+            },
+            {
+              name: 'sub-feature-2',
+              privilegeGroups: [
+                {
+                  name: 'Group Name',
+                  groupType: 'independent',
+                  privileges: [
+                    createSubFeaturePrivilege('privilege-5', ['capability9', 'capability10']),
+                  ],
+                } as SubFeaturePrivilegeGroupConfig,
+              ],
+            },
+          ],
+        }),
       ])
     ).toEqual({
       catalogue: {},
@@ -117,6 +190,11 @@ describe('populateUICapabilities', () => {
         capability3: true,
         capability4: true,
         capability5: true,
+        capability6: true,
+        capability7: true,
+        capability8: true,
+        capability9: true,
+        capability10: true,
       },
     });
   });
@@ -124,41 +202,49 @@ describe('populateUICapabilities', () => {
   it('supports merging multiple features with multiple privileges each', () => {
     expect(
       uiCapabilitiesForFeatures([
-        {
+        new Feature({
           id: 'newFeature',
           name: 'my new feature',
           navLinkId: 'newFeatureNavLink',
           app: ['bar-app'],
           privileges: {
-            ...createFeaturePrivilege('foo', ['capability1', 'capability2']),
-            ...createFeaturePrivilege('bar', ['capability3', 'capability4']),
-            ...createFeaturePrivilege('baz', ['capability1', 'capability5']),
+            all: createFeaturePrivilege(['capability1', 'capability2']),
+            read: createFeaturePrivilege(['capability3', 'capability4']),
           },
-        },
-        {
+        }),
+        new Feature({
           id: 'anotherNewFeature',
           name: 'another new feature',
           app: ['bar-app'],
           privileges: {
-            ...createFeaturePrivilege('foo', ['capability1', 'capability2']),
-            ...createFeaturePrivilege('bar', ['capability3', 'capability4']),
+            all: createFeaturePrivilege(['capability1', 'capability2']),
+            read: createFeaturePrivilege(['capability3', 'capability4']),
           },
-        },
-        {
+        }),
+        new Feature({
           id: 'yetAnotherNewFeature',
           name: 'yet another new feature',
           navLinkId: 'yetAnotherNavLink',
           app: ['bar-app'],
           privileges: {
-            ...createFeaturePrivilege('all', ['capability1', 'capability2']),
-            ...createFeaturePrivilege('read', []),
-            ...createFeaturePrivilege('somethingInBetween', [
-              'something1',
-              'something2',
-              'something3',
-            ]),
+            all: createFeaturePrivilege(['capability1', 'capability2']),
+            read: createFeaturePrivilege(['something1', 'something2', 'something3']),
           },
-        },
+          subFeatures: [
+            {
+              name: 'sub-feature-1',
+              privilegeGroups: [
+                {
+                  groupType: 'independent',
+                  privileges: [
+                    createSubFeaturePrivilege('privilege-1', ['capability3']),
+                    createSubFeaturePrivilege('privilege-2', ['capability4']),
+                  ],
+                } as SubFeaturePrivilegeGroupConfig,
+              ],
+            },
+          ],
+        }),
       ])
     ).toEqual({
       anotherNewFeature: {
@@ -173,11 +259,12 @@ describe('populateUICapabilities', () => {
         capability2: true,
         capability3: true,
         capability4: true,
-        capability5: true,
       },
       yetAnotherNewFeature: {
         capability1: true,
         capability2: true,
+        capability3: true,
+        capability4: true,
         something1: true,
         something2: true,
         something3: true,
diff --git a/x-pack/plugins/features/server/ui_capabilities_for_features.ts b/x-pack/plugins/features/server/ui_capabilities_for_features.ts
index a13afa854de52..d3d3230822749 100644
--- a/x-pack/plugins/features/server/ui_capabilities_for_features.ts
+++ b/x-pack/plugins/features/server/ui_capabilities_for_features.ts
@@ -39,7 +39,14 @@ function getCapabilitiesFromFeature(feature: Feature): FeatureCapabilities {
     };
   }
 
-  Object.values(feature.privileges).forEach(privilege => {
+  const featurePrivileges = Object.values(feature.privileges ?? {});
+  if (feature.subFeatures) {
+    featurePrivileges.push(
+      ...feature.subFeatures.map(sf => sf.privilegeGroups.map(pg => pg.privileges)).flat(2)
+    );
+  }
+
+  featurePrivileges.forEach(privilege => {
     UIFeatureCapabilities[feature.id] = {
       ...UIFeatureCapabilities[feature.id],
       ...privilege.ui.reduce(
diff --git a/x-pack/plugins/graph/public/app.js b/x-pack/plugins/graph/public/app.js
index 72dddc2b9f813..53175d18e629f 100644
--- a/x-pack/plugins/graph/public/app.js
+++ b/x-pack/plugins/graph/public/app.js
@@ -31,6 +31,11 @@ import { asAngularSyncedObservable } from './helpers/as_observable';
 import { colorChoices } from './helpers/style_choices';
 import { createGraphStore, datasourceSelector, hasFieldsSelector } from './state_management';
 import { formatHttpError } from './helpers/format_http_error';
+import {
+  findSavedWorkspace,
+  getSavedWorkspace,
+  deleteSavedWorkspace,
+} from './helpers/saved_workspace_utils';
 
 export function initGraphApp(angularModule, deps) {
   const {
@@ -42,7 +47,6 @@ export function initGraphApp(angularModule, deps) {
     getBasePath,
     data,
     config,
-    savedWorkspaceLoader,
     capabilities,
     coreStart,
     storage,
@@ -112,15 +116,21 @@ export function initGraphApp(angularModule, deps) {
             $location.url(getNewPath());
           };
           $scope.find = search => {
-            return savedWorkspaceLoader.find(search, $scope.listingLimit);
+            return findSavedWorkspace(
+              { savedObjectsClient, basePath: coreStart.http.basePath },
+              search,
+              $scope.listingLimit
+            );
           };
           $scope.editItem = workspace => {
             $location.url(getEditPath(workspace));
           };
           $scope.getViewUrl = workspace => getEditUrl(addBasePath, workspace);
-          $scope.delete = workspaces => {
-            return savedWorkspaceLoader.delete(workspaces.map(({ id }) => id));
-          };
+          $scope.delete = workspaces =>
+            deleteSavedWorkspace(
+              savedObjectsClient,
+              workspaces.map(({ id }) => id)
+            );
           $scope.capabilities = capabilities;
           $scope.initialFilter = $location.search().filter || '';
           $scope.coreStart = coreStart;
@@ -133,7 +143,7 @@ export function initGraphApp(angularModule, deps) {
         resolve: {
           savedWorkspace: function($rootScope, $route, $location) {
             return $route.current.params.id
-              ? savedWorkspaceLoader.get($route.current.params.id).catch(function(e) {
+              ? getSavedWorkspace(savedObjectsClient, $route.current.params.id).catch(function(e) {
                   toastNotifications.addError(e, {
                     title: i18n.translate('xpack.graph.missingWorkspaceErrorMessage', {
                       defaultMessage: "Couldn't load graph with ID",
@@ -146,7 +156,7 @@ export function initGraphApp(angularModule, deps) {
                   // return promise that never returns to prevent the controller from loading
                   return new Promise();
                 })
-              : savedWorkspaceLoader.get();
+              : getSavedWorkspace(savedObjectsClient);
           },
           indexPatterns: function() {
             return savedObjectsClient
@@ -283,6 +293,8 @@ export function initGraphApp(angularModule, deps) {
       },
       notifications: coreStart.notifications,
       http: coreStart.http,
+      overlays: coreStart.overlays,
+      savedObjectsClient,
       showSaveModal,
       setWorkspaceInitialized: () => {
         $scope.workspaceInitialized = true;
diff --git a/x-pack/plugins/graph/public/application.ts b/x-pack/plugins/graph/public/application.ts
index 4f7bdd69db356..f804265f1f5ab 100644
--- a/x-pack/plugins/graph/public/application.ts
+++ b/x-pack/plugins/graph/public/application.ts
@@ -29,7 +29,6 @@ import { Plugin as DataPlugin, IndexPatternsContract } from '../../../../src/plu
 import { LicensingPluginSetup } from '../../licensing/public';
 import { checkLicense } from '../common/check_license';
 import { NavigationPublicPluginStart as NavigationStart } from '../../../../src/plugins/navigation/public';
-import { createSavedWorkspacesLoader } from './services/persistence/saved_workspace_loader';
 import { Storage } from '../../../../src/plugins/kibana_utils/public';
 import {
   addAppRedirectMessageToUrl,
@@ -87,15 +86,7 @@ export const renderApp = ({ appBasePath, element, ...deps }: GraphDependencies)
     }
   });
 
-  const savedWorkspaceLoader = createSavedWorkspacesLoader({
-    chrome: deps.coreStart.chrome,
-    indexPatterns: deps.data.indexPatterns,
-    overlays: deps.coreStart.overlays,
-    savedObjectsClient: deps.coreStart.savedObjects.client,
-    basePath: deps.coreStart.http.basePath,
-  });
-
-  initGraphApp(graphAngularModule, { ...deps, savedWorkspaceLoader });
+  initGraphApp(graphAngularModule, deps);
   const $injector = mountGraphApp(appBasePath, element);
   return () => {
     licenseSubscription.unsubscribe();
diff --git a/x-pack/plugins/graph/public/helpers/saved_workspace_utils.ts b/x-pack/plugins/graph/public/helpers/saved_workspace_utils.ts
new file mode 100644
index 0000000000000..2933e94b86e86
--- /dev/null
+++ b/x-pack/plugins/graph/public/helpers/saved_workspace_utils.ts
@@ -0,0 +1,207 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { cloneDeep, assign, defaults, forOwn } from 'lodash';
+import { i18n } from '@kbn/i18n';
+import {
+  IBasePath,
+  OverlayStart,
+  SavedObjectsClientContract,
+  SavedObjectAttributes,
+} from 'kibana/public';
+
+import {
+  SavedObjectSaveOpts,
+  checkForDuplicateTitle,
+  saveWithConfirmation,
+  isErrorNonFatal,
+  SavedObjectKibanaServices,
+} from '../../../../../src/plugins/saved_objects/public';
+import {
+  injectReferences,
+  extractReferences,
+} from '../services/persistence/saved_workspace_references';
+import { SavedObjectNotFound } from '../../../../../src/plugins/kibana_utils/public';
+import { GraphWorkspaceSavedObject } from '../types';
+
+const savedWorkspaceType = 'graph-workspace';
+const mapping: Record<string, string> = {
+  title: 'text',
+  description: 'text',
+  numLinks: 'integer',
+  numVertices: 'integer',
+  version: 'integer',
+  wsState: 'json',
+};
+const defaultsProps = {
+  title: i18n.translate('xpack.graph.savedWorkspace.workspaceNameTitle', {
+    defaultMessage: 'New Graph Workspace',
+  }),
+  numLinks: 0,
+  numVertices: 0,
+  wsState: '{}',
+  version: 1,
+};
+
+const urlFor = (basePath: IBasePath, id: string) =>
+  basePath.prepend(`/app/graph#/workspace/${encodeURIComponent(id)}`);
+
+function mapHits(hit: { id: string; attributes: Record<string, unknown> }, url: string) {
+  const source = hit.attributes;
+  source.id = hit.id;
+  source.url = url;
+  source.icon = 'fa-share-alt'; // looks like a graph
+  return source;
+}
+
+interface SavedWorkspaceServices {
+  basePath: IBasePath;
+  savedObjectsClient: SavedObjectsClientContract;
+}
+
+export function findSavedWorkspace(
+  { savedObjectsClient, basePath }: SavedWorkspaceServices,
+  searchString: string,
+  size: number = 100
+) {
+  return savedObjectsClient
+    .find<Record<string, unknown>>({
+      type: savedWorkspaceType,
+      search: searchString ? `${searchString}*` : undefined,
+      perPage: size,
+      searchFields: ['title^3', 'description'],
+    })
+    .then(resp => {
+      return {
+        total: resp.total,
+        hits: resp.savedObjects.map(hit => mapHits(hit, urlFor(basePath, hit.id))),
+      };
+    });
+}
+
+export async function getSavedWorkspace(
+  savedObjectsClient: SavedObjectsClientContract,
+  id?: string
+) {
+  const savedObject = {
+    id,
+    displayName: 'graph workspace',
+    getEsType: () => savedWorkspaceType,
+  } as { [key: string]: any };
+
+  if (!id) {
+    assign(savedObject, defaultsProps);
+    return Promise.resolve(savedObject);
+  }
+
+  const resp = await savedObjectsClient.get<Record<string, unknown>>(savedWorkspaceType, id);
+  savedObject._source = cloneDeep(resp.attributes);
+
+  if (!resp._version) {
+    throw new SavedObjectNotFound(savedWorkspaceType, id || '');
+  }
+
+  // assign the defaults to the response
+  defaults(savedObject._source, defaultsProps);
+
+  // transform the source using JSON.parse
+  if (savedObject._source.wsState) {
+    savedObject._source.wsState = JSON.parse(savedObject._source.wsState as string);
+  }
+
+  // Give obj all of the values in _source.fields
+  assign(savedObject, savedObject._source);
+  savedObject.lastSavedTitle = savedObject.title;
+
+  if (resp.references && resp.references.length > 0) {
+    injectReferences(savedObject, resp.references);
+  }
+
+  return savedObject as GraphWorkspaceSavedObject;
+}
+
+export function deleteSavedWorkspace(
+  savedObjectsClient: SavedObjectsClientContract,
+  ids: string[]
+) {
+  return Promise.all(ids.map((id: string) => savedObjectsClient.delete(savedWorkspaceType, id)));
+}
+
+export async function saveSavedWorkspace(
+  savedObject: GraphWorkspaceSavedObject,
+  {
+    confirmOverwrite = false,
+    isTitleDuplicateConfirmed = false,
+    onTitleDuplicate,
+  }: SavedObjectSaveOpts = {},
+  services: {
+    savedObjectsClient: SavedObjectsClientContract;
+    overlays: OverlayStart;
+  }
+) {
+  // Save the original id in case the save fails.
+  const originalId = savedObject.id;
+  // Read https://github.com/elastic/kibana/issues/9056 and
+  // https://github.com/elastic/kibana/issues/9012 for some background into why this copyOnSave variable
+  // exists.
+  // The goal is to move towards a better rename flow, but since our users have been conditioned
+  // to expect a 'save as' flow during a rename, we are keeping the logic the same until a better
+  // UI/UX can be worked out.
+  if (savedObject.copyOnSave) {
+    delete savedObject.id;
+  }
+
+  let attributes: SavedObjectAttributes = {};
+
+  forOwn(mapping, (fieldType, fieldName) => {
+    const savedObjectFieldVal = savedObject[fieldName as keyof GraphWorkspaceSavedObject] as string;
+    if (savedObjectFieldVal != null) {
+      attributes[fieldName as keyof GraphWorkspaceSavedObject] =
+        fieldName === 'wsState' ? JSON.stringify(savedObjectFieldVal) : savedObjectFieldVal;
+    }
+  });
+  const extractedRefs = extractReferences({ attributes, references: [] });
+  const references = extractedRefs.references;
+  attributes = extractedRefs.attributes;
+
+  if (!references) {
+    throw new Error('References not returned from extractReferences');
+  }
+
+  try {
+    await checkForDuplicateTitle(
+      savedObject as any,
+      isTitleDuplicateConfirmed,
+      onTitleDuplicate,
+      services as SavedObjectKibanaServices
+    );
+    savedObject.isSaving = true;
+
+    const createOpt = {
+      id: savedObject.id,
+      migrationVersion: savedObject.migrationVersion,
+      references,
+    };
+    const resp = confirmOverwrite
+      ? await saveWithConfirmation(attributes, savedObject, createOpt, services)
+      : await services.savedObjectsClient.create(savedObject.getEsType(), attributes, {
+          ...createOpt,
+          overwrite: true,
+        });
+
+    savedObject.id = resp.id;
+    savedObject.isSaving = false;
+    savedObject.lastSavedTitle = savedObject.title;
+    return savedObject.id;
+  } catch (err) {
+    savedObject.isSaving = false;
+    savedObject.id = originalId;
+    if (isErrorNonFatal(err)) {
+      return '';
+    }
+    return Promise.reject(err);
+  }
+}
diff --git a/x-pack/plugins/graph/public/services/persistence/saved_workspace.ts b/x-pack/plugins/graph/public/services/persistence/saved_workspace.ts
deleted file mode 100644
index e2bd885dc7209..0000000000000
--- a/x-pack/plugins/graph/public/services/persistence/saved_workspace.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { i18n } from '@kbn/i18n';
-import { extractReferences, injectReferences } from './saved_workspace_references';
-import {
-  SavedObject,
-  createSavedObjectClass,
-  SavedObjectKibanaServices,
-} from '../../../../../../src/plugins/saved_objects/public';
-
-export interface SavedWorkspace extends SavedObject {
-  wsState?: string;
-}
-
-export function createSavedWorkspaceClass(services: SavedObjectKibanaServices) {
-  // SavedWorkspace constructor. Usually you'd interact with an instance of this.
-  // ID is option, without it one will be generated on save.
-  const SavedObjectClass = createSavedObjectClass(services);
-  class SavedWorkspaceClass extends SavedObjectClass {
-    public static type: string = 'graph-workspace';
-    // if type:workspace has no mapping, we push this mapping into ES
-    public static mapping: Record<string, string> = {
-      title: 'text',
-      description: 'text',
-      numLinks: 'integer',
-      numVertices: 'integer',
-      version: 'integer',
-      wsState: 'json',
-    };
-    // Order these fields to the top, the rest are alphabetical
-    public static fieldOrder = ['title', 'description'];
-    public static searchSource = false;
-
-    public wsState?: string;
-
-    constructor(id: string) {
-      // Gives our SavedWorkspace the properties of a SavedObject
-      super({
-        type: SavedWorkspaceClass.type,
-        mapping: SavedWorkspaceClass.mapping,
-        searchSource: SavedWorkspaceClass.searchSource,
-        extractReferences,
-        injectReferences,
-        // if this is null/undefined then the SavedObject will be assigned the defaults
-        id,
-        // default values that will get assigned if the doc is new
-        defaults: {
-          title: i18n.translate('xpack.graph.savedWorkspace.workspaceNameTitle', {
-            defaultMessage: 'New Graph Workspace',
-          }),
-          numLinks: 0,
-          numVertices: 0,
-          wsState: '{}',
-          version: 1,
-        },
-      });
-    }
-    // Overwrite the default getDisplayName function which uses type and which is not very
-    // user friendly for this object.
-    getDisplayName = () => {
-      return 'graph workspace';
-    };
-  }
-  return SavedWorkspaceClass;
-}
diff --git a/x-pack/plugins/graph/public/services/persistence/saved_workspace_loader.ts b/x-pack/plugins/graph/public/services/persistence/saved_workspace_loader.ts
deleted file mode 100644
index fb64fbadfbf7c..0000000000000
--- a/x-pack/plugins/graph/public/services/persistence/saved_workspace_loader.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { IBasePath } from 'kibana/public';
-import { i18n } from '@kbn/i18n';
-
-import { SavedObjectKibanaServices } from '../../../../../../src/plugins/saved_objects/public';
-import { createSavedWorkspaceClass } from './saved_workspace';
-
-export function createSavedWorkspacesLoader(
-  services: SavedObjectKibanaServices & { basePath: IBasePath }
-) {
-  const { savedObjectsClient, basePath } = services;
-  const SavedWorkspace = createSavedWorkspaceClass(services);
-  const urlFor = (id: string) =>
-    basePath.prepend(`/app/graph#/workspace/${encodeURIComponent(id)}`);
-  const mapHits = (hit: { id: string; attributes: Record<string, unknown> }) => {
-    const source = hit.attributes;
-    source.id = hit.id;
-    source.url = urlFor(hit.id);
-    source.icon = 'fa-share-alt'; // looks like a graph
-    return source;
-  };
-
-  return {
-    type: SavedWorkspace.type,
-    Class: SavedWorkspace,
-    loaderProperties: {
-      name: 'Graph workspace',
-      noun: i18n.translate('xpack.graph.savedWorkspaces.graphWorkspaceLabel', {
-        defaultMessage: 'Graph workspace',
-      }),
-      nouns: i18n.translate('xpack.graph.savedWorkspaces.graphWorkspacesLabel', {
-        defaultMessage: 'Graph workspaces',
-      }),
-    },
-    // Returns a single dashboard by ID, should be the name of the workspace
-    get: (id: string) => {
-      // Returns a promise that contains a workspace which is a subclass of docSource
-      // @ts-ignore
-      return new SavedWorkspace(id).init();
-    },
-    urlFor,
-    delete: (ids: string | string[]) => {
-      const idArr = Array.isArray(ids) ? ids : [ids];
-      return Promise.all(
-        idArr.map((id: string) => savedObjectsClient.delete(SavedWorkspace.type, id))
-      );
-    },
-    find: (searchString: string, size: number = 100) => {
-      return savedObjectsClient
-        .find<Record<string, unknown>>({
-          type: SavedWorkspace.type,
-          search: searchString ? `${searchString}*` : undefined,
-          perPage: size,
-          searchFields: ['title^3', 'description'],
-        })
-        .then(resp => {
-          return {
-            total: resp.total,
-            hits: resp.savedObjects.map(hit => mapHits(hit)),
-          };
-        });
-    },
-  };
-}
diff --git a/x-pack/plugins/graph/public/services/persistence/saved_workspace_references.test.ts b/x-pack/plugins/graph/public/services/persistence/saved_workspace_references.test.ts
index 716520cb83aa1..c973a54a650a6 100644
--- a/x-pack/plugins/graph/public/services/persistence/saved_workspace_references.test.ts
+++ b/x-pack/plugins/graph/public/services/persistence/saved_workspace_references.test.ts
@@ -5,7 +5,6 @@
  */
 
 import { extractReferences, injectReferences } from './saved_workspace_references';
-import { SavedWorkspace } from './saved_workspace';
 
 describe('extractReferences', () => {
   test('extracts references from wsState', () => {
@@ -67,7 +66,7 @@ describe('injectReferences', () => {
         indexPatternRefName: 'indexPattern_0',
         bar: true,
       }),
-    } as SavedWorkspace;
+    };
     const references = [
       {
         name: 'indexPattern_0',
@@ -89,7 +88,7 @@ Object {
     const context = {
       id: '1',
       title: 'test',
-    } as SavedWorkspace;
+    } as any;
     injectReferences(context, []);
     expect(context).toMatchInlineSnapshot(`
 Object {
@@ -103,7 +102,7 @@ Object {
     const context = {
       id: '1',
       wsState: JSON.stringify({ bar: true }),
-    } as SavedWorkspace;
+    };
     injectReferences(context, []);
     expect(context).toMatchInlineSnapshot(`
 Object {
@@ -119,7 +118,7 @@ Object {
       wsState: JSON.stringify({
         indexPatternRefName: 'indexPattern_0',
       }),
-    } as SavedWorkspace;
+    };
     expect(() => injectReferences(context, [])).toThrowErrorMatchingInlineSnapshot(
       `"Could not find reference \\"indexPattern_0\\""`
     );
diff --git a/x-pack/plugins/graph/public/services/persistence/saved_workspace_references.ts b/x-pack/plugins/graph/public/services/persistence/saved_workspace_references.ts
index 3a596b8068655..0948d7a88fce8 100644
--- a/x-pack/plugins/graph/public/services/persistence/saved_workspace_references.ts
+++ b/x-pack/plugins/graph/public/services/persistence/saved_workspace_references.ts
@@ -5,7 +5,6 @@
  */
 
 import { SavedObjectAttributes, SavedObjectReference } from 'kibana/public';
-import { SavedWorkspace } from './saved_workspace';
 
 export function extractReferences({
   attributes,
@@ -38,7 +37,10 @@ export function extractReferences({
   };
 }
 
-export function injectReferences(savedObject: SavedWorkspace, references: SavedObjectReference[]) {
+export function injectReferences(
+  savedObject: { wsState?: string },
+  references: SavedObjectReference[]
+) {
   // Skip if wsState is missing, at the time of development of this, there is no guarantee each
   // saved object has wsState.
   if (typeof savedObject.wsState !== 'string') {
diff --git a/x-pack/plugins/graph/public/services/save_modal.tsx b/x-pack/plugins/graph/public/services/save_modal.tsx
index 127ff6a2b4c37..94b5de3be13ac 100644
--- a/x-pack/plugins/graph/public/services/save_modal.tsx
+++ b/x-pack/plugins/graph/public/services/save_modal.tsx
@@ -5,18 +5,24 @@
  */
 
 import React from 'react';
-import { I18nStart } from 'src/core/public';
+import { I18nStart, OverlayStart, SavedObjectsClientContract } from 'src/core/public';
 import { SaveResult } from 'src/plugins/saved_objects/public';
 import { GraphWorkspaceSavedObject, GraphSavePolicy } from '../types';
 import { SaveModal, OnSaveGraphProps } from '../components/save_modal';
 
+export interface SaveWorkspaceServices {
+  overlays: OverlayStart;
+  savedObjectsClient: SavedObjectsClientContract;
+}
+
 export type SaveWorkspaceHandler = (
   saveOptions: {
     confirmOverwrite: boolean;
     isTitleDuplicateConfirmed: boolean;
     onTitleDuplicate: () => void;
   },
-  dataConsent: boolean
+  dataConsent: boolean,
+  services: SaveWorkspaceServices
 ) => Promise<SaveResult>;
 
 export function openSaveModal({
@@ -26,6 +32,7 @@ export function openSaveModal({
   saveWorkspace,
   showSaveModal,
   I18nContext,
+  services,
 }: {
   savePolicy: GraphSavePolicy;
   hasData: boolean;
@@ -33,6 +40,7 @@ export function openSaveModal({
   saveWorkspace: SaveWorkspaceHandler;
   showSaveModal: (el: React.ReactNode, I18nContext: I18nStart['Context']) => void;
   I18nContext: I18nStart['Context'];
+  services: SaveWorkspaceServices;
 }) {
   const currentTitle = workspace.title;
   const currentDescription = workspace.description;
@@ -52,7 +60,7 @@ export function openSaveModal({
       isTitleDuplicateConfirmed,
       onTitleDuplicate,
     };
-    return saveWorkspace(saveOptions, dataConsent).then(response => {
+    return saveWorkspace(saveOptions, dataConsent, services).then(response => {
       // If the save wasn't successful, put the original values back.
       if (!('id' in response) || !Boolean(response.id)) {
         workspace.title = currentTitle;
diff --git a/x-pack/plugins/graph/public/state_management/mocks.ts b/x-pack/plugins/graph/public/state_management/mocks.ts
index d06f8a7b3ef0b..02a5830ffd6be 100644
--- a/x-pack/plugins/graph/public/state_management/mocks.ts
+++ b/x-pack/plugins/graph/public/state_management/mocks.ts
@@ -4,7 +4,12 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { NotificationsStart, HttpStart } from 'kibana/public';
+import {
+  NotificationsStart,
+  HttpStart,
+  OverlayStart,
+  SavedObjectsClientContract,
+} from 'kibana/public';
 import createSagaMiddleware from 'redux-saga';
 import { createStore, applyMiddleware, AnyAction } from 'redux';
 import { ChromeStart } from 'kibana/public';
@@ -79,6 +84,13 @@ export function createMockGraphStore({
     setLiveResponseFields: jest.fn(),
     setUrlTemplates: jest.fn(),
     setWorkspaceInitialized: jest.fn(),
+    overlays: ({
+      openModal: jest.fn(),
+    } as unknown) as OverlayStart,
+    savedObjectsClient: ({
+      find: jest.fn(),
+      get: jest.fn(),
+    } as unknown) as SavedObjectsClientContract,
     ...mockedDepsOverwrites,
   };
   const sagaMiddleware = createSagaMiddleware();
diff --git a/x-pack/plugins/graph/public/state_management/persistence.test.ts b/x-pack/plugins/graph/public/state_management/persistence.test.ts
index 2dac92fceb6b4..285bf2d6a0ea9 100644
--- a/x-pack/plugins/graph/public/state_management/persistence.test.ts
+++ b/x-pack/plugins/graph/public/state_management/persistence.test.ts
@@ -40,6 +40,10 @@ jest.mock('../services/save_modal', () => ({
   openSaveModal: jest.fn(),
 }));
 
+jest.mock('../helpers/saved_workspace_utils', () => ({
+  saveSavedWorkspace: jest.fn().mockResolvedValueOnce('123'),
+}));
+
 describe('persistence sagas', () => {
   let env: MockedGraphEnvironment;
 
@@ -90,7 +94,6 @@ describe('persistence sagas', () => {
           savePolicy: 'configAndDataWithConsent',
         },
       });
-      (env.mockedDeps.getSavedWorkspace().save as jest.Mock).mockResolvedValueOnce('123');
       env.mockedDeps.getSavedWorkspace().id = '123';
     });
 
diff --git a/x-pack/plugins/graph/public/state_management/persistence.ts b/x-pack/plugins/graph/public/state_management/persistence.ts
index 0f72186af031f..8dd1386f70e6e 100644
--- a/x-pack/plugins/graph/public/state_management/persistence.ts
+++ b/x-pack/plugins/graph/public/state_management/persistence.ts
@@ -22,6 +22,8 @@ import {
 import { updateMetaData, metaDataSelector } from './meta_data';
 import { openSaveModal, SaveWorkspaceHandler } from '../services/save_modal';
 import { getEditPath } from '../services/url';
+import { saveSavedWorkspace } from '../helpers/saved_workspace_utils';
+
 const actionCreator = actionCreatorFactory('x-pack/graph');
 
 export const loadSavedWorkspace = actionCreator<GraphWorkspaceSavedObject>('LOAD_WORKSPACE');
@@ -140,7 +142,8 @@ function showModal(
 ) {
   const saveWorkspaceHandler: SaveWorkspaceHandler = async (
     saveOptions,
-    userHasConfirmedSaveWorkspaceData
+    userHasConfirmedSaveWorkspaceData,
+    services
   ) => {
     const canSaveData =
       deps.savePolicy === 'configAndData' ||
@@ -157,7 +160,7 @@ function showModal(
       canSaveData
     );
     try {
-      const id = await savedWorkspace.save(saveOptions);
+      const id = await saveSavedWorkspace(savedWorkspace, saveOptions, services);
       if (id) {
         const title = i18n.translate('xpack.graph.saveWorkspace.successNotificationTitle', {
           defaultMessage: 'Saved "{workspaceTitle}"',
@@ -200,5 +203,9 @@ function showModal(
     showSaveModal: deps.showSaveModal,
     saveWorkspace: saveWorkspaceHandler,
     I18nContext: deps.I18nContext,
+    services: {
+      savedObjectsClient: deps.savedObjectsClient,
+      overlays: deps.overlays,
+    },
   });
 }
diff --git a/x-pack/plugins/graph/public/state_management/store.ts b/x-pack/plugins/graph/public/state_management/store.ts
index 4aeef0338923b..e639662225cb3 100644
--- a/x-pack/plugins/graph/public/state_management/store.ts
+++ b/x-pack/plugins/graph/public/state_management/store.ts
@@ -6,7 +6,7 @@
 
 import createSagaMiddleware, { SagaMiddleware } from 'redux-saga';
 import { combineReducers, createStore, Store, AnyAction, Dispatch, applyMiddleware } from 'redux';
-import { ChromeStart, I18nStart } from 'kibana/public';
+import { ChromeStart, I18nStart, OverlayStart, SavedObjectsClientContract } from 'kibana/public';
 import { CoreStart } from 'src/core/public';
 import {
   fieldsReducer,
@@ -54,6 +54,8 @@ export interface GraphStoreDependencies {
   getSavedWorkspace: () => GraphWorkspaceSavedObject;
   notifications: CoreStart['notifications'];
   http: CoreStart['http'];
+  overlays: OverlayStart;
+  savedObjectsClient: SavedObjectsClientContract;
   showSaveModal: (el: React.ReactNode, I18nContext: I18nStart['Context']) => void;
   savePolicy: GraphSavePolicy;
   changeUrl: (newUrl: string) => void;
diff --git a/x-pack/plugins/graph/public/types/persistence.ts b/x-pack/plugins/graph/public/types/persistence.ts
index b0209153c82e3..6847199d5878c 100644
--- a/x-pack/plugins/graph/public/types/persistence.ts
+++ b/x-pack/plugins/graph/public/types/persistence.ts
@@ -4,7 +4,6 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { SavedObject } from '../../../../../src/plugins/saved_objects/public';
 import { AdvancedSettings, UrlTemplate, WorkspaceField } from './app_state';
 import { WorkspaceNode, WorkspaceEdge } from './workspace_state';
 
@@ -12,15 +11,23 @@ type Omit<T, K> = Pick<T, Exclude<keyof T, K>>;
 
 /**
  * Workspace fetched from server.
- * This type is returned by `SavedWorkspacesProvider#get`.
  */
-export interface GraphWorkspaceSavedObject extends SavedObject {
-  title: string;
+export interface GraphWorkspaceSavedObject {
+  copyOnSave?: boolean;
   description: string;
+  displayName: string;
+  getEsType(): string;
+  id?: string;
+  isSaving?: boolean;
+  lastSavedTitle?: string;
+  migrationVersion?: Record<string, any>;
   numLinks: number;
   numVertices: number;
-  version: number;
+  title: string;
+  type: string;
+  version?: number;
   wsState: string;
+  _source: Record<string, unknown>;
 }
 
 export interface SerializedWorkspaceState {
diff --git a/x-pack/plugins/infra/kibana.json b/x-pack/plugins/infra/kibana.json
index bb40d65d311e8..b8796ad7a358e 100644
--- a/x-pack/plugins/infra/kibana.json
+++ b/x-pack/plugins/infra/kibana.json
@@ -11,7 +11,8 @@
     "data",
     "dataEnhanced",
     "metrics",
-    "alerting"
+    "alerting",
+    "triggers_actions_ui"
   ],
   "server": true,
   "ui": true,
diff --git a/x-pack/plugins/infra/public/apps/start_app.tsx b/x-pack/plugins/infra/public/apps/start_app.tsx
index a797e4c9d4ba7..a986ee6ece352 100644
--- a/x-pack/plugins/infra/public/apps/start_app.tsx
+++ b/x-pack/plugins/infra/public/apps/start_app.tsx
@@ -15,7 +15,8 @@ import { CoreStart, AppMountParameters } from 'kibana/public';
 
 // TODO use theme provided from parentApp when kibana supports it
 import { EuiErrorBoundary } from '@elastic/eui';
-import { EuiThemeProvider } from '../../../observability/public';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { EuiThemeProvider } from '../../../observability/public/typings/eui_styled_components';
 import { InfraFrontendLibs } from '../lib/lib';
 import { createStore } from '../store';
 import { ApolloClientContext } from '../utils/apollo_context';
@@ -26,6 +27,8 @@ import {
   KibanaContextProvider,
 } from '../../../../../src/plugins/kibana_react/public';
 import { AppRouter } from '../routers';
+import { TriggersAndActionsUIPublicPluginSetup } from '../../../triggers_actions_ui/public';
+import { TriggersActionsProvider } from '../utils/triggers_actions_context';
 import '../index.scss';
 
 export const CONTAINER_CLASSNAME = 'infra-container-element';
@@ -35,7 +38,8 @@ export async function startApp(
   core: CoreStart,
   plugins: object,
   params: AppMountParameters,
-  Router: AppRouter
+  Router: AppRouter,
+  triggersActionsUI: TriggersAndActionsUIPublicPluginSetup
 ) {
   const { element, appBasePath } = params;
   const history = createBrowserHistory({ basename: appBasePath });
@@ -51,19 +55,21 @@ export async function startApp(
     return (
       <core.i18n.Context>
         <EuiErrorBoundary>
-          <ReduxStoreProvider store={store}>
-            <ReduxStateContextProvider>
-              <ApolloProvider client={libs.apolloClient}>
-                <ApolloClientContext.Provider value={libs.apolloClient}>
-                  <EuiThemeProvider darkMode={darkMode}>
-                    <HistoryContext.Provider value={history}>
-                      <Router history={history} />
-                    </HistoryContext.Provider>
-                  </EuiThemeProvider>
-                </ApolloClientContext.Provider>
-              </ApolloProvider>
-            </ReduxStateContextProvider>
-          </ReduxStoreProvider>
+          <TriggersActionsProvider triggersActionsUI={triggersActionsUI}>
+            <ReduxStoreProvider store={store}>
+              <ReduxStateContextProvider>
+                <ApolloProvider client={libs.apolloClient}>
+                  <ApolloClientContext.Provider value={libs.apolloClient}>
+                    <EuiThemeProvider darkMode={darkMode}>
+                      <HistoryContext.Provider value={history}>
+                        <Router history={history} />
+                      </HistoryContext.Provider>
+                    </EuiThemeProvider>
+                  </ApolloClientContext.Provider>
+                </ApolloProvider>
+              </ReduxStateContextProvider>
+            </ReduxStoreProvider>
+          </TriggersActionsProvider>
         </EuiErrorBoundary>
       </core.i18n.Context>
     );
diff --git a/x-pack/plugins/infra/public/components/alerting/metrics/alert_dropdown.tsx b/x-pack/plugins/infra/public/components/alerting/metrics/alert_dropdown.tsx
new file mode 100644
index 0000000000000..0a464d91fbe06
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/alerting/metrics/alert_dropdown.tsx
@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, useCallback, useMemo } from 'react';
+import { EuiPopover, EuiButtonEmpty, EuiContextMenuItem, EuiContextMenuPanel } from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { AlertFlyout } from './alert_flyout';
+import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
+
+export const AlertDropdown = () => {
+  const [popoverOpen, setPopoverOpen] = useState(false);
+  const [flyoutVisible, setFlyoutVisible] = useState(false);
+  const kibana = useKibana();
+
+  const closePopover = useCallback(() => {
+    setPopoverOpen(false);
+  }, [setPopoverOpen]);
+
+  const openPopover = useCallback(() => {
+    setPopoverOpen(true);
+  }, [setPopoverOpen]);
+
+  const menuItems = useMemo(() => {
+    return [
+      <EuiContextMenuItem icon="bell" key="createLink" onClick={() => setFlyoutVisible(true)}>
+        <FormattedMessage
+          id="xpack.infra.alerting.createAlertButton"
+          defaultMessage="Create alert"
+        />
+      </EuiContextMenuItem>,
+      <EuiContextMenuItem
+        icon="tableOfContents"
+        key="manageLink"
+        href={kibana.services?.application?.getUrlForApp(
+          'kibana#/management/kibana/triggersActions/alerts'
+        )}
+      >
+        <FormattedMessage id="xpack.infra.alerting.manageAlerts" defaultMessage="Manage Alerts" />
+      </EuiContextMenuItem>,
+    ];
+  }, [kibana.services]);
+
+  return (
+    <>
+      <EuiPopover
+        button={
+          <EuiButtonEmpty iconSide={'right'} iconType={'arrowDown'} onClick={openPopover}>
+            <FormattedMessage id="xpack.infra.alerting.alertsButton" defaultMessage="Alerts" />
+          </EuiButtonEmpty>
+        }
+        isOpen={popoverOpen}
+        closePopover={closePopover}
+      >
+        <EuiContextMenuPanel items={menuItems} />
+      </EuiPopover>
+      <AlertFlyout setVisible={setFlyoutVisible} visible={flyoutVisible} />
+    </>
+  );
+};
diff --git a/x-pack/plugins/infra/public/components/alerting/metrics/alert_flyout.tsx b/x-pack/plugins/infra/public/components/alerting/metrics/alert_flyout.tsx
new file mode 100644
index 0000000000000..a00d63af8aac2
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/alerting/metrics/alert_flyout.tsx
@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useContext } from 'react';
+import { AlertsContextProvider, AlertAdd } from '../../../../../triggers_actions_ui/public';
+import { TriggerActionsContext } from '../../../utils/triggers_actions_context';
+import { useKibana } from '../../../../../../../src/plugins/kibana_react/public';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { METRIC_THRESHOLD_ALERT_TYPE_ID } from '../../../../server/lib/alerting/metric_threshold/types';
+import { MetricsExplorerOptions } from '../../../containers/metrics_explorer/use_metrics_explorer_options';
+import { MetricsExplorerSeries } from '../../../../common/http_api/metrics_explorer';
+
+interface Props {
+  visible?: boolean;
+  options?: Partial<MetricsExplorerOptions>;
+  series?: MetricsExplorerSeries;
+  setVisible: React.Dispatch<React.SetStateAction<boolean>>;
+}
+
+export const AlertFlyout = (props: Props) => {
+  const { triggersActionsUI } = useContext(TriggerActionsContext);
+  const { services } = useKibana();
+
+  return (
+    <>
+      {triggersActionsUI && (
+        <AlertsContextProvider
+          value={{
+            metadata: {
+              currentOptions: props.options,
+              series: props.series,
+            },
+            toastNotifications: services.notifications?.toasts,
+            http: services.http,
+            actionTypeRegistry: triggersActionsUI.actionTypeRegistry,
+            alertTypeRegistry: triggersActionsUI.alertTypeRegistry,
+          }}
+        >
+          <AlertAdd
+            addFlyoutVisible={props.visible!}
+            setAddFlyoutVisibility={props.setVisible}
+            alertTypeId={METRIC_THRESHOLD_ALERT_TYPE_ID}
+            canChangeTrigger={false}
+            consumer={'metrics'}
+          />
+        </AlertsContextProvider>
+      )}
+    </>
+  );
+};
diff --git a/x-pack/plugins/infra/public/components/alerting/metrics/expression.tsx b/x-pack/plugins/infra/public/components/alerting/metrics/expression.tsx
new file mode 100644
index 0000000000000..ea8dd1484a670
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/alerting/metrics/expression.tsx
@@ -0,0 +1,473 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useCallback, useMemo, useEffect, useState } from 'react';
+import {
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonIcon,
+  EuiSpacer,
+  EuiText,
+  EuiFormRow,
+  EuiButtonEmpty,
+} from '@elastic/eui';
+import { IFieldType } from 'src/plugins/data/public';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+import { euiStyled } from '../../../../../observability/public';
+import {
+  WhenExpression,
+  OfExpression,
+  ThresholdExpression,
+  ForLastExpression,
+  // eslint-disable-next-line @kbn/eslint/no-restricted-paths
+} from '../../../../../triggers_actions_ui/public/common';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { IErrorObject } from '../../../../../triggers_actions_ui/public/types';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { AlertsContextValue } from '../../../../../triggers_actions_ui/public/application/context/alerts_context';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { MetricsExplorerOptions } from '../../../containers/metrics_explorer/use_metrics_explorer_options';
+import { MetricsExplorerKueryBar } from '../../metrics_explorer/kuery_bar';
+import { MetricsExplorerSeries } from '../../../../common/http_api/metrics_explorer';
+import { useSource } from '../../../containers/source';
+import { MetricsExplorerGroupBy } from '../../metrics_explorer/group_by';
+
+export interface MetricExpression {
+  aggType?: string;
+  metric?: string;
+  comparator?: Comparator;
+  threshold?: number[];
+  timeSize?: number;
+  timeUnit?: TimeUnit;
+  indexPattern?: string;
+}
+
+interface AlertContextMeta {
+  currentOptions?: Partial<MetricsExplorerOptions>;
+  series?: MetricsExplorerSeries;
+}
+
+interface Props {
+  errors: IErrorObject[];
+  alertParams: {
+    criteria: MetricExpression[];
+    groupBy?: string;
+    filterQuery?: string;
+  };
+  alertsContext: AlertsContextValue<AlertContextMeta>;
+  setAlertParams(key: string, value: any): void;
+  setAlertProperty(key: string, value: any): void;
+}
+
+type Comparator = '>' | '>=' | 'between' | '<' | '<=';
+type TimeUnit = 's' | 'm' | 'h' | 'd';
+
+export const Expressions: React.FC<Props> = props => {
+  const { setAlertParams, alertParams, errors, alertsContext } = props;
+  const { source, createDerivedIndexPattern } = useSource({ sourceId: 'default' });
+  const [timeSize, setTimeSize] = useState<number | undefined>(1);
+  const [timeUnit, setTimeUnit] = useState<TimeUnit>('s');
+
+  const derivedIndexPattern = useMemo(() => createDerivedIndexPattern('metrics'), [
+    createDerivedIndexPattern,
+  ]);
+
+  const options = useMemo<MetricsExplorerOptions>(() => {
+    if (alertsContext.metadata?.currentOptions?.metrics) {
+      return alertsContext.metadata.currentOptions as MetricsExplorerOptions;
+    } else {
+      return {
+        metrics: [],
+        aggregation: 'avg',
+      };
+    }
+  }, [alertsContext.metadata]);
+
+  const defaultExpression = useMemo<MetricExpression>(
+    () => ({
+      aggType: AGGREGATION_TYPES.MAX,
+      comparator: '>',
+      threshold: [],
+      timeSize: 1,
+      timeUnit: 's',
+      indexPattern: source?.configuration.metricAlias,
+    }),
+    [source]
+  );
+
+  const updateParams = useCallback(
+    (id, e: MetricExpression) => {
+      const exp = alertParams.criteria ? alertParams.criteria.slice() : [];
+      exp[id] = { ...exp[id], ...e };
+      setAlertParams('criteria', exp);
+    },
+    [setAlertParams, alertParams.criteria]
+  );
+
+  const addExpression = useCallback(() => {
+    const exp = alertParams.criteria.slice();
+    exp.push(defaultExpression);
+    setAlertParams('criteria', exp);
+  }, [setAlertParams, alertParams.criteria, defaultExpression]);
+
+  const removeExpression = useCallback(
+    (id: number) => {
+      const exp = alertParams.criteria.slice();
+      if (exp.length > 1) {
+        exp.splice(id, 1);
+        setAlertParams('criteria', exp);
+      }
+    },
+    [setAlertParams, alertParams.criteria]
+  );
+
+  const onFilterQuerySubmit = useCallback(
+    (filter: any) => {
+      setAlertParams('filterQuery', filter);
+    },
+    [setAlertParams]
+  );
+
+  const onGroupByChange = useCallback(
+    (group: string | null) => {
+      setAlertParams('groupBy', group || undefined);
+    },
+    [setAlertParams]
+  );
+
+  const emptyError = useMemo(() => {
+    return {
+      aggField: [],
+      timeSizeUnit: [],
+      timeWindowSize: [],
+    };
+  }, []);
+
+  const updateTimeSize = useCallback(
+    (ts: number | undefined) => {
+      const criteria = alertParams.criteria.map(c => ({
+        ...c,
+        timeSize: ts,
+      }));
+      setTimeSize(ts || undefined);
+      setAlertParams('criteria', criteria);
+    },
+    [alertParams.criteria, setAlertParams]
+  );
+
+  const updateTimeUnit = useCallback(
+    (tu: string) => {
+      const criteria = alertParams.criteria.map(c => ({
+        ...c,
+        timeUnit: tu,
+      }));
+      setTimeUnit(tu as TimeUnit);
+      setAlertParams('criteria', criteria);
+    },
+    [alertParams.criteria, setAlertParams]
+  );
+
+  useEffect(() => {
+    const md = alertsContext.metadata;
+    if (md) {
+      if (md.currentOptions?.metrics) {
+        setAlertParams(
+          'criteria',
+          md.currentOptions.metrics.map(metric => ({
+            metric: metric.field,
+            comparator: '>',
+            threshold: [],
+            timeSize,
+            timeUnit,
+            indexPattern: source?.configuration.metricAlias,
+            aggType: metric.aggregation,
+          }))
+        );
+      } else {
+        setAlertParams('criteria', [defaultExpression]);
+      }
+
+      if (md.currentOptions) {
+        if (md.currentOptions.filterQuery) {
+          setAlertParams('filterQuery', md.currentOptions.filterQuery);
+        } else if (md.currentOptions.groupBy && md.series) {
+          const filter = `${md.currentOptions.groupBy}: "${md.series.id}"`;
+          setAlertParams('filterQuery', filter);
+        }
+
+        setAlertParams('groupBy', md.currentOptions.groupBy);
+      }
+    }
+  }, [alertsContext.metadata, defaultExpression, source]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  return (
+    <>
+      <EuiSpacer size={'m'} />
+      <EuiText size="xs">
+        <h4>
+          <FormattedMessage
+            id="xpack.infra.metrics.alertFlyout.conditions"
+            defaultMessage="Conditions"
+          />
+        </h4>
+      </EuiText>
+      <EuiSpacer size={'xs'} />
+      {alertParams.criteria &&
+        alertParams.criteria.map((e, idx) => {
+          return (
+            <ExpressionRow
+              canDelete={alertParams.criteria.length > 1}
+              fields={derivedIndexPattern.fields}
+              remove={removeExpression}
+              addExpression={addExpression}
+              key={idx} // idx's don't usually make good key's but here the index has semantic meaning
+              expressionId={idx}
+              setAlertParams={updateParams}
+              errors={errors[idx] || emptyError}
+              expression={e || {}}
+            />
+          );
+        })}
+
+      <ForLastExpression
+        timeWindowSize={timeSize}
+        timeWindowUnit={timeUnit}
+        errors={emptyError}
+        onChangeWindowSize={updateTimeSize}
+        onChangeWindowUnit={updateTimeUnit}
+      />
+
+      <div>
+        <EuiButtonEmpty
+          color={'primary'}
+          iconSide={'left'}
+          flush={'left'}
+          iconType={'plusInCircleFilled'}
+          onClick={addExpression}
+        >
+          <FormattedMessage
+            id="xpack.infra.metrics.alertFlyout.addCondition"
+            defaultMessage="Add condition"
+          />
+        </EuiButtonEmpty>
+      </div>
+
+      <EuiSpacer size={'m'} />
+
+      <EuiFormRow
+        label={i18n.translate('xpack.infra.metrics.alertFlyout.filterLabel', {
+          defaultMessage: 'Filter',
+        })}
+        helpText={i18n.translate('xpack.infra.metrics.alertFlyout.filterHelpText', {
+          defaultMessage: 'Filter help text',
+        })}
+        fullWidth
+        compressed
+      >
+        <MetricsExplorerKueryBar
+          derivedIndexPattern={derivedIndexPattern}
+          onSubmit={onFilterQuerySubmit}
+          value={alertParams.filterQuery}
+        />
+      </EuiFormRow>
+
+      <EuiSpacer size={'m'} />
+
+      {alertsContext.metadata && (
+        <EuiFormRow
+          label={i18n.translate('xpack.infra.metrics.alertFlyout.createAlertPerText', {
+            defaultMessage: 'Create alert per',
+          })}
+          helpText={i18n.translate('xpack.infra.metrics.alertFlyout.createAlertPerHelpText', {
+            defaultMessage: 'Create alert help text',
+          })}
+          fullWidth
+          compressed
+        >
+          <MetricsExplorerGroupBy
+            onChange={onGroupByChange}
+            fields={derivedIndexPattern.fields}
+            options={{
+              ...options,
+              groupBy: alertParams.groupBy || undefined,
+            }}
+          />
+        </EuiFormRow>
+      )}
+    </>
+  );
+};
+
+interface ExpressionRowProps {
+  fields: IFieldType[];
+  expressionId: number;
+  expression: MetricExpression;
+  errors: IErrorObject;
+  canDelete: boolean;
+  addExpression(): void;
+  remove(id: number): void;
+  setAlertParams(id: number, params: MetricExpression): void;
+}
+
+const StyledExpressionRow = euiStyled(EuiFlexGroup)`
+  display: flex;
+  flex-wrap: wrap;
+  margin: 0 -${props => props.theme.eui.euiSizeXS};
+`;
+
+const StyledExpression = euiStyled.div`
+  padding: 0 ${props => props.theme.eui.euiSizeXS};
+`;
+
+export const ExpressionRow: React.FC<ExpressionRowProps> = props => {
+  const { setAlertParams, expression, errors, expressionId, remove, fields, canDelete } = props;
+  const { aggType = AGGREGATION_TYPES.MAX, metric, comparator = '>', threshold = [] } = expression;
+
+  const updateAggType = useCallback(
+    (at: string) => {
+      setAlertParams(expressionId, { ...expression, aggType: at });
+    },
+    [expressionId, expression, setAlertParams]
+  );
+
+  const updateMetric = useCallback(
+    (m?: string) => {
+      setAlertParams(expressionId, { ...expression, metric: m });
+    },
+    [expressionId, expression, setAlertParams]
+  );
+
+  const updateComparator = useCallback(
+    (c?: string) => {
+      setAlertParams(expressionId, { ...expression, comparator: c as Comparator });
+    },
+    [expressionId, expression, setAlertParams]
+  );
+
+  const updateThreshold = useCallback(
+    t => {
+      setAlertParams(expressionId, { ...expression, threshold: t });
+    },
+    [expressionId, expression, setAlertParams]
+  );
+
+  return (
+    <>
+      <EuiFlexGroup gutterSize="xs">
+        <EuiFlexItem grow>
+          <StyledExpressionRow>
+            <StyledExpression>
+              <WhenExpression
+                customAggTypesOptions={aggregationType}
+                aggType={aggType}
+                onChangeSelectedAggType={updateAggType}
+              />
+            </StyledExpression>
+            {aggType !== 'count' && (
+              <StyledExpression>
+                <OfExpression
+                  customAggTypesOptions={aggregationType}
+                  aggField={metric}
+                  fields={fields.map(f => ({
+                    normalizedType: f.type,
+                    name: f.name,
+                  }))}
+                  aggType={aggType}
+                  errors={errors}
+                  onChangeSelectedAggField={updateMetric}
+                />
+              </StyledExpression>
+            )}
+            <StyledExpression>
+              <ThresholdExpression
+                thresholdComparator={comparator || '>'}
+                threshold={threshold}
+                onChangeSelectedThresholdComparator={updateComparator}
+                onChangeSelectedThreshold={updateThreshold}
+                errors={errors}
+              />
+            </StyledExpression>
+          </StyledExpressionRow>
+        </EuiFlexItem>
+        {canDelete && (
+          <EuiFlexItem grow={false}>
+            <EuiButtonIcon
+              aria-label={i18n.translate('xpack.infra.metrics.alertFlyout.removeCondition', {
+                defaultMessage: 'Remove condition',
+              })}
+              color={'danger'}
+              iconType={'trash'}
+              onClick={() => remove(expressionId)}
+            />
+          </EuiFlexItem>
+        )}
+      </EuiFlexGroup>
+      <EuiSpacer size={'s'} />
+    </>
+  );
+};
+
+enum AGGREGATION_TYPES {
+  COUNT = 'count',
+  AVERAGE = 'avg',
+  SUM = 'sum',
+  MIN = 'min',
+  MAX = 'max',
+  RATE = 'rate',
+  CARDINALITY = 'cardinality',
+}
+
+export const aggregationType: { [key: string]: any } = {
+  avg: {
+    text: i18n.translate('xpack.infra.metrics.alertFlyout.aggregationText.avg', {
+      defaultMessage: 'Average',
+    }),
+    fieldRequired: true,
+    validNormalizedTypes: ['number'],
+    value: AGGREGATION_TYPES.AVERAGE,
+  },
+  max: {
+    text: i18n.translate('xpack.infra.metrics.alertFlyout.aggregationText.max', {
+      defaultMessage: 'Max',
+    }),
+    fieldRequired: true,
+    validNormalizedTypes: ['number', 'date'],
+    value: AGGREGATION_TYPES.MAX,
+  },
+  min: {
+    text: i18n.translate('xpack.infra.metrics.alertFlyout.aggregationText.min', {
+      defaultMessage: 'Min',
+    }),
+    fieldRequired: true,
+    validNormalizedTypes: ['number', 'date'],
+    value: AGGREGATION_TYPES.MIN,
+  },
+  cardinality: {
+    text: i18n.translate('xpack.infra.metrics.alertFlyout.aggregationText.cardinality', {
+      defaultMessage: 'Cardinality',
+    }),
+    fieldRequired: false,
+    value: AGGREGATION_TYPES.CARDINALITY,
+    validNormalizedTypes: ['number'],
+  },
+  rate: {
+    text: i18n.translate('xpack.infra.metrics.alertFlyout.aggregationText.rate', {
+      defaultMessage: 'Rate',
+    }),
+    fieldRequired: false,
+    value: AGGREGATION_TYPES.RATE,
+    validNormalizedTypes: ['number'],
+  },
+  count: {
+    text: i18n.translate('xpack.infra.metrics.alertFlyout.aggregationText.count', {
+      defaultMessage: 'Document count',
+    }),
+    fieldRequired: false,
+    value: AGGREGATION_TYPES.COUNT,
+    validNormalizedTypes: ['number'],
+  },
+};
diff --git a/x-pack/plugins/infra/public/components/alerting/metrics/metric_threshold_alert_type.ts b/x-pack/plugins/infra/public/components/alerting/metrics/metric_threshold_alert_type.ts
new file mode 100644
index 0000000000000..d3b5aaa7c8796
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/alerting/metrics/metric_threshold_alert_type.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { i18n } from '@kbn/i18n';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { AlertTypeModel } from '../../../../../triggers_actions_ui/public/types';
+import { Expressions } from './expression';
+import { validateMetricThreshold } from './validation';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { METRIC_THRESHOLD_ALERT_TYPE_ID } from '../../../../server/lib/alerting/metric_threshold/types';
+
+export function getAlertType(): AlertTypeModel {
+  return {
+    id: METRIC_THRESHOLD_ALERT_TYPE_ID,
+    name: i18n.translate('xpack.infra.metrics.alertFlyout.alertName', {
+      defaultMessage: 'Alert Trigger',
+    }),
+    iconClass: 'bell',
+    alertParamsExpression: Expressions,
+    validate: validateMetricThreshold,
+  };
+}
diff --git a/x-pack/plugins/infra/public/components/alerting/metrics/validation.tsx b/x-pack/plugins/infra/public/components/alerting/metrics/validation.tsx
new file mode 100644
index 0000000000000..0f5b07f8c0e13
--- /dev/null
+++ b/x-pack/plugins/infra/public/components/alerting/metrics/validation.tsx
@@ -0,0 +1,80 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+
+import { MetricExpression } from './expression';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { ValidationResult } from '../../../../../triggers_actions_ui/public/types';
+
+export function validateMetricThreshold({
+  criteria,
+}: {
+  criteria: MetricExpression[];
+}): ValidationResult {
+  const validationResult = { errors: {} };
+  const errors: {
+    [id: string]: {
+      aggField: string[];
+      timeSizeUnit: string[];
+      timeWindowSize: string[];
+      threshold0: string[];
+      threshold1: string[];
+    };
+  } = {};
+  validationResult.errors = errors;
+
+  if (!criteria || !criteria.length) {
+    return validationResult;
+  }
+
+  criteria.forEach((c, idx) => {
+    // Create an id for each criteria, so we can map errors to specific criteria.
+    const id = idx.toString();
+
+    errors[id] = errors[id] || {
+      aggField: [],
+      timeSizeUnit: [],
+      timeWindowSize: [],
+      threshold0: [],
+      threshold1: [],
+    };
+    if (!c.aggType) {
+      errors[id].aggField.push(
+        i18n.translate('xpack.infra.metrics.alertFlyout.error.aggregationRequired', {
+          defaultMessage: 'Aggreation is required.',
+        })
+      );
+    }
+
+    if (!c.threshold || !c.threshold.length) {
+      errors[id].threshold0.push(
+        i18n.translate('xpack.infra.metrics.alertFlyout.error.thresholdRequired', {
+          defaultMessage: 'Threshold is required.',
+        })
+      );
+    }
+
+    if (c.comparator === 'between' && (!c.threshold || c.threshold.length < 2)) {
+      errors[id].threshold1.push(
+        i18n.translate('xpack.infra.metrics.alertFlyout.error.thresholdRequired', {
+          defaultMessage: 'Threshold is required.',
+        })
+      );
+    }
+
+    if (!c.timeSize) {
+      errors[id].timeWindowSize.push(
+        i18n.translate('xpack.infra.metrics.alertFlyout.error.timeRequred', {
+          defaultMessage: 'Time size is Required.',
+        })
+      );
+    }
+  });
+
+  return validationResult;
+}
diff --git a/x-pack/plugins/infra/public/components/metrics_explorer/chart_context_menu.test.tsx b/x-pack/plugins/infra/public/components/metrics_explorer/chart_context_menu.test.tsx
index a23a2739a8e23..8ffef269a42ea 100644
--- a/x-pack/plugins/infra/public/components/metrics_explorer/chart_context_menu.test.tsx
+++ b/x-pack/plugins/infra/public/components/metrics_explorer/chart_context_menu.test.tsx
@@ -143,7 +143,7 @@ describe('MetricsExplorerChartContextMenu', () => {
         uiCapabilities: customUICapabilities,
         chartOptions,
       });
-      expect(component.find('button').length).toBe(0);
+      expect(component.find('button').length).toBe(1);
     });
   });
 
diff --git a/x-pack/plugins/infra/public/components/metrics_explorer/chart_context_menu.tsx b/x-pack/plugins/infra/public/components/metrics_explorer/chart_context_menu.tsx
index c50550f1de56f..75a04cbe9799e 100644
--- a/x-pack/plugins/infra/public/components/metrics_explorer/chart_context_menu.tsx
+++ b/x-pack/plugins/infra/public/components/metrics_explorer/chart_context_menu.tsx
@@ -24,6 +24,7 @@ import { createTSVBLink } from './helpers/create_tsvb_link';
 import { getNodeDetailUrl } from '../../pages/link_to/redirect_to_node_detail';
 import { SourceConfiguration } from '../../utils/source_configuration';
 import { InventoryItemType } from '../../../common/inventory_models/types';
+import { AlertFlyout } from '../alerting/metrics/alert_flyout';
 import { useLinkProps } from '../../hooks/use_link_props';
 
 export interface Props {
@@ -81,6 +82,7 @@ export const MetricsExplorerChartContextMenu: React.FC<Props> = ({
   chartOptions,
 }: Props) => {
   const [isPopoverOpen, setPopoverState] = useState(false);
+  const [flyoutVisible, setFlyoutVisible] = useState(false);
   const supportFiltering = options.groupBy != null && onFilter != null;
   const handleFilter = useCallback(() => {
     // onFilter needs check for Typescript even though it's
@@ -141,7 +143,20 @@ export const MetricsExplorerChartContextMenu: React.FC<Props> = ({
       ]
     : [];
 
-  const itemPanels = [...filterByItem, ...openInVisualize, ...viewNodeDetail];
+  const itemPanels = [
+    ...filterByItem,
+    ...openInVisualize,
+    ...viewNodeDetail,
+    {
+      name: i18n.translate('xpack.infra.metricsExplorer.alerts.createAlertButton', {
+        defaultMessage: 'Create alert',
+      }),
+      icon: 'bell',
+      onClick() {
+        setFlyoutVisible(true);
+      },
+    },
+  ];
 
   // If there are no itemPanels then there is no reason to show the actions button.
   if (itemPanels.length === 0) return null;
@@ -174,15 +189,24 @@ export const MetricsExplorerChartContextMenu: React.FC<Props> = ({
       {actionLabel}
     </EuiButtonEmpty>
   );
+
   return (
-    <EuiPopover
-      closePopover={handleClose}
-      id={`${series.id}-popover`}
-      button={button}
-      isOpen={isPopoverOpen}
-      panelPaddingSize="none"
-    >
-      <EuiContextMenu initialPanelId={0} panels={panels} />
-    </EuiPopover>
+    <>
+      <EuiPopover
+        closePopover={handleClose}
+        id={`${series.id}-popover`}
+        button={button}
+        isOpen={isPopoverOpen}
+        panelPaddingSize="none"
+      >
+        <EuiContextMenu initialPanelId={0} panels={panels} />
+        <AlertFlyout
+          series={series}
+          options={options}
+          setVisible={setFlyoutVisible}
+          visible={flyoutVisible}
+        />
+      </EuiPopover>
+    </>
   );
 };
diff --git a/x-pack/plugins/infra/public/components/metrics_explorer/kuery_bar.tsx b/x-pack/plugins/infra/public/components/metrics_explorer/kuery_bar.tsx
index 0e18deedd404c..dcc160d05b6ad 100644
--- a/x-pack/plugins/infra/public/components/metrics_explorer/kuery_bar.tsx
+++ b/x-pack/plugins/infra/public/components/metrics_explorer/kuery_bar.tsx
@@ -16,6 +16,7 @@ interface Props {
   derivedIndexPattern: IIndexPattern;
   onSubmit: (query: string) => void;
   value?: string | null;
+  placeholder?: string;
 }
 
 function validateQuery(query: string) {
@@ -27,7 +28,12 @@ function validateQuery(query: string) {
   return true;
 }
 
-export const MetricsExplorerKueryBar = ({ derivedIndexPattern, onSubmit, value }: Props) => {
+export const MetricsExplorerKueryBar = ({
+  derivedIndexPattern,
+  onSubmit,
+  value,
+  placeholder,
+}: Props) => {
   const [draftQuery, setDraftQuery] = useState<string>(value || '');
   const [isValid, setValidation] = useState<boolean>(true);
 
@@ -48,9 +54,12 @@ export const MetricsExplorerKueryBar = ({ derivedIndexPattern, onSubmit, value }
     fields: derivedIndexPattern.fields.filter(field => isDisplayable(field)),
   };
 
-  const placeholder = i18n.translate('xpack.infra.homePage.toolbar.kqlSearchFieldPlaceholder', {
-    defaultMessage: 'Search for infrastructure data… (e.g. host.name:host-1)',
-  });
+  const defaultPlaceholder = i18n.translate(
+    'xpack.infra.homePage.toolbar.kqlSearchFieldPlaceholder',
+    {
+      defaultMessage: 'Search for infrastructure data… (e.g. host.name:host-1)',
+    }
+  );
 
   return (
     <WithKueryAutocompletion indexPattern={filteredDerivedIndexPattern}>
@@ -62,7 +71,7 @@ export const MetricsExplorerKueryBar = ({ derivedIndexPattern, onSubmit, value }
           loadSuggestions={loadSuggestions}
           onChange={handleChange}
           onSubmit={onSubmit}
-          placeholder={placeholder}
+          placeholder={placeholder || defaultPlaceholder}
           suggestions={suggestions}
           value={draftQuery}
         />
diff --git a/x-pack/plugins/infra/public/components/metrics_explorer/toolbar.tsx b/x-pack/plugins/infra/public/components/metrics_explorer/toolbar.tsx
index 9e96819a36cac..0fbb0b6acad17 100644
--- a/x-pack/plugins/infra/public/components/metrics_explorer/toolbar.tsx
+++ b/x-pack/plugins/infra/public/components/metrics_explorer/toolbar.tsx
@@ -63,6 +63,7 @@ export const MetricsExplorerToolbar = ({
   const isDefaultOptions = options.aggregation === 'avg' && options.metrics.length === 0;
   const [timepickerQuickRanges] = useKibanaUiSetting('timepicker:quickRanges');
   const commonlyUsedRanges = mapKibanaQuickRangesToDatePickerRanges(timepickerQuickRanges);
+
   return (
     <Toolbar>
       <EuiFlexGroup alignItems="center">
diff --git a/x-pack/plugins/infra/public/components/waffle/node_context_menu.tsx b/x-pack/plugins/infra/public/components/waffle/node_context_menu.tsx
index cc6a94c8a41a2..5f05cebd8f616 100644
--- a/x-pack/plugins/infra/public/components/waffle/node_context_menu.tsx
+++ b/x-pack/plugins/infra/public/components/waffle/node_context_menu.tsx
@@ -8,7 +8,7 @@ import { EuiPopoverProps, EuiCode } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 
-import React, { useMemo } from 'react';
+import React, { useMemo, useState } from 'react';
 import { InfraWaffleMapNode, InfraWaffleMapOptions } from '../../lib/lib';
 import { getNodeDetailUrl, getNodeLogsUrl } from '../../pages/link_to';
 import { createUptimeLink } from './lib/create_uptime_link';
@@ -25,6 +25,7 @@ import {
   SectionLink,
 } from '../../../../observability/public';
 import { useLinkProps } from '../../hooks/use_link_props';
+import { AlertFlyout } from '../alerting/metrics/alert_flyout';
 
 interface Props {
   options: InfraWaffleMapOptions;
@@ -46,6 +47,7 @@ export const NodeContextMenu: React.FC<Props> = ({
   nodeType,
   popoverPosition,
 }) => {
+  const [flyoutVisible, setFlyoutVisible] = useState(false);
   const inventoryModel = findInventoryModel(nodeType);
   const nodeDetailFrom = currentTime - inventoryModel.metrics.defaultTimeRangeInSeconds * 1000;
   const uiCapabilities = useKibana().services.application?.capabilities;
@@ -144,41 +146,48 @@ export const NodeContextMenu: React.FC<Props> = ({
   };
 
   return (
-    <ActionMenu
-      closePopover={closePopover}
-      id={`${node.pathId}-popover`}
-      isOpen={isPopoverOpen}
-      button={children!}
-      anchorPosition={popoverPosition}
-    >
-      <div style={{ maxWidth: 300 }} data-test-subj="nodeContextMenu">
-        <Section>
-          <SectionTitle>
-            <FormattedMessage
-              id="xpack.infra.nodeContextMenu.title"
-              defaultMessage="{inventoryName} details"
-              values={{ inventoryName: inventoryModel.singularDisplayName }}
-            />
-          </SectionTitle>
-          {inventoryId.label && (
-            <SectionSubtitle>
-              <div style={{ wordBreak: 'break-all' }}>
-                <FormattedMessage
-                  id="xpack.infra.nodeContextMenu.description"
-                  defaultMessage="View details for {label} {value}"
-                  values={{ label: inventoryId.label, value: inventoryId.value }}
-                />
-              </div>
-            </SectionSubtitle>
-          )}
-          <SectionLinks>
-            <SectionLink data-test-subj="viewLogsContextMenuItem" {...nodeLogsMenuItem} />
-            <SectionLink {...nodeDetailMenuItem} />
-            <SectionLink data-test-subj="viewApmTracesContextMenuItem" {...apmTracesMenuItem} />
-            <SectionLink {...uptimeMenuItem} />
-          </SectionLinks>
-        </Section>
-      </div>
-    </ActionMenu>
+    <>
+      <ActionMenu
+        closePopover={closePopover}
+        id={`${node.pathId}-popover`}
+        isOpen={isPopoverOpen}
+        button={children!}
+        anchorPosition={popoverPosition}
+      >
+        <div style={{ maxWidth: 300 }} data-test-subj="nodeContextMenu">
+          <Section>
+            <SectionTitle>
+              <FormattedMessage
+                id="xpack.infra.nodeContextMenu.title"
+                defaultMessage="{inventoryName} details"
+                values={{ inventoryName: inventoryModel.singularDisplayName }}
+              />
+            </SectionTitle>
+            {inventoryId.label && (
+              <SectionSubtitle>
+                <div style={{ wordBreak: 'break-all' }}>
+                  <FormattedMessage
+                    id="xpack.infra.nodeContextMenu.description"
+                    defaultMessage="View details for {label} {value}"
+                    values={{ label: inventoryId.label, value: inventoryId.value }}
+                  />
+                </div>
+              </SectionSubtitle>
+            )}
+            <SectionLinks>
+              <SectionLink data-test-subj="viewLogsContextMenuItem" {...nodeLogsMenuItem} />
+              <SectionLink {...nodeDetailMenuItem} />
+              <SectionLink data-test-subj="viewApmTracesContextMenuItem" {...apmTracesMenuItem} />
+              <SectionLink {...uptimeMenuItem} />
+            </SectionLinks>
+          </Section>
+        </div>
+      </ActionMenu>
+      <AlertFlyout
+        options={{ filterQuery: `${nodeType}: ${node.id}` }}
+        setVisible={setFlyoutVisible}
+        visible={flyoutVisible}
+      />
+    </>
   );
 };
diff --git a/x-pack/plugins/infra/public/pages/infrastructure/index.tsx b/x-pack/plugins/infra/public/pages/infrastructure/index.tsx
index b4ff7aeff696c..730f67ab2bdca 100644
--- a/x-pack/plugins/infra/public/pages/infrastructure/index.tsx
+++ b/x-pack/plugins/infra/public/pages/infrastructure/index.tsx
@@ -9,6 +9,7 @@ import { i18n } from '@kbn/i18n';
 import React from 'react';
 import { Route, RouteComponentProps, Switch } from 'react-router-dom';
 
+import { EuiFlexItem, EuiFlexGroup } from '@elastic/eui';
 import { DocumentTitle } from '../../components/document_title';
 import { HelpCenterContent } from '../../components/help_center_content';
 import { RoutedTabs } from '../../components/navigation/routed_tabs';
@@ -24,9 +25,11 @@ import { MetricsSettingsPage } from './settings';
 import { AppNavigation } from '../../components/navigation/app_navigation';
 import { SourceLoadingPage } from '../../components/source_loading_page';
 import { useKibana } from '../../../../../../src/plugins/kibana_react/public';
+import { AlertDropdown } from '../../components/alerting/metrics/alert_dropdown';
 
 export const InfrastructurePage = ({ match }: RouteComponentProps) => {
   const uiCapabilities = useKibana().services.application?.capabilities;
+
   return (
     <Source.Provider sourceId="default">
       <ColumnarPage>
@@ -59,31 +62,38 @@ export const InfrastructurePage = ({ match }: RouteComponentProps) => {
             defaultMessage: 'Metrics',
           })}
         >
-          <RoutedTabs
-            tabs={[
-              {
-                app: 'metrics',
-                title: i18n.translate('xpack.infra.homePage.inventoryTabTitle', {
-                  defaultMessage: 'Inventory',
-                }),
-                pathname: '/inventory',
-              },
-              {
-                app: 'metrics',
-                title: i18n.translate('xpack.infra.homePage.metricsExplorerTabTitle', {
-                  defaultMessage: 'Metrics Explorer',
-                }),
-                pathname: '/explorer',
-              },
-              {
-                app: 'metrics',
-                title: i18n.translate('xpack.infra.homePage.settingsTabTitle', {
-                  defaultMessage: 'Settings',
-                }),
-                pathname: '/settings',
-              },
-            ]}
-          />
+          <EuiFlexGroup gutterSize={'none'} alignItems={'center'}>
+            <EuiFlexItem>
+              <RoutedTabs
+                tabs={[
+                  {
+                    app: 'metrics',
+                    title: i18n.translate('xpack.infra.homePage.inventoryTabTitle', {
+                      defaultMessage: 'Inventory',
+                    }),
+                    pathname: '/inventory',
+                  },
+                  {
+                    app: 'metrics',
+                    title: i18n.translate('xpack.infra.homePage.metricsExplorerTabTitle', {
+                      defaultMessage: 'Metrics Explorer',
+                    }),
+                    pathname: '/explorer',
+                  },
+                  {
+                    app: 'metrics',
+                    title: i18n.translate('xpack.infra.homePage.settingsTabTitle', {
+                      defaultMessage: 'Settings',
+                    }),
+                    pathname: '/settings',
+                  },
+                ]}
+              />
+            </EuiFlexItem>
+            <EuiFlexItem grow={false}>
+              <AlertDropdown />
+            </EuiFlexItem>
+          </EuiFlexGroup>
         </AppNavigation>
 
         <Switch>
diff --git a/x-pack/plugins/infra/public/plugin.ts b/x-pack/plugins/infra/public/plugin.ts
index d576331662a08..15796f35856bd 100644
--- a/x-pack/plugins/infra/public/plugin.ts
+++ b/x-pack/plugins/infra/public/plugin.ts
@@ -29,6 +29,8 @@ import { DataPublicPluginSetup, DataPublicPluginStart } from '../../../../src/pl
 import { UsageCollectionSetup } from '../../../../src/plugins/usage_collection/public';
 import { DataEnhancedSetup, DataEnhancedStart } from '../../data_enhanced/public';
 import { LogsRouter, MetricsRouter } from './routers';
+import { TriggersAndActionsUIPublicPluginSetup } from '../../../plugins/triggers_actions_ui/public';
+import { getAlertType } from './components/alerting/metrics/metric_threshold_alert_type';
 
 export type ClientSetup = void;
 export type ClientStart = void;
@@ -38,6 +40,7 @@ export interface ClientPluginsSetup {
   data: DataPublicPluginSetup;
   usageCollection: UsageCollectionSetup;
   dataEnhanced: DataEnhancedSetup;
+  triggers_actions_ui: TriggersAndActionsUIPublicPluginSetup;
 }
 
 export interface ClientPluginsStart {
@@ -58,6 +61,8 @@ export class Plugin
   setup(core: CoreSetup, pluginsSetup: ClientPluginsSetup) {
     registerFeatures(pluginsSetup.home);
 
+    pluginsSetup.triggers_actions_ui.alertTypeRegistry.register(getAlertType());
+
     core.application.register({
       id: 'logs',
       title: i18n.translate('xpack.infra.logs.pluginTitle', {
@@ -76,7 +81,8 @@ export class Plugin
           coreStart,
           plugins,
           params,
-          LogsRouter
+          LogsRouter,
+          pluginsSetup.triggers_actions_ui
         );
       },
     });
@@ -99,7 +105,8 @@ export class Plugin
           coreStart,
           plugins,
           params,
-          MetricsRouter
+          MetricsRouter,
+          pluginsSetup.triggers_actions_ui
         );
       },
     });
diff --git a/x-pack/plugins/infra/public/utils/triggers_actions_context.tsx b/x-pack/plugins/infra/public/utils/triggers_actions_context.tsx
new file mode 100644
index 0000000000000..4ca4aedb4a08b
--- /dev/null
+++ b/x-pack/plugins/infra/public/utils/triggers_actions_context.tsx
@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as React from 'react';
+import { TriggersAndActionsUIPublicPluginSetup } from '../../../triggers_actions_ui/public';
+
+interface ContextProps {
+  triggersActionsUI: TriggersAndActionsUIPublicPluginSetup | null;
+}
+
+export const TriggerActionsContext = React.createContext<ContextProps>({
+  triggersActionsUI: null,
+});
+
+interface Props {
+  triggersActionsUI: TriggersAndActionsUIPublicPluginSetup;
+}
+
+export const TriggersActionsProvider: React.FC<Props> = props => {
+  return (
+    <TriggerActionsContext.Provider
+      value={{
+        triggersActionsUI: props.triggersActionsUI,
+      }}
+    >
+      {props.children}
+    </TriggerActionsContext.Provider>
+  );
+};
diff --git a/x-pack/plugins/infra/server/features.ts b/x-pack/plugins/infra/server/features.ts
index edf94beab43a7..5301e1e9cbd0b 100644
--- a/x-pack/plugins/infra/server/features.ts
+++ b/x-pack/plugins/infra/server/features.ts
@@ -11,12 +11,15 @@ export const METRICS_FEATURE = {
   name: i18n.translate('xpack.infra.featureRegistry.linkInfrastructureTitle', {
     defaultMessage: 'Metrics',
   }),
+  order: 700,
   icon: 'metricsApp',
   navLinkId: 'metrics',
   app: ['infra', 'kibana'],
   catalogue: ['infraops'],
   privileges: {
     all: {
+      app: ['infra', 'kibana'],
+      catalogue: ['infraops'],
       api: ['infra'],
       savedObject: {
         all: ['infrastructure-ui-source'],
@@ -25,6 +28,8 @@ export const METRICS_FEATURE = {
       ui: ['show', 'configureSource', 'save'],
     },
     read: {
+      app: ['infra', 'kibana'],
+      catalogue: ['infraops'],
       api: ['infra'],
       savedObject: {
         all: [],
@@ -40,12 +45,15 @@ export const LOGS_FEATURE = {
   name: i18n.translate('xpack.infra.featureRegistry.linkLogsTitle', {
     defaultMessage: 'Logs',
   }),
+  order: 800,
   icon: 'logsApp',
   navLinkId: 'logs',
   app: ['infra', 'kibana'],
   catalogue: ['infralogging'],
   privileges: {
     all: {
+      app: ['infra', 'kibana'],
+      catalogue: ['infralogging'],
       api: ['infra'],
       savedObject: {
         all: ['infrastructure-ui-source'],
@@ -54,6 +62,8 @@ export const LOGS_FEATURE = {
       ui: ['show', 'configureSource', 'save'],
     },
     read: {
+      app: ['infra', 'kibana'],
+      catalogue: ['infralogging'],
       api: ['infra'],
       savedObject: {
         all: [],
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
index a6b9b70feede2..feaa404ae960a 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.test.ts
@@ -17,7 +17,7 @@ const alertInstances = new Map();
 
 const services = {
   callCluster(_: string, { body }: any) {
-    const metric = body.query.bool.filter[1].exists.field;
+    const metric = body.query.bool.filter[1]?.exists.field;
     if (body.aggs.groupings) {
       if (body.aggs.groupings.composite.after) {
         return mocks.compositeEndResponse;
@@ -228,6 +228,7 @@ describe('The metric threshold alert type', () => {
               comparator,
               threshold,
               aggType: 'count',
+              metric: undefined,
             },
           ],
         },
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
index 8c509c017cf20..778889ba0c7a5 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/metric_threshold_executor.ts
@@ -63,6 +63,12 @@ export const getElasticsearchMetricQuery = (
   groupBy?: string,
   filterQuery?: string
 ) => {
+  if (aggType === 'count' && metric) {
+    throw new Error('Cannot aggregate document count with a metric');
+  }
+  if (aggType !== 'count' && !metric) {
+    throw new Error('Can only aggregate without a metric if using the document count aggregator');
+  }
   const interval = `${timeSize}${timeUnit}`;
 
   const aggregations =
@@ -108,25 +114,32 @@ export const getElasticsearchMetricQuery = (
       }
     : baseAggs;
 
+  const rangeFilters = [
+    {
+      range: {
+        '@timestamp': {
+          gte: `now-${interval}`,
+        },
+      },
+    },
+  ];
+
+  const metricFieldFilters = metric
+    ? [
+        {
+          exists: {
+            field: metric,
+          },
+        },
+      ]
+    : [];
+
   const parsedFilterQuery = getParsedFilterQuery(filterQuery);
 
   return {
     query: {
       bool: {
-        filter: [
-          {
-            range: {
-              '@timestamp': {
-                gte: `now-${interval}`,
-              },
-            },
-          },
-          {
-            exists: {
-              field: metric,
-            },
-          },
-        ],
+        filter: [...rangeFilters, ...metricFieldFilters],
         ...parsedFilterQuery,
       },
     },
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
index 501d7549e1712..ed3a9b2f4fe36 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/register_metric_threshold_alert_type.ts
@@ -17,22 +17,44 @@ export async function registerMetricThresholdAlertType(alertingPlugin: PluginSet
   }
   const alertUUID = uuid.v4();
 
+  const baseCriterion = {
+    threshold: schema.arrayOf(schema.number()),
+    comparator: schema.oneOf([
+      schema.literal('>'),
+      schema.literal('<'),
+      schema.literal('>='),
+      schema.literal('<='),
+      schema.literal('between'),
+    ]),
+    timeUnit: schema.string(),
+    timeSize: schema.number(),
+    indexPattern: schema.string(),
+  };
+
+  const nonCountCriterion = schema.object({
+    ...baseCriterion,
+    metric: schema.string(),
+    aggType: schema.oneOf([
+      schema.literal('avg'),
+      schema.literal('min'),
+      schema.literal('max'),
+      schema.literal('rate'),
+      schema.literal('cardinality'),
+    ]),
+  });
+
+  const countCriterion = schema.object({
+    ...baseCriterion,
+    aggType: schema.literal('count'),
+    metric: schema.never(),
+  });
+
   alertingPlugin.registerType({
     id: METRIC_THRESHOLD_ALERT_TYPE_ID,
     name: 'Metric Alert - Threshold',
     validate: {
       params: schema.object({
-        criteria: schema.arrayOf(
-          schema.object({
-            threshold: schema.arrayOf(schema.number()),
-            comparator: schema.string(),
-            aggType: schema.string(),
-            metric: schema.string(),
-            timeUnit: schema.string(),
-            timeSize: schema.number(),
-            indexPattern: schema.string(),
-          })
-        ),
+        criteria: schema.arrayOf(schema.oneOf([countCriterion, nonCountCriterion])),
         groupBy: schema.maybe(schema.string()),
         filterQuery: schema.maybe(schema.string()),
       }),
diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/types.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/types.ts
index 07739c9d81bc4..557a071ec9175 100644
--- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/types.ts
+++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/types.ts
@@ -25,12 +25,22 @@ export enum AlertStates {
 
 export type TimeUnit = 's' | 'm' | 'h' | 'd';
 
-export interface MetricExpressionParams {
-  aggType: MetricsExplorerAggregation;
-  metric: string;
+interface BaseMetricExpressionParams {
   timeSize: number;
   timeUnit: TimeUnit;
   indexPattern: string;
   threshold: number[];
   comparator: Comparator;
 }
+
+interface NonCountMetricExpressionParams extends BaseMetricExpressionParams {
+  aggType: Exclude<MetricsExplorerAggregation, 'count'>;
+  metric: string;
+}
+
+interface CountMetricExpressionParams extends BaseMetricExpressionParams {
+  aggType: 'count';
+  metric: never;
+}
+
+export type MetricExpressionParams = NonCountMetricExpressionParams | CountMetricExpressionParams;
diff --git a/x-pack/plugins/ingest_manager/common/services/routes.ts b/x-pack/plugins/ingest_manager/common/services/routes.ts
index 01b3b1983486c..7cc6fc3c66afb 100644
--- a/x-pack/plugins/ingest_manager/common/services/routes.ts
+++ b/x-pack/plugins/ingest_manager/common/services/routes.ts
@@ -82,6 +82,10 @@ export const agentConfigRouteService = {
   getDeletePath: () => {
     return AGENT_CONFIG_API_ROUTES.DELETE_PATTERN;
   },
+
+  getInfoFullPath: (agentConfigId: string) => {
+    return AGENT_CONFIG_API_ROUTES.FULL_INFO_PATTERN.replace('{agentConfigId}', agentConfigId);
+  },
 };
 
 export const fleetSetupRouteService = {
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/enrollment_instructions/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/enrollment_instructions/index.tsx
similarity index 100%
rename from x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/enrollment_instructions/index.tsx
rename to x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/enrollment_instructions/index.tsx
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/enrollment_instructions/manual/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/enrollment_instructions/manual/index.tsx
similarity index 100%
rename from x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/enrollment_instructions/manual/index.tsx
rename to x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/enrollment_instructions/manual/index.tsx
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/enrollment_instructions/shell/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/enrollment_instructions/shell/index.tsx
similarity index 86%
rename from x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/enrollment_instructions/shell/index.tsx
rename to x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/enrollment_instructions/shell/index.tsx
index 04e84902bc9d4..e6990927b926e 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/enrollment_instructions/shell/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/components/enrollment_instructions/shell/index.tsx
@@ -12,7 +12,7 @@ import {
   EuiFieldText,
   EuiPopover,
 } from '@elastic/eui';
-import { EnrollmentAPIKey } from '../../../../../../types';
+import { EnrollmentAPIKey } from '../../../types';
 
 // No need for i18n as these are platform names
 const PLATFORMS = {
@@ -37,11 +37,13 @@ export const ShellEnrollmentInstructions: React.FunctionComponent<Props> = ({
   const [isPlatformOptionsOpen, setIsPlatformOptionsOpen] = useState<boolean>(false);
 
   // Build quick installation command
-  const quickInstallInstructions = `${
-    kibanaCASha256 ? `CA_SHA256=${kibanaCASha256} ` : ''
-  }API_KEY=${
-    apiKey.api_key
-  } sh -c "$(curl ${kibanaUrl}/api/ingest_manager/fleet/install/${currentPlatform})"`;
+  // const quickInstallInstructions = `${
+  //   kibanaCASha256 ? `CA_SHA256=${kibanaCASha256} ` : ''
+  // }API_KEY=${
+  //   apiKey.api_key
+  // } sh -c "$(curl ${kibanaUrl}/api/ingest_manager/fleet/install/${currentPlatform})"`;
+
+  const quickInstallInstructions = `./agent enroll ${kibanaUrl} ${apiKey.api_key}`;
 
   return (
     <>
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_request/agent_config.ts b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_request/agent_config.ts
index d44cc67e2dc4c..d16d835f8c701 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_request/agent_config.ts
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/hooks/use_request/agent_config.ts
@@ -32,6 +32,13 @@ export const useGetOneAgentConfig = (agentConfigId: string) => {
   });
 };
 
+export const useGetOneAgentConfigFull = (agentConfigId: string) => {
+  return useRequest({
+    path: agentConfigRouteService.getInfoFullPath(agentConfigId),
+    method: 'get',
+  });
+};
+
 export const sendGetOneAgentConfig = (agentConfigId: string) => {
   return sendRequest<GetOneAgentConfigResponse>({
     path: agentConfigRouteService.getInfoPath(agentConfigId),
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/components/yaml/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/components/yaml/index.tsx
new file mode 100644
index 0000000000000..57031a3d72abe
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/components/yaml/index.tsx
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { memo } from 'react';
+import { dump } from 'js-yaml';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiTitle,
+  EuiSpacer,
+  EuiText,
+  EuiCodeBlock,
+  EuiFlexGroup,
+  EuiFlexItem,
+} from '@elastic/eui';
+import { AgentConfig } from '../../../../../../../../common/types/models';
+import {
+  useGetOneAgentConfigFull,
+  useGetEnrollmentAPIKeys,
+  useGetOneEnrollmentAPIKey,
+  useCore,
+} from '../../../../../hooks';
+import { ShellEnrollmentInstructions } from '../../../../../components/enrollment_instructions';
+import { Loading } from '../../../../../components';
+
+const CONFIG_KEYS_ORDER = ['id', 'revision', 'outputs', 'datasources'];
+
+export const ConfigYamlView = memo<{ config: AgentConfig }>(({ config }) => {
+  const core = useCore();
+
+  const fullConfigRequest = useGetOneAgentConfigFull(config.id);
+  const apiKeysRequest = useGetEnrollmentAPIKeys();
+  const apiKeyRequest = useGetOneEnrollmentAPIKey(apiKeysRequest.data?.list?.[0].id as string);
+
+  if (fullConfigRequest.isLoading && !fullConfigRequest.data) {
+    return <Loading />;
+  }
+
+  return (
+    <EuiFlexGroup>
+      <EuiFlexItem grow={7}>
+        <EuiCodeBlock language="yaml" isCopyable>
+          {dump(fullConfigRequest.data.item, {
+            sortKeys: (keyA: string, keyB: string) => {
+              return CONFIG_KEYS_ORDER.indexOf(keyA) - CONFIG_KEYS_ORDER.indexOf(keyB);
+            },
+          })}
+        </EuiCodeBlock>
+      </EuiFlexItem>
+      <EuiFlexItem grow={3}>
+        <EuiTitle size="s">
+          <h3>
+            <FormattedMessage
+              id="xpack.ingestManager.yamlConfig.instructionTittle"
+              defaultMessage="Enroll with fleet"
+            />
+          </h3>
+        </EuiTitle>
+        <EuiSpacer size="m" />
+        <EuiText size="s">
+          <FormattedMessage
+            id="xpack.ingestManager.yamlConfig.instructionDescription"
+            defaultMessage="To enroll an agent with this configuration, copy and run the following command on your host."
+          />
+        </EuiText>
+        <EuiSpacer size="m" />
+        {apiKeyRequest.data && (
+          <ShellEnrollmentInstructions
+            apiKey={apiKeyRequest.data.item}
+            kibanaUrl={`${window.location.origin}${core.http.basePath.get()}`}
+          />
+        )}
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+});
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/index.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/index.tsx
index efb96f6459254..450f86df5c03a 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/index.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/agent_config/details_page/index.tsx
@@ -31,6 +31,7 @@ import { LinkedAgentCount } from '../components';
 import { useAgentConfigLink } from './hooks/use_details_uri';
 import { DETAILS_ROUTER_PATH, DETAILS_ROUTER_SUB_PATH } from './constants';
 import { ConfigDatasourcesView } from './components/datasources';
+import { ConfigYamlView } from './components/yaml';
 
 const Divider = styled.div`
   width: 0;
@@ -282,8 +283,7 @@ export const AgentConfigDetailsLayout: React.FunctionComponent = () => {
             <Route
               path={`${DETAILS_ROUTER_PATH}/yaml`}
               render={() => {
-                // TODO: YAML implementation tracked via https://github.com/elastic/kibana/issues/57958
-                return <div>YAML placeholder</div>;
+                return <ConfigYamlView config={agentConfig} />;
               }}
             />
             <Route
diff --git a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/agent_enrollment_flyout/instructions.tsx b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/agent_enrollment_flyout/instructions.tsx
index 97434d2178852..1bc20c2baf660 100644
--- a/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/agent_enrollment_flyout/instructions.tsx
+++ b/x-pack/plugins/ingest_manager/public/applications/ingest_manager/sections/fleet/agent_list_page/components/agent_enrollment_flyout/instructions.tsx
@@ -8,7 +8,10 @@ import { i18n } from '@kbn/i18n';
 import { EuiSpacer, EuiText, EuiButtonGroup, EuiSteps } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { useEnrollmentApiKey } from '../enrollment_api_keys';
-import { ShellEnrollmentInstructions, ManualInstructions } from '../enrollment_instructions';
+import {
+  ShellEnrollmentInstructions,
+  ManualInstructions,
+} from '../../../../../components/enrollment_instructions';
 import { useCore, useGetAgents } from '../../../../../hooks';
 import { Loading } from '../../../components';
 
diff --git a/x-pack/plugins/ingest_manager/server/plugin.ts b/x-pack/plugins/ingest_manager/server/plugin.ts
index 67737c6fe502e..45c847fe1f68a 100644
--- a/x-pack/plugins/ingest_manager/server/plugin.ts
+++ b/x-pack/plugins/ingest_manager/server/plugin.ts
@@ -88,6 +88,7 @@ export class IngestManagerPlugin implements Plugin {
         privileges: {
           all: {
             api: [`${PLUGIN_ID}-read`, `${PLUGIN_ID}-all`],
+            app: [PLUGIN_ID, 'kibana'],
             savedObject: {
               all: allSavedObjectTypes,
               read: [],
@@ -96,6 +97,7 @@ export class IngestManagerPlugin implements Plugin {
           },
           read: {
             api: [`${PLUGIN_ID}-read`],
+            app: [PLUGIN_ID, 'kibana'],
             savedObject: {
               all: [],
               read: allSavedObjectTypes,
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/__snapshots__/install.test.ts.snap b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/__snapshots__/install.test.ts.snap
index 79f778f9bba8f..d063ebe92f938 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/__snapshots__/install.test.ts.snap
+++ b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/__snapshots__/install.test.ts.snap
@@ -565,372 +565,6 @@ exports[`creating index patterns from yaml fields createIndexPatternFields funct
 }
 `;
 
-exports[`creating index patterns from yaml fields dedupFields function remove duplicated fields when parsing multiple files: dedupeFields 1`] = `
-[
-  {
-    "name": "coredns",
-    "type": "group",
-    "description": "coredns fields after normalization\\n",
-    "fields": [
-      {
-        "name": "id",
-        "type": "keyword",
-        "description": "id of the DNS transaction\\n"
-      },
-      {
-        "name": "allParams",
-        "type": "integer",
-        "format": "bytes",
-        "pattern": "patternValQueryWeight",
-        "input_format": "inputFormatVal,",
-        "output_format": "outputFormalVal,",
-        "output_precision": "3,",
-        "label_template": "labelTemplateVal,",
-        "url_template": "urlTemplateVal,",
-        "openLinkInCurrentTab": "true,",
-        "description": "weight of the DNS query\\n"
-      },
-      {
-        "name": "query.length",
-        "type": "integer",
-        "pattern": "patternValQueryLength",
-        "description": "length of the DNS query\\n"
-      },
-      {
-        "name": "query.size",
-        "type": "integer",
-        "format": "bytes",
-        "pattern": "patternValQuerySize",
-        "description": "size of the DNS query\\n"
-      },
-      {
-        "name": "query.class",
-        "type": "keyword",
-        "description": "DNS query class\\n"
-      },
-      {
-        "name": "query.name",
-        "type": "keyword",
-        "description": "DNS query name\\n"
-      },
-      {
-        "name": "query.type",
-        "type": "keyword",
-        "description": "DNS query type\\n"
-      },
-      {
-        "name": "response.code",
-        "type": "keyword",
-        "description": "DNS response code\\n"
-      },
-      {
-        "name": "response.flags",
-        "type": "keyword",
-        "description": "DNS response flags\\n"
-      },
-      {
-        "name": "response.size",
-        "type": "integer",
-        "format": "bytes",
-        "description": "size of the DNS response\\n"
-      },
-      {
-        "name": "dnssec_ok",
-        "type": "boolean",
-        "description": "dnssec flag\\n"
-      }
-    ]
-  },
-  {
-    "name": "@timestamp",
-    "level": "core",
-    "required": true,
-    "type": "date",
-    "description": "Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events.",
-    "example": "2016-05-23T08:05:34.853Z"
-  },
-  {
-    "name": "labels",
-    "level": "core",
-    "type": "object",
-    "object_type": "keyword",
-    "description": "Custom key/value pairs. Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. Example: \`docker\` and \`k8s\` labels.",
-    "example": {
-      "application": "foo-bar",
-      "env": "production"
-    }
-  },
-  {
-    "name": "message",
-    "level": "core",
-    "type": "text",
-    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.",
-    "example": "Hello World"
-  },
-  {
-    "name": "tags",
-    "level": "core",
-    "type": "keyword",
-    "ignore_above": 1024,
-    "description": "List of keywords used to tag each event.",
-    "example": "[\\"production\\", \\"env2\\"]"
-  },
-  {
-    "name": "agent",
-    "title": "Agent",
-    "group": 2,
-    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host. Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server.",
-    "type": "group",
-    "fields": [
-      {
-        "name": "ephemeral_id",
-        "level": "extended",
-        "type": "keyword",
-        "ignore_above": 1024,
-        "description": "Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but \`agent.id\` does not.",
-        "example": "8a4f500f"
-      },
-      {
-        "name": "id",
-        "level": "core",
-        "type": "keyword",
-        "ignore_above": 1024,
-        "description": "Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id.",
-        "example": "8a4f500d"
-      },
-      {
-        "name": "name",
-        "level": "core",
-        "type": "keyword",
-        "ignore_above": 1024,
-        "description": "Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.",
-        "example": "foo"
-      },
-      {
-        "name": "type",
-        "level": "core",
-        "type": "keyword",
-        "ignore_above": 1024,
-        "description": "Type of the agent. The agent type stays always the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "example": "filebeat"
-      },
-      {
-        "name": "version",
-        "level": "core",
-        "type": "keyword",
-        "ignore_above": 1024,
-        "description": "Version of the agent.",
-        "example": "6.0.0-rc2"
-      }
-    ]
-  },
-  {
-    "name": "as",
-    "title": "Autonomous System",
-    "group": 2,
-    "description": "An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet.",
-    "type": "group",
-    "fields": [
-      {
-        "name": "number",
-        "level": "extended",
-        "type": "long",
-        "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
-        "example": 15169
-      },
-      {
-        "name": "organization.name",
-        "level": "extended",
-        "type": "keyword",
-        "ignore_above": 1024,
-        "description": "Organization name.",
-        "example": "Google LLC"
-      }
-    ]
-  },
-  {
-    "name": "nginx.access",
-    "type": "group",
-    "description": "Contains fields for the Nginx access logs.\\n",
-    "fields": [
-      {
-        "name": "group_disabled",
-        "type": "group",
-        "enabled": false,
-        "fields": [
-          {
-            "name": "message",
-            "type": "text"
-          }
-        ]
-      },
-      {
-        "name": "remote_ip_list",
-        "type": "array",
-        "description": "An array of remote IP addresses. It is a list because it is common to include, besides the client IP address, IP addresses from headers like \`X-Forwarded-For\`. Real source IP is restored to \`source.ip\`.\\n"
-      },
-      {
-        "name": "body_sent.bytes",
-        "type": "alias",
-        "path": "http.response.body.bytes",
-        "migration": true
-      },
-      {
-        "name": "user_name",
-        "type": "alias",
-        "path": "user.name",
-        "migration": true
-      },
-      {
-        "name": "method",
-        "type": "alias",
-        "path": "http.request.method",
-        "migration": true
-      },
-      {
-        "name": "url",
-        "type": "alias",
-        "path": "url.original",
-        "migration": true
-      },
-      {
-        "name": "http_version",
-        "type": "alias",
-        "path": "http.version",
-        "migration": true
-      },
-      {
-        "name": "response_code",
-        "type": "alias",
-        "path": "http.response.status_code",
-        "migration": true
-      },
-      {
-        "name": "referrer",
-        "type": "alias",
-        "path": "http.request.referrer",
-        "migration": true
-      },
-      {
-        "name": "agent",
-        "type": "alias",
-        "path": "user_agent.original",
-        "migration": true
-      },
-      {
-        "name": "user_agent",
-        "type": "group",
-        "fields": [
-          {
-            "name": "device",
-            "type": "alias",
-            "path": "user_agent.device.name",
-            "migration": true
-          },
-          {
-            "name": "name",
-            "type": "alias",
-            "path": "user_agent.name",
-            "migration": true
-          },
-          {
-            "name": "os",
-            "type": "alias",
-            "path": "user_agent.os.full_name",
-            "migration": true
-          },
-          {
-            "name": "os_name",
-            "type": "alias",
-            "path": "user_agent.os.name",
-            "migration": true
-          },
-          {
-            "name": "original",
-            "type": "alias",
-            "path": "user_agent.original",
-            "migration": true
-          }
-        ]
-      },
-      {
-        "name": "geoip",
-        "type": "group",
-        "fields": [
-          {
-            "name": "continent_name",
-            "type": "alias",
-            "path": "source.geo.continent_name",
-            "migration": true
-          },
-          {
-            "name": "country_iso_code",
-            "type": "alias",
-            "path": "source.geo.country_iso_code",
-            "migration": true
-          },
-          {
-            "name": "location",
-            "type": "alias",
-            "path": "source.geo.location",
-            "migration": true
-          },
-          {
-            "name": "region_name",
-            "type": "alias",
-            "path": "source.geo.region_name",
-            "migration": true
-          },
-          {
-            "name": "city_name",
-            "type": "alias",
-            "path": "source.geo.city_name",
-            "migration": true
-          },
-          {
-            "name": "region_iso_code",
-            "type": "alias",
-            "path": "source.geo.region_iso_code",
-            "migration": true
-          }
-        ]
-      }
-    ]
-  },
-  {
-    "name": "source",
-    "type": "group",
-    "fields": [
-      {
-        "name": "geo",
-        "type": "group",
-        "fields": [
-          {
-            "name": "continent_name",
-            "type": "text"
-          }
-        ]
-      }
-    ]
-  },
-  {
-    "name": "country",
-    "type": "",
-    "multi_fields": [
-      {
-        "name": "keyword",
-        "type": "keyword"
-      },
-      {
-        "name": "text",
-        "type": "text"
-      }
-    ]
-  }
-]
-`;
-
 exports[`creating index patterns from yaml fields flattenFields function flattens recursively and handles copying alias fields: flattenFields 1`] = `
 [
   {
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/install.test.ts b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/install.test.ts
index 5e883772957d2..bc1694348b4c2 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/install.test.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/install.test.ts
@@ -19,6 +19,7 @@ import {
   createIndexPattern,
 } from './install';
 import { Fields, Field } from '../../fields/field';
+import { dupeFields } from './tests/test_data';
 
 // Add our own serialiser to just do JSON.stringify
 expect.addSnapshotSerializer({
@@ -60,9 +61,31 @@ describe('creating index patterns from yaml fields', () => {
     expect(flattened).toMatchSnapshot('flattenFields');
   });
 
-  test('dedupFields function remove duplicated fields when parsing multiple files', () => {
-    const deduped = dedupeFields(fields);
-    expect(deduped).toMatchSnapshot('dedupeFields');
+  describe('dedupFields', () => {
+    const deduped = dedupeFields(dupeFields);
+    const checkIfDup = (field: Field) => {
+      return deduped.filter(item => item.name === field.name);
+    };
+    test('there there is one field object with name of "1"', () => {
+      expect(checkIfDup({ name: '1' }).length).toBe(1);
+    });
+    test('there there is one field object with name of "1.1"', () => {
+      expect(checkIfDup({ name: '1.1' }).length).toBe(1);
+    });
+    test('there there is one field object with name of "2"', () => {
+      expect(checkIfDup({ name: '2' }).length).toBe(1);
+    });
+    test('there there is one field object with name of "4"', () => {
+      expect(checkIfDup({ name: '4' }).length).toBe(1);
+    });
+    // existing field takes precendence
+    test('the new merged field has correct attributes', () => {
+      const mergedField = deduped.find(field => field.name === '1');
+      expect(mergedField?.searchable).toBe(true);
+      expect(mergedField?.aggregatable).toBe(true);
+      expect(mergedField?.analyzed).toBe(true);
+      expect(mergedField?.count).toBe(0);
+    });
   });
 
   describe('getFieldByPath searches recursively for field in fields given dot separated path', () => {
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/install.ts b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/install.ts
index 7aecc408e05fe..0657fb7759b49 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/install.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/install.ts
@@ -78,8 +78,12 @@ export async function installIndexPatterns(
     savedObjectsClient,
     InstallationStatus.installed
   );
-  // add this package
-  if (pkgkey) installedPackages.push(pkgkey);
+  // add this package to the array if it doesn't already exist
+  // this should not happen because a user can't "reinstall" a package
+  // if it does because the install endpoint is called directly, the install continues
+  if (pkgkey && !installedPackages.includes(pkgkey)) {
+    installedPackages.push(pkgkey);
+  }
 
   // get each package's registry info
   const installedPackagesFetchInfoPromise = installedPackages.map(pkg => Registry.fetchInfo(pkg));
@@ -151,17 +155,29 @@ export const createIndexPattern = (indexPatternType: string, fields: Fields) =>
 export const createIndexPatternFields = (
   fields: Fields
 ): { indexPatternFields: IndexPatternField[]; fieldFormatMap: FieldFormatMap } => {
-  const dedupedFields = dedupeFields(fields);
-  const flattenedFields = flattenFields(dedupedFields);
+  const flattenedFields = flattenFields(fields);
   const fieldFormatMap = createFieldFormatMap(flattenedFields);
   const transformedFields = flattenedFields.map(transformField);
-  return { indexPatternFields: transformedFields, fieldFormatMap };
+  const dedupedFields = dedupeFields(transformedFields);
+  return { indexPatternFields: dedupedFields, fieldFormatMap };
 };
 
-export const dedupeFields = (fields: Fields) => {
-  const uniqueObj = fields.reduce<{ [name: string]: Field }>((acc, field) => {
+// merges fields that are duplicates with the existing taking precedence
+export const dedupeFields = (fields: IndexPatternField[]) => {
+  const uniqueObj = fields.reduce<{ [name: string]: IndexPatternField }>((acc, field) => {
+    // if field doesn't exist yet
     if (!acc[field.name]) {
       acc[field.name] = field;
+      // if field exists already
+    } else {
+      const existingField = acc[field.name];
+      // if the existing field and this field have the same type, merge
+      if (existingField.type === field.type) {
+        const mergedField = { ...field, ...existingField };
+        acc[field.name] = mergedField;
+      } else {
+        // log when there is a dup with different types
+      }
     }
     return acc;
   }, {});
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/tests/test_data.ts b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/tests/test_data.ts
new file mode 100644
index 0000000000000..13bef1b6ddb2c
--- /dev/null
+++ b/x-pack/plugins/ingest_manager/server/services/epm/kibana/index_pattern/tests/test_data.ts
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IndexPatternField } from '../install';
+
+export const dupeFields: IndexPatternField[] = [
+  {
+    name: '1',
+    type: 'integer',
+    searchable: true,
+    aggregatable: true,
+    count: 0,
+    indexed: true,
+    doc_values: true,
+    scripted: false,
+    analyzed: true,
+  },
+  {
+    name: '2',
+    type: 'integer',
+    searchable: true,
+    aggregatable: true,
+    count: 0,
+    indexed: true,
+    doc_values: true,
+    scripted: false,
+    analyzed: true,
+  },
+  {
+    name: '3',
+    type: 'integer',
+    searchable: true,
+    aggregatable: true,
+    count: 0,
+    indexed: true,
+    doc_values: true,
+    scripted: false,
+    analyzed: true,
+  },
+  {
+    name: '1',
+    type: 'integer',
+    searchable: false,
+    aggregatable: false,
+    count: 2,
+    indexed: true,
+    doc_values: true,
+    scripted: false,
+    analyzed: true,
+  },
+  {
+    name: '1.1',
+    type: 'integer',
+    searchable: false,
+    aggregatable: false,
+    count: 0,
+    indexed: true,
+    doc_values: true,
+    scripted: false,
+    analyzed: true,
+  },
+  {
+    name: '4',
+    type: 'integer',
+    searchable: false,
+    aggregatable: false,
+    count: 0,
+    indexed: true,
+    doc_values: true,
+    scripted: false,
+    analyzed: true,
+  },
+  {
+    name: '2',
+    type: 'integer',
+    searchable: false,
+    aggregatable: false,
+    count: 0,
+    indexed: true,
+    doc_values: true,
+    scripted: false,
+    analyzed: true,
+  },
+  {
+    name: '1',
+    type: 'integer',
+    searchable: false,
+    aggregatable: false,
+    count: 1,
+    indexed: true,
+    doc_values: true,
+    scripted: false,
+    analyzed: false,
+  },
+];
diff --git a/x-pack/plugins/ingest_manager/server/services/epm/packages/assets.ts b/x-pack/plugins/ingest_manager/server/services/epm/packages/assets.ts
index ecc882d9c2e70..e36c2de1b4e80 100644
--- a/x-pack/plugins/ingest_manager/server/services/epm/packages/assets.ts
+++ b/x-pack/plugins/ingest_manager/server/services/epm/packages/assets.ts
@@ -35,8 +35,7 @@ export function getAssets(
 
     // if dataset, filter for them
     if (datasetName) {
-      // TODO: Filter for dataset path
-      const comparePath = `${EPR_PATH_PREFIX}/${packageInfo.name}-${packageInfo.version}/dataset/${datasetName}`;
+      const comparePath = `${EPR_PATH_PREFIX}/${packageInfo.name}-${packageInfo.version}/dataset/${datasetName}/`;
       if (!path.includes(comparePath)) {
         continue;
       }
diff --git a/x-pack/plugins/license_management/public/application/lib/telemetry.ts b/x-pack/plugins/license_management/public/application/lib/telemetry.ts
index 1d90fce6f6b9a..823680a36dccb 100644
--- a/x-pack/plugins/license_management/public/application/lib/telemetry.ts
+++ b/x-pack/plugins/license_management/public/application/lib/telemetry.ts
@@ -6,7 +6,7 @@
 
 import { TelemetryPluginSetup } from '../../../../../../src/plugins/telemetry/public';
 
-export { OptInExampleFlyout } from '../../../../../../src/plugins/telemetry/public/components';
+export { OptInExampleFlyout } from '../../../../../../src/plugins/telemetry_management_section/public/components';
 export { PRIVACY_STATEMENT_URL } from '../../../../../../src/plugins/telemetry/common/constants';
 export { TelemetryPluginSetup, shouldShowTelemetryOptIn };
 
diff --git a/x-pack/plugins/maps/common/constants.ts b/x-pack/plugins/maps/common/constants.ts
index fecf8db0e85de..12b03f0386304 100644
--- a/x-pack/plugins/maps/common/constants.ts
+++ b/x-pack/plugins/maps/common/constants.ts
@@ -43,13 +43,13 @@ export function createMapPath(id: string) {
   return `${MAP_BASE_URL}/${id}`;
 }
 
-export const LAYER_TYPE = {
-  TILE: 'TILE',
-  VECTOR: 'VECTOR',
-  VECTOR_TILE: 'VECTOR_TILE',
-  HEATMAP: 'HEATMAP',
-  BLENDED_VECTOR: 'BLENDED_VECTOR',
-};
+export enum LAYER_TYPE {
+  TILE = 'TILE',
+  VECTOR = 'VECTOR',
+  VECTOR_TILE = 'VECTOR_TILE',
+  HEATMAP = 'HEATMAP',
+  BLENDED_VECTOR = 'BLENDED_VECTOR',
+}
 
 export enum SORT_ORDER {
   ASC = 'asc',
diff --git a/x-pack/plugins/ml/common/types/anomalies.ts b/x-pack/plugins/ml/common/types/anomalies.ts
index 7a648a82dbae0..639d9b3b25fae 100644
--- a/x-pack/plugins/ml/common/types/anomalies.ts
+++ b/x-pack/plugins/ml/common/types/anomalies.ts
@@ -36,3 +36,20 @@ export interface AnomalyRecordDoc {
   // TODO provide the causes resource interface.
   causes?: any[];
 }
+
+export interface AnomaliesTableRecord {
+  time: number;
+  source: AnomalyRecordDoc;
+  rowId: string;
+  jobId: string;
+  detectorIndex: number;
+  severity: number;
+  entityName?: string;
+  entityValue?: any;
+  influencers?: Array<{ [key: string]: any }>;
+  actual?: number[];
+  actualSort?: any;
+  typical?: number[];
+  typicalSort?: any;
+  metricDescriptionSort?: number;
+}
diff --git a/x-pack/plugins/ml/common/types/data_recognizer.ts b/x-pack/plugins/ml/common/types/data_recognizer.ts
new file mode 100644
index 0000000000000..2f77cc8c33896
--- /dev/null
+++ b/x-pack/plugins/ml/common/types/data_recognizer.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface JobStat {
+  id: string;
+  earliestTimestampMs: number;
+  latestTimestampMs: number;
+  latestResultsTimestampMs: number;
+}
+
+export interface JobExistResult {
+  jobsExist: boolean;
+  jobs: JobStat[];
+}
diff --git a/x-pack/plugins/ml/common/types/modules.ts b/x-pack/plugins/ml/common/types/modules.ts
index e61ff9972d601..b476762f6efca 100644
--- a/x-pack/plugins/ml/common/types/modules.ts
+++ b/x-pack/plugins/ml/common/types/modules.ts
@@ -90,8 +90,14 @@ export interface DataRecognizerConfigResponse {
   };
 }
 
-export type GeneralOverride = any;
-
 export type JobOverride = Partial<Job>;
+export type GeneralJobsOverride = Omit<JobOverride, 'job_id'>;
+export type JobSpecificOverride = JobOverride & { job_id: Job['job_id'] };
+
+export function isGeneralJobOverride(override: JobOverride): override is GeneralJobsOverride {
+  return override.job_id === undefined;
+}
+
+export type GeneralDatafeedsOverride = Partial<Omit<Datafeed, 'job_id' | 'datafeed_id'>>;
 
 export type DatafeedOverride = Partial<Datafeed>;
diff --git a/x-pack/plugins/ml/public/application/app.tsx b/x-pack/plugins/ml/public/application/app.tsx
index 6269c11fca896..8c3e0c066f411 100644
--- a/x-pack/plugins/ml/public/application/app.tsx
+++ b/x-pack/plugins/ml/public/application/app.tsx
@@ -23,45 +23,16 @@ type MlDependencies = MlSetupDependencies & MlStartDependencies;
 interface AppProps {
   coreStart: CoreStart;
   deps: MlDependencies;
-  appMountParams: AppMountParameters;
 }
 
 const localStorage = new Storage(window.localStorage);
 
-const App: FC<AppProps> = ({ coreStart, deps, appMountParams }) => {
-  setDependencyCache({
-    indexPatterns: deps.data.indexPatterns,
-    timefilter: deps.data.query.timefilter,
-    fieldFormats: deps.data.fieldFormats,
-    autocomplete: deps.data.autocomplete,
-    config: coreStart.uiSettings!,
-    chrome: coreStart.chrome!,
-    docLinks: coreStart.docLinks!,
-    toastNotifications: coreStart.notifications.toasts,
-    overlays: coreStart.overlays,
-    recentlyAccessed: coreStart.chrome!.recentlyAccessed,
-    basePath: coreStart.http.basePath,
-    savedObjectsClient: coreStart.savedObjects.client,
-    application: coreStart.application,
-    http: coreStart.http,
-    security: deps.security,
-    urlGenerators: deps.share.urlGenerators,
-  });
-
-  const mlLicense = setLicenseCache(deps.licensing);
-
-  appMountParams.onAppLeave(actions => {
-    mlLicense.unsubscribe();
-    clearCache();
-    return actions.default();
-  });
-
+const App: FC<AppProps> = ({ coreStart, deps }) => {
   const pageDeps = {
     indexPatterns: deps.data.indexPatterns,
     config: coreStart.uiSettings!,
     setBreadcrumbs: coreStart.chrome!.setBreadcrumbs,
   };
-
   const services = {
     appName: 'ML',
     data: deps.data,
@@ -85,10 +56,34 @@ export const renderApp = (
   deps: MlDependencies,
   appMountParams: AppMountParameters
 ) => {
-  ReactDOM.render(
-    <App coreStart={coreStart} deps={deps} appMountParams={appMountParams} />,
-    appMountParams.element
-  );
+  setDependencyCache({
+    indexPatterns: deps.data.indexPatterns,
+    timefilter: deps.data.query.timefilter,
+    fieldFormats: deps.data.fieldFormats,
+    autocomplete: deps.data.autocomplete,
+    config: coreStart.uiSettings!,
+    chrome: coreStart.chrome!,
+    docLinks: coreStart.docLinks!,
+    toastNotifications: coreStart.notifications.toasts,
+    overlays: coreStart.overlays,
+    recentlyAccessed: coreStart.chrome!.recentlyAccessed,
+    basePath: coreStart.http.basePath,
+    savedObjectsClient: coreStart.savedObjects.client,
+    application: coreStart.application,
+    http: coreStart.http,
+    security: deps.security,
+    urlGenerators: deps.share.urlGenerators,
+  });
 
-  return () => ReactDOM.unmountComponentAtNode(appMountParams.element);
+  const mlLicense = setLicenseCache(deps.licensing);
+
+  appMountParams.onAppLeave(actions => actions.default());
+
+  ReactDOM.render(<App coreStart={coreStart} deps={deps} />, appMountParams.element);
+
+  return () => {
+    mlLicense.unsubscribe();
+    clearCache();
+    ReactDOM.unmountComponentAtNode(appMountParams.element);
+  };
 };
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_job_flyout.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_job_flyout.js
index aec57e0d33cdd..29c79458fe431 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_job_flyout.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/edit_job_flyout.js
@@ -31,6 +31,7 @@ import { withKibana } from '../../../../../../../../../src/plugins/kibana_react/
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { collapseLiteralStrings } from '../../../../../../shared_imports';
+import { DATAFEED_STATE } from '../../../../../../common/constants/states';
 
 export class EditJobFlyoutUI extends Component {
   _initialJobFormState = null;
@@ -41,6 +42,7 @@ export class EditJobFlyoutUI extends Component {
     this.state = {
       job: {},
       hasDatafeed: false,
+      datafeedRunning: false,
       isFlyoutVisible: false,
       isConfirmationModalVisible: false,
       jobDescription: '',
@@ -157,10 +159,12 @@ export class EditJobFlyoutUI extends Component {
 
   extractJob(job, hasDatafeed) {
     this.extractInitialJobFormState(job, hasDatafeed);
+    const datafeedRunning = hasDatafeed && job.datafeed_config.state !== DATAFEED_STATE.STOPPED;
 
     this.setState({
       job,
       hasDatafeed,
+      datafeedRunning,
       jobModelMemoryLimitValidationError: '',
       jobGroupsValidationError: '',
       ...cloneDeep(this._initialJobFormState),
@@ -283,6 +287,7 @@ export class EditJobFlyoutUI extends Component {
         jobModelMemoryLimitValidationError,
         isValidJobDetails,
         isValidJobCustomUrls,
+        datafeedRunning,
       } = this.state;
 
       const tabs = [
@@ -293,6 +298,7 @@ export class EditJobFlyoutUI extends Component {
           }),
           content: (
             <JobDetails
+              datafeedRunning={datafeedRunning}
               jobDescription={jobDescription}
               jobGroups={jobGroups}
               jobModelMemoryLimit={jobModelMemoryLimit}
@@ -328,6 +334,7 @@ export class EditJobFlyoutUI extends Component {
               datafeedScrollSize={datafeedScrollSize}
               jobBucketSpan={jobBucketSpan}
               setDatafeed={this.setDatafeed}
+              datafeedRunning={datafeedRunning}
             />
           ),
         },
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/datafeed.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/datafeed.js
index 096a03621d422..3d81b767021a0 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/datafeed.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/datafeed.js
@@ -7,7 +7,14 @@
 import PropTypes from 'prop-types';
 import React, { Component } from 'react';
 
-import { EuiFieldText, EuiForm, EuiFormRow, EuiSpacer, EuiFieldNumber } from '@elastic/eui';
+import {
+  EuiFieldText,
+  EuiForm,
+  EuiFormRow,
+  EuiSpacer,
+  EuiFieldNumber,
+  EuiCallOut,
+} from '@elastic/eui';
 
 import { calculateDatafeedFrequencyDefaultSeconds } from '../../../../../../../common/util/job_utils';
 import { getNewJobDefaults } from '../../../../../services/ml_server_info';
@@ -72,9 +79,21 @@ export class Datafeed extends Component {
 
   render() {
     const { query, queryDelay, frequency, scrollSize, defaults } = this.state;
+    const { datafeedRunning } = this.props;
     return (
       <React.Fragment>
         <EuiSpacer size="m" />
+        {datafeedRunning && (
+          <>
+            <EuiCallOut color="warning">
+              <FormattedMessage
+                id="xpack.ml.jobsList.editJobFlyout.datafeed.readOnlyCalloutText"
+                defaultMessage="Datafeed settings cannot be edited while the datafeed is running. Please stop the job if you wish to edit these settings."
+              />
+            </EuiCallOut>
+            <EuiSpacer size="l" />
+          </>
+        )}
         <EuiForm>
           <EuiFormRow
             label={
@@ -90,6 +109,7 @@ export class Datafeed extends Component {
               value={query}
               onChange={this.onQueryChange}
               height="200px"
+              readOnly={datafeedRunning}
             />
           </EuiFormRow>
           <EuiFormRow
@@ -104,6 +124,7 @@ export class Datafeed extends Component {
               value={queryDelay}
               placeholder={defaults.queryDelay}
               onChange={this.onQueryDelayChange}
+              disabled={datafeedRunning}
             />
           </EuiFormRow>
           <EuiFormRow
@@ -118,6 +139,7 @@ export class Datafeed extends Component {
               value={frequency}
               placeholder={defaults.frequency}
               onChange={this.onFrequencyChange}
+              disabled={datafeedRunning}
             />
           </EuiFormRow>
           <EuiFormRow
@@ -132,6 +154,7 @@ export class Datafeed extends Component {
               value={scrollSize}
               placeholder={defaults.scrollSize}
               onChange={this.onScrollSizeChange}
+              disabled={datafeedRunning}
             />
           </EuiFormRow>
         </EuiForm>
@@ -140,6 +163,7 @@ export class Datafeed extends Component {
   }
 }
 Datafeed.propTypes = {
+  datafeedRunning: PropTypes.bool.isRequired,
   datafeedQuery: PropTypes.string.isRequired,
   datafeedQueryDelay: PropTypes.string.isRequired,
   datafeedFrequency: PropTypes.string.isRequired,
diff --git a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/job_details.js b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/job_details.js
index a609d6a7c3fba..672fd8cefaaba 100644
--- a/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/job_details.js
+++ b/x-pack/plugins/ml/public/application/jobs/jobs_list/components/edit_job_flyout/tabs/job_details.js
@@ -105,6 +105,7 @@ export class JobDetails extends Component {
       mmlValidationError,
       groupsValidationError,
     } = this.state;
+    const { datafeedRunning } = this.props;
     return (
       <React.Fragment>
         <EuiSpacer size="m" />
@@ -152,6 +153,14 @@ export class JobDetails extends Component {
                 defaultMessage="Model memory limit"
               />
             }
+            helpText={
+              datafeedRunning ? (
+                <FormattedMessage
+                  id="xpack.ml.jobsList.editJobFlyout.jobDetails.modelMemoryLimitLabelHelp"
+                  defaultMessage="Model memory limit cannot be edited while the datafeed is running."
+                />
+              ) : null
+            }
             isInvalid={mmlValidationError !== ''}
             error={mmlValidationError}
           >
@@ -160,6 +169,7 @@ export class JobDetails extends Component {
               onChange={this.onMmlChange}
               isInvalid={mmlValidationError !== ''}
               error={mmlValidationError}
+              disabled={datafeedRunning}
             />
           </EuiFormRow>
         </EuiForm>
@@ -168,6 +178,7 @@ export class JobDetails extends Component {
   }
 }
 JobDetails.propTypes = {
+  datafeedRunning: PropTypes.bool.isRequired,
   jobDescription: PropTypes.string.isRequired,
   jobGroups: PropTypes.array.isRequired,
   jobModelMemoryLimit: PropTypes.string.isRequired,
diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx
index 50c35ec426acb..9b76b9be9bf45 100644
--- a/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx
+++ b/x-pack/plugins/ml/public/application/jobs/new_job/recognize/page.tsx
@@ -172,6 +172,7 @@ export const Page: FC<PageProps> = ({ moduleId, existingGroupIds }) => {
         startDatafeed: startDatafeedAfterSave,
         ...(jobOverridesPayload !== null ? { jobOverrides: jobOverridesPayload } : {}),
         ...resultTimeRange,
+        estimateModelMemory: false,
       });
       const { datafeeds: datafeedsResponse, jobs: jobsResponse, kibana: kibanaResponse } = response;
 
diff --git a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
index cd4a97bd10ed4..df59678452e2f 100644
--- a/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
+++ b/x-pack/plugins/ml/public/application/services/ml_api_service/index.ts
@@ -367,6 +367,7 @@ export const ml = {
     start,
     end,
     jobOverrides,
+    estimateModelMemory,
   }: {
     moduleId: string;
     prefix?: string;
@@ -378,6 +379,7 @@ export const ml = {
     start?: number;
     end?: number;
     jobOverrides?: Array<Partial<Job>>;
+    estimateModelMemory?: boolean;
   }) {
     const body = JSON.stringify({
       prefix,
@@ -389,6 +391,7 @@ export const ml = {
       start,
       end,
       jobOverrides,
+      estimateModelMemory,
     });
 
     return http<DataRecognizerConfigResponse>({
diff --git a/x-pack/plugins/ml/server/models/calculate_model_memory_limit/calculate_model_memory_limit.ts b/x-pack/plugins/ml/server/models/calculate_model_memory_limit/calculate_model_memory_limit.ts
index c97bbe07fffda..cd61dd9eddcdd 100644
--- a/x-pack/plugins/ml/server/models/calculate_model_memory_limit/calculate_model_memory_limit.ts
+++ b/x-pack/plugins/ml/server/models/calculate_model_memory_limit/calculate_model_memory_limit.ts
@@ -6,6 +6,7 @@
 
 import numeral from '@elastic/numeral';
 import { APICaller } from 'kibana/server';
+import { MLCATEGORY } from '../../../common/constants/field_types';
 import { AnalysisConfig } from '../../../common/types/anomaly_detection_jobs';
 import { fieldsServiceProvider } from '../fields_service';
 
@@ -34,92 +35,96 @@ export interface ModelMemoryEstimate {
 /**
  * Retrieves overall and max bucket cardinalities.
  */
-async function getCardinalities(
-  callAsCurrentUser: APICaller,
-  analysisConfig: AnalysisConfig,
-  indexPattern: string,
-  query: any,
-  timeFieldName: string,
-  earliestMs: number,
-  latestMs: number
-): Promise<{
-  overallCardinality: { [key: string]: number };
-  maxBucketCardinality: { [key: string]: number };
-}> {
-  /**
-   * Fields not involved in cardinality check
-   */
-  const excludedKeywords = new Set<string>(
-    /**
-     * The keyword which is used to mean the output of categorization,
-     * so it will have cardinality zero in the actual input data.
-     */
-    'mlcategory'
-  );
-
+const cardinalityCheckProvider = (callAsCurrentUser: APICaller) => {
   const fieldsService = fieldsServiceProvider(callAsCurrentUser);
 
-  const { detectors, influencers, bucket_span: bucketSpan } = analysisConfig;
-
-  let overallCardinality = {};
-  let maxBucketCardinality = {};
-  const overallCardinalityFields: Set<string> = detectors.reduce(
-    (
-      acc,
-      {
-        by_field_name: byFieldName,
-        partition_field_name: partitionFieldName,
-        over_field_name: overFieldName,
-      }
-    ) => {
-      [byFieldName, partitionFieldName, overFieldName]
-        .filter(field => field !== undefined && field !== '' && !excludedKeywords.has(field))
-        .forEach(key => {
-          acc.add(key as string);
-        });
-      return acc;
-    },
-    new Set<string>()
-  );
-
-  const maxBucketFieldCardinalities: string[] = influencers.filter(
-    influencerField =>
-      typeof influencerField === 'string' &&
-      !excludedKeywords.has(influencerField) &&
-      !!influencerField &&
-      !overallCardinalityFields.has(influencerField)
-  ) as string[];
-
-  if (overallCardinalityFields.size > 0) {
-    overallCardinality = await fieldsService.getCardinalityOfFields(
-      indexPattern,
-      [...overallCardinalityFields],
-      query,
-      timeFieldName,
-      earliestMs,
-      latestMs
+  return async (
+    analysisConfig: AnalysisConfig,
+    indexPattern: string,
+    query: any,
+    timeFieldName: string,
+    earliestMs: number,
+    latestMs: number
+  ): Promise<{
+    overallCardinality: { [key: string]: number };
+    maxBucketCardinality: { [key: string]: number };
+  }> => {
+    /**
+     * Fields not involved in cardinality check
+     */
+    const excludedKeywords = new Set<string>(
+      /**
+       * The keyword which is used to mean the output of categorization,
+       * so it will have cardinality zero in the actual input data.
+       */
+      MLCATEGORY
     );
-  }
 
-  if (maxBucketFieldCardinalities.length > 0) {
-    maxBucketCardinality = await fieldsService.getMaxBucketCardinalities(
-      indexPattern,
-      maxBucketFieldCardinalities,
-      query,
-      timeFieldName,
-      earliestMs,
-      latestMs,
-      bucketSpan
+    const { detectors, influencers, bucket_span: bucketSpan } = analysisConfig;
+
+    let overallCardinality = {};
+    let maxBucketCardinality = {};
+
+    // Get fields required for the model memory estimation
+    const overallCardinalityFields: Set<string> = detectors.reduce(
+      (
+        acc,
+        {
+          by_field_name: byFieldName,
+          partition_field_name: partitionFieldName,
+          over_field_name: overFieldName,
+        }
+      ) => {
+        [byFieldName, partitionFieldName, overFieldName]
+          .filter(field => field !== undefined && field !== '' && !excludedKeywords.has(field))
+          .forEach(key => {
+            acc.add(key as string);
+          });
+        return acc;
+      },
+      new Set<string>()
     );
-  }
 
-  return {
-    overallCardinality,
-    maxBucketCardinality,
+    const maxBucketFieldCardinalities: string[] = influencers.filter(
+      influencerField =>
+        !!influencerField &&
+        !excludedKeywords.has(influencerField) &&
+        !overallCardinalityFields.has(influencerField)
+    ) as string[];
+
+    if (overallCardinalityFields.size > 0) {
+      overallCardinality = await fieldsService.getCardinalityOfFields(
+        indexPattern,
+        [...overallCardinalityFields],
+        query,
+        timeFieldName,
+        earliestMs,
+        latestMs
+      );
+    }
+
+    if (maxBucketFieldCardinalities.length > 0) {
+      maxBucketCardinality = await fieldsService.getMaxBucketCardinalities(
+        indexPattern,
+        maxBucketFieldCardinalities,
+        query,
+        timeFieldName,
+        earliestMs,
+        latestMs,
+        bucketSpan
+      );
+    }
+
+    return {
+      overallCardinality,
+      maxBucketCardinality,
+    };
   };
-}
+};
 
 export function calculateModelMemoryLimitProvider(callAsCurrentUser: APICaller) {
+  const getCardinalities = cardinalityCheckProvider(callAsCurrentUser);
+
   /**
    * Retrieves an estimated size of the model memory limit used in the job config
    * based on the cardinality of the fields being used to split the data
@@ -145,7 +150,6 @@ export function calculateModelMemoryLimitProvider(callAsCurrentUser: APICaller)
     }
 
     const { overallCardinality, maxBucketCardinality } = await getCardinalities(
-      callAsCurrentUser,
       analysisConfig,
       indexPattern,
       query,
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
index a54c2f22a7951..84f81a30f36b8 100644
--- a/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
+++ b/x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts
@@ -7,10 +7,12 @@
 import fs from 'fs';
 import Boom from 'boom';
 import numeral from '@elastic/numeral';
-import { CallAPIOptions, APICaller, SavedObjectsClientContract } from 'kibana/server';
+import { APICaller, SavedObjectsClientContract } from 'kibana/server';
+import moment from 'moment';
 import { IndexPatternAttributes } from 'src/plugins/data/server';
 import { merge } from 'lodash';
-import { CombinedJobWithStats } from '../../../common/types/anomaly_detection_jobs';
+import { AnalysisLimits, CombinedJobWithStats } from '../../../common/types/anomaly_detection_jobs';
+import { MlInfoResponse } from '../../../common/types/ml_server_info';
 import {
   KibanaObjects,
   ModuleDataFeed,
@@ -18,16 +20,22 @@ import {
   Module,
   JobOverride,
   DatafeedOverride,
-  GeneralOverride,
+  GeneralJobsOverride,
   DatafeedResponse,
   JobResponse,
   KibanaObjectResponse,
   DataRecognizerConfigResponse,
+  GeneralDatafeedsOverride,
+  JobSpecificOverride,
+  isGeneralJobOverride,
 } from '../../../common/types/modules';
 import { getLatestDataOrBucketTimestamp, prefixDatafeedId } from '../../../common/util/job_utils';
 import { mlLog } from '../../client/log';
+import { calculateModelMemoryLimitProvider } from '../calculate_model_memory_limit';
+import { fieldsServiceProvider } from '../fields_service';
 import { jobServiceProvider } from '../job_service';
 import { resultsServiceProvider } from '../results_service';
+import { JobExistResult, JobStat } from '../../../common/types/data_recognizer';
 
 const ML_DIR = 'ml';
 const KIBANA_DIR = 'kibana';
@@ -73,18 +81,6 @@ export interface RecognizeResult {
   logo: { icon: string } | null;
 }
 
-interface JobStat {
-  id: string;
-  earliestTimestampMs: number;
-  latestTimestampMs: number;
-  latestResultsTimestampMs: number;
-}
-
-interface JobExistResult {
-  jobsExist: boolean;
-  jobs: JobStat[];
-}
-
 interface ObjectExistResult {
   id: string;
   type: string;
@@ -107,18 +103,15 @@ export class DataRecognizer {
   modulesDir = `${__dirname}/modules`;
   indexPatternName: string = '';
   indexPatternId: string | undefined = undefined;
-  savedObjectsClient: SavedObjectsClientContract;
-
-  callAsCurrentUser: (
-    endpoint: string,
-    clientParams?: Record<string, any>,
-    options?: CallAPIOptions
-  ) => Promise<any>;
+  /**
+   * List of the module jobs that require model memory estimation
+   */
+  jobsForModelMemoryEstimation: ModuleJob[] = [];
 
-  constructor(callAsCurrentUser: APICaller, savedObjectsClient: SavedObjectsClientContract) {
-    this.callAsCurrentUser = callAsCurrentUser;
-    this.savedObjectsClient = savedObjectsClient;
-  }
+  constructor(
+    private callAsCurrentUser: APICaller,
+    private savedObjectsClient: SavedObjectsClientContract
+  ) {}
 
   // list all directories under the given directory
   async listDirs(dirName: string): Promise<string[]> {
@@ -367,16 +360,17 @@ export class DataRecognizer {
   // if any of the savedObjects already exist, they will not be overwritten.
   async setupModuleItems(
     moduleId: string,
-    jobPrefix: string,
-    groups: string[],
-    indexPatternName: string,
-    query: any,
-    useDedicatedIndex: boolean,
-    startDatafeed: boolean,
-    start: number,
-    end: number,
-    jobOverrides: JobOverride[],
-    datafeedOverrides: DatafeedOverride[]
+    jobPrefix?: string,
+    groups?: string[],
+    indexPatternName?: string,
+    query?: any,
+    useDedicatedIndex?: boolean,
+    startDatafeed?: boolean,
+    start?: number,
+    end?: number,
+    jobOverrides?: JobOverride | JobOverride[],
+    datafeedOverrides?: DatafeedOverride | DatafeedOverride[],
+    estimateModelMemory?: boolean
   ) {
     // load the config from disk
     const moduleConfig = await this.getModule(moduleId, jobPrefix);
@@ -418,11 +412,13 @@ export class DataRecognizer {
       savedObjects: [] as KibanaObjectResponse[],
     };
 
+    this.jobsForModelMemoryEstimation = moduleConfig.jobs;
+
     this.applyJobConfigOverrides(moduleConfig, jobOverrides, jobPrefix);
     this.applyDatafeedConfigOverrides(moduleConfig, datafeedOverrides, jobPrefix);
     this.updateDatafeedIndices(moduleConfig);
     this.updateJobUrlIndexPatterns(moduleConfig);
-    await this.updateModelMemoryLimits(moduleConfig);
+    await this.updateModelMemoryLimits(moduleConfig, estimateModelMemory, start, end);
 
     // create the jobs
     if (moduleConfig.jobs && moduleConfig.jobs.length) {
@@ -689,8 +685,8 @@ export class DataRecognizer {
 
   async startDatafeeds(
     datafeeds: ModuleDataFeed[],
-    start: number,
-    end: number
+    start?: number,
+    end?: number
   ): Promise<{ [key: string]: DatafeedResponse }> {
     const results = {} as { [key: string]: DatafeedResponse };
     for (const datafeed of datafeeds) {
@@ -933,28 +929,117 @@ export class DataRecognizer {
     }
   }
 
-  // ensure the model memory limit for each job is not greater than
-  // the max model memory setting for the cluster
-  async updateModelMemoryLimits(moduleConfig: Module) {
-    const { limits } = await this.callAsCurrentUser('ml.info');
+  /**
+   * Provides a time range of the last 3 months of data
+   */
+  async getFallbackTimeRange(
+    timeField: string,
+    query?: any
+  ): Promise<{ start: number; end: number }> {
+    const fieldsService = fieldsServiceProvider(this.callAsCurrentUser);
+
+    const timeFieldRange = await fieldsService.getTimeFieldRange(
+      this.indexPatternName,
+      timeField,
+      query
+    );
+
+    return {
+      start: timeFieldRange.end.epoch - moment.duration(3, 'months').asMilliseconds(),
+      end: timeFieldRange.end.epoch,
+    };
+  }
+
+  /**
+   * Ensure the model memory limit for each job is not greater than
+   * the max model memory setting for the cluster
+   */
+  async updateModelMemoryLimits(
+    moduleConfig: Module,
+    estimateMML: boolean = false,
+    start?: number,
+    end?: number
+  ) {
+    if (!Array.isArray(moduleConfig.jobs)) {
+      return;
+    }
+
+    if (estimateMML && this.jobsForModelMemoryEstimation.length > 0) {
+      const calculateModelMemoryLimit = calculateModelMemoryLimitProvider(this.callAsCurrentUser);
+      const query = moduleConfig.query ?? null;
+
+      // Checks if all jobs in the module have the same time field configured
+      const isSameTimeFields = this.jobsForModelMemoryEstimation.every(
+        job =>
+          job.config.data_description.time_field ===
+          this.jobsForModelMemoryEstimation[0].config.data_description.time_field
+      );
+
+      if (isSameTimeFields && (start === undefined || end === undefined)) {
+        // In case of time range is not provided and the time field is the same
+        // set the fallback range for all jobs
+        const { start: fallbackStart, end: fallbackEnd } = await this.getFallbackTimeRange(
+          this.jobsForModelMemoryEstimation[0].config.data_description.time_field,
+          query
+        );
+        start = fallbackStart;
+        end = fallbackEnd;
+      }
+
+      for (const job of this.jobsForModelMemoryEstimation) {
+        let earliestMs = start;
+        let latestMs = end;
+        if (earliestMs === undefined || latestMs === undefined) {
+          const timeFieldRange = await this.getFallbackTimeRange(
+            job.config.data_description.time_field,
+            query
+          );
+          earliestMs = timeFieldRange.start;
+          latestMs = timeFieldRange.end;
+        }
+
+        const { modelMemoryLimit } = await calculateModelMemoryLimit(
+          job.config.analysis_config,
+          this.indexPatternName,
+          query,
+          job.config.data_description.time_field,
+          earliestMs,
+          latestMs
+        );
+
+        if (!job.config.analysis_limits) {
+          job.config.analysis_limits = {} as AnalysisLimits;
+        }
+
+        job.config.analysis_limits.model_memory_limit = modelMemoryLimit;
+      }
+    }
+
+    const { limits } = await this.callAsCurrentUser<MlInfoResponse>('ml.info');
     const maxMml = limits.max_model_memory_limit;
-    if (maxMml !== undefined) {
-      // @ts-ignore
-      const maxBytes: number = numeral(maxMml.toUpperCase()).value();
-
-      if (Array.isArray(moduleConfig.jobs)) {
-        moduleConfig.jobs.forEach(job => {
-          const mml = job.config?.analysis_limits?.model_memory_limit;
-          if (mml !== undefined) {
-            // @ts-ignore
-            const mmlBytes: number = numeral(mml.toUpperCase()).value();
-            if (mmlBytes > maxBytes) {
-              // if the job's mml is over the max,
-              // so set the jobs mml to be the max
-              job.config.analysis_limits!.model_memory_limit = maxMml;
-            }
+
+    if (!maxMml) {
+      return;
+    }
+
+    // @ts-ignore
+    const maxBytes: number = numeral(maxMml.toUpperCase()).value();
+
+    for (const job of moduleConfig.jobs) {
+      const mml = job.config?.analysis_limits?.model_memory_limit;
+      if (mml !== undefined) {
+        // @ts-ignore
+        const mmlBytes: number = numeral(mml.toUpperCase()).value();
+        if (mmlBytes > maxBytes) {
+          // if the job's mml is over the max,
+          // so set the jobs mml to be the max
+
+          if (!job.config.analysis_limits) {
+            job.config.analysis_limits = {} as AnalysisLimits;
           }
-        });
+
+          job.config.analysis_limits.model_memory_limit = maxMml;
+        }
       }
     }
   }
@@ -975,7 +1060,11 @@ export class DataRecognizer {
     return false;
   }
 
-  applyJobConfigOverrides(moduleConfig: Module, jobOverrides: JobOverride[], jobPrefix = '') {
+  applyJobConfigOverrides(
+    moduleConfig: Module,
+    jobOverrides?: JobOverride | JobOverride[],
+    jobPrefix = ''
+  ) {
     if (jobOverrides === undefined || jobOverrides === null) {
       return;
     }
@@ -993,17 +1082,26 @@ export class DataRecognizer {
 
     // separate all the overrides.
     // the overrides which don't contain a job id will be applied to all jobs in the module
-    const generalOverrides: GeneralOverride[] = [];
-    const jobSpecificOverrides: JobOverride[] = [];
+    const generalOverrides: GeneralJobsOverride[] = [];
+    const jobSpecificOverrides: JobSpecificOverride[] = [];
 
     overrides.forEach(override => {
-      if (override.job_id === undefined) {
+      if (isGeneralJobOverride(override)) {
         generalOverrides.push(override);
       } else {
         jobSpecificOverrides.push(override);
       }
     });
 
+    if (generalOverrides.some(override => !!override.analysis_limits?.model_memory_limit)) {
+      this.jobsForModelMemoryEstimation = [];
+    } else {
+      this.jobsForModelMemoryEstimation = moduleConfig.jobs.filter(job => {
+        const override = jobSpecificOverrides.find(o => `${jobPrefix}${o.job_id}` === job.id);
+        return override?.analysis_limits?.model_memory_limit === undefined;
+      });
+    }
+
     function processArrayValues(source: any, update: any) {
       if (typeof source !== 'object' || typeof update !== 'object') {
         return;
@@ -1052,7 +1150,7 @@ export class DataRecognizer {
 
   applyDatafeedConfigOverrides(
     moduleConfig: Module,
-    datafeedOverrides: DatafeedOverride | DatafeedOverride[],
+    datafeedOverrides?: DatafeedOverride | DatafeedOverride[],
     jobPrefix = ''
   ) {
     if (datafeedOverrides !== undefined && datafeedOverrides !== null) {
@@ -1069,7 +1167,7 @@ export class DataRecognizer {
 
       // separate all the overrides.
       // the overrides which don't contain a datafeed id or a job id will be applied to all jobs in the module
-      const generalOverrides: GeneralOverride[] = [];
+      const generalOverrides: GeneralDatafeedsOverride[] = [];
       const datafeedSpecificOverrides: DatafeedOverride[] = [];
       overrides.forEach(o => {
         if (o.datafeed_id === undefined && o.job_id === undefined) {
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/logo.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/logo.json
new file mode 100644
index 0000000000000..cc9c9ff57560e
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/logo.json
@@ -0,0 +1,3 @@
+{
+  "icon": "uptimeApp"
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/manifest.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/manifest.json
new file mode 100644
index 0000000000000..52005a2629900
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/manifest.json
@@ -0,0 +1,26 @@
+{
+  "id": "uptime_heartbeat",
+  "title": "Uptime: Heartbeat",
+  "description": "Detect latency issues in heartbeat monitors.",
+  "type": "Heartbeat data",
+  "logoFile": "logo.json",
+  "defaultIndexPattern": "heartbeat-*",
+  "query": {
+    "bool": {
+      "filter": [{ "term": { "agent.type": "heartbeat" } }]
+    }
+  },
+  "jobs": [
+    {
+      "id": "high_latency_by_geo",
+      "file": "high_latency_by_geo.json"
+    }
+  ],
+  "datafeeds": [
+    {
+      "id": "datafeed-high_latency_by_geo",
+      "file": "datafeed_high_latency_by_geo.json",
+      "job_id": "high_latency_by_geo"
+    }
+  ]
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/datafeed_high_latency_by_geo.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/datafeed_high_latency_by_geo.json
new file mode 100644
index 0000000000000..0b0cc24982da9
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/datafeed_high_latency_by_geo.json
@@ -0,0 +1,13 @@
+{
+  "job_id": "JOB_ID",
+  "indices": ["INDEX_PATTERN_NAME"],
+  "max_empty_searches": 10,
+  "query": {
+    "bool": {
+      "must": [
+        { "bool": { "filter": { "term": { "agent.type": "heartbeat" } } } },
+        { "bool": { "filter": { "term": { "event.dataset": "uptime" } } } }
+      ]
+    }
+  }
+}
diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/high_latency_by_geo.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/high_latency_by_geo.json
new file mode 100644
index 0000000000000..c4f06daf97d08
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/uptime_heartbeat/ml/high_latency_by_geo.json
@@ -0,0 +1,29 @@
+{
+  "job_type": "anomaly_detector",
+  "groups": ["uptime"],
+  "description": "Uptime Heartbeat: Identify periods of increased latency across geographical regions.",
+  "analysis_config": {
+    "bucket_span": "15m",
+    "detectors": [
+      {
+        "detector_description": "increased latency",
+        "function": "high_mean",
+        "field_name": "monitor.duration.us",
+        "partition_field_name": "observer.geo.name",
+        "use_null": true
+      }
+    ],
+    "influencers": ["monitor.id", "monitor.name", "observer.geo.name"]
+  },
+  "allow_lazy_open": true,
+  "analysis_limits": {
+    "model_memory_limit": "32mb"
+  },
+  "data_description": {
+    "time_field": "@timestamp"
+  },
+  "custom_settings": {
+    "created_by": "ml-module-uptime-heartbeat",
+    "custom_urls": []
+  }
+}
diff --git a/x-pack/plugins/ml/server/models/fields_service/fields_aggs_cache.ts b/x-pack/plugins/ml/server/models/fields_service/fields_aggs_cache.ts
new file mode 100644
index 0000000000000..cdaefe6fdeed7
--- /dev/null
+++ b/x-pack/plugins/ml/server/models/fields_service/fields_aggs_cache.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { pick } from 'lodash';
+
+/**
+ * Cached aggregation types
+ */
+type AggType = 'overallCardinality' | 'maxBucketCardinality';
+
+type CacheStorage = { [key in AggType]: { [field: string]: number } };
+
+/**
+ * Caches cardinality fields values to avoid
+ * unnecessary aggregations on elasticsearch
+ */
+export const initCardinalityFieldsCache = () => {
+  const cardinalityCache = new Map<string, CacheStorage>();
+
+  return {
+    /**
+     * Gets requested values from cache
+     */
+    getValues(
+      indexPatternName: string | string[],
+      timeField: string,
+      earliestMs: number,
+      latestMs: number,
+      aggType: AggType,
+      fieldNames: string[]
+    ): CacheStorage[AggType] | null {
+      const cacheKey = indexPatternName + timeField + earliestMs + latestMs;
+      const cached = cardinalityCache.get(cacheKey);
+      if (!cached) {
+        return null;
+      }
+      return pick(cached[aggType], fieldNames);
+    },
+    /**
+     * Extends cache with provided values
+     */
+    updateValues(
+      indexPatternName: string | string[],
+      timeField: string,
+      earliestMs: number,
+      latestMs: number,
+      update: Partial<CacheStorage>
+    ): void {
+      const cacheKey = indexPatternName + timeField + earliestMs + latestMs;
+      const cachedValues = cardinalityCache.get(cacheKey);
+      if (cachedValues === undefined) {
+        cardinalityCache.set(cacheKey, {
+          overallCardinality: update.overallCardinality ?? {},
+          maxBucketCardinality: update.maxBucketCardinality ?? {},
+        });
+        return;
+      }
+
+      Object.assign(cachedValues.overallCardinality, update.overallCardinality);
+      Object.assign(cachedValues.maxBucketCardinality, update.maxBucketCardinality);
+    },
+  };
+};
diff --git a/x-pack/plugins/ml/server/models/fields_service/fields_service.ts b/x-pack/plugins/ml/server/models/fields_service/fields_service.ts
index d16984abc5d2a..567c5d2afb7de 100644
--- a/x-pack/plugins/ml/server/models/fields_service/fields_service.ts
+++ b/x-pack/plugins/ml/server/models/fields_service/fields_service.ts
@@ -7,12 +7,15 @@
 import Boom from 'boom';
 import { APICaller } from 'kibana/server';
 import { parseInterval } from '../../../common/util/parse_interval';
+import { initCardinalityFieldsCache } from './fields_aggs_cache';
 
 /**
  * Service for carrying out queries to obtain data
  * specific to fields in Elasticsearch indices.
  */
 export function fieldsServiceProvider(callAsCurrentUser: APICaller) {
+  const fieldsAggsCache = initCardinalityFieldsCache();
+
   /**
    * Gets aggregatable fields.
    */
@@ -58,6 +61,23 @@ export function fieldsServiceProvider(callAsCurrentUser: APICaller) {
       return {};
     }
 
+    const cachedValues =
+      fieldsAggsCache.getValues(
+        index,
+        timeFieldName,
+        earliestMs,
+        latestMs,
+        'overallCardinality',
+        fieldNames
+      ) ?? {};
+
+    // No need to perform aggregation over the cached fields
+    const fieldsToAgg = aggregatableFields.filter(field => !cachedValues.hasOwnProperty(field));
+
+    if (fieldsToAgg.length === 0) {
+      return cachedValues;
+    }
+
     // Build the criteria to use in the bool filter part of the request.
     // Add criteria for the time range and the datafeed config query.
     const mustCriteria = [
@@ -76,7 +96,7 @@ export function fieldsServiceProvider(callAsCurrentUser: APICaller) {
       mustCriteria.push(query);
     }
 
-    const aggs = aggregatableFields.reduce((obj, field) => {
+    const aggs = fieldsToAgg.reduce((obj, field) => {
       obj[field] = { cardinality: { field } };
       return obj;
     }, {} as { [field: string]: { cardinality: { field: string } } });
@@ -105,53 +125,63 @@ export function fieldsServiceProvider(callAsCurrentUser: APICaller) {
       return {};
     }
 
-    return aggregatableFields.reduce((obj, field) => {
+    const aggResult = fieldsToAgg.reduce((obj, field) => {
       obj[field] = (aggregations[field] || { value: 0 }).value;
       return obj;
     }, {} as { [field: string]: number });
+
+    fieldsAggsCache.updateValues(index, timeFieldName, earliestMs, latestMs, {
+      overallCardinality: aggResult,
+    });
+
+    return {
+      ...cachedValues,
+      ...aggResult,
+    };
   }
 
-  function getTimeFieldRange(
+  /**
+   * Gets time boundaries of the index data based on the provided time field.
+   */
+  async function getTimeFieldRange(
     index: string[] | string,
     timeFieldName: string,
     query: any
-  ): Promise<any> {
-    return new Promise((resolve, reject) => {
-      const obj = { success: true, start: { epoch: 0, string: '' }, end: { epoch: 0, string: '' } };
-
-      callAsCurrentUser('search', {
-        index,
-        size: 0,
-        body: {
-          query,
-          aggs: {
-            earliest: {
-              min: {
-                field: timeFieldName,
-              },
+  ): Promise<{
+    success: boolean;
+    start: { epoch: number; string: string };
+    end: { epoch: number; string: string };
+  }> {
+    const obj = { success: true, start: { epoch: 0, string: '' }, end: { epoch: 0, string: '' } };
+
+    const resp = await callAsCurrentUser('search', {
+      index,
+      size: 0,
+      body: {
+        ...(query ? { query } : {}),
+        aggs: {
+          earliest: {
+            min: {
+              field: timeFieldName,
             },
-            latest: {
-              max: {
-                field: timeFieldName,
-              },
+          },
+          latest: {
+            max: {
+              field: timeFieldName,
             },
           },
         },
-      })
-        .then(resp => {
-          if (resp.aggregations && resp.aggregations.earliest && resp.aggregations.latest) {
-            obj.start.epoch = resp.aggregations.earliest.value;
-            obj.start.string = resp.aggregations.earliest.value_as_string;
-
-            obj.end.epoch = resp.aggregations.latest.value;
-            obj.end.string = resp.aggregations.latest.value_as_string;
-          }
-          resolve(obj);
-        })
-        .catch(resp => {
-          reject(resp);
-        });
+      },
     });
+
+    if (resp.aggregations && resp.aggregations.earliest && resp.aggregations.latest) {
+      obj.start.epoch = resp.aggregations.earliest.value;
+      obj.start.string = resp.aggregations.earliest.value_as_string;
+
+      obj.end.epoch = resp.aggregations.latest.value;
+      obj.end.string = resp.aggregations.latest.value_as_string;
+    }
+    return obj;
   }
 
   /**
@@ -213,6 +243,23 @@ export function fieldsServiceProvider(callAsCurrentUser: APICaller) {
       return {};
     }
 
+    const cachedValues =
+      fieldsAggsCache.getValues(
+        index,
+        timeFieldName,
+        earliestMs,
+        latestMs,
+        'maxBucketCardinality',
+        fieldNames
+      ) ?? {};
+
+    // No need to perform aggregation over the cached fields
+    const fieldsToAgg = aggregatableFields.filter(field => !cachedValues.hasOwnProperty(field));
+
+    if (fieldsToAgg.length === 0) {
+      return cachedValues;
+    }
+
     const { start, end } = getSafeTimeRange(earliestMs, latestMs, interval);
 
     const mustCriteria = [
@@ -238,7 +285,7 @@ export function fieldsServiceProvider(callAsCurrentUser: APICaller) {
     const getSafeAggName = (field: string) => field.replace(/\W/g, '');
     const getMaxBucketAggKey = (field: string) => `max_bucket_${field}`;
 
-    const fieldsCardinalityAggs = aggregatableFields.reduce((obj, field) => {
+    const fieldsCardinalityAggs = fieldsToAgg.reduce((obj, field) => {
       obj[getSafeAggName(field)] = { cardinality: { field } };
       return obj;
     }, {} as { [field: string]: { cardinality: { field: string } } });
@@ -279,13 +326,18 @@ export function fieldsServiceProvider(callAsCurrentUser: APICaller) {
     )?.aggregations;
 
     if (!aggregations) {
-      return {};
+      return cachedValues;
     }
 
-    return aggregatableFields.reduce((obj, field) => {
+    const aggResult = fieldsToAgg.reduce((obj, field) => {
       obj[field] = (aggregations[getMaxBucketAggKey(field)] || { value: 0 }).value ?? 0;
       return obj;
     }, {} as { [field: string]: number });
+
+    return {
+      ...cachedValues,
+      ...aggResult,
+    };
   }
 
   return {
diff --git a/x-pack/plugins/ml/server/models/results_service/build_anomaly_table_items.d.ts b/x-pack/plugins/ml/server/models/results_service/build_anomaly_table_items.d.ts
index 2bd19985c8518..061f295ba5970 100644
--- a/x-pack/plugins/ml/server/models/results_service/build_anomaly_table_items.d.ts
+++ b/x-pack/plugins/ml/server/models/results_service/build_anomaly_table_items.d.ts
@@ -4,24 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { AnomalyRecordDoc } from '../../../common/types/anomalies';
-
-export interface AnomaliesTableRecord {
-  time: number;
-  source: AnomalyRecordDoc;
-  rowId: string;
-  jobId: string;
-  detectorIndex: number;
-  severity: number;
-  entityName?: string;
-  entityValue?: any;
-  influencers?: Array<{ [key: string]: any }>;
-  actual?: number[];
-  actualSort?: any;
-  typical?: number[];
-  typicalSort?: any;
-  metricDescriptionSort?: number;
-}
+import { AnomaliesTableRecord } from '../../../common/types/anomalies';
 
 export function buildAnomalyTableItems(
   anomalyRecords: any,
diff --git a/x-pack/plugins/ml/server/models/results_service/results_service.ts b/x-pack/plugins/ml/server/models/results_service/results_service.ts
index 6a12862048dee..1df53d9cee79c 100644
--- a/x-pack/plugins/ml/server/models/results_service/results_service.ts
+++ b/x-pack/plugins/ml/server/models/results_service/results_service.ts
@@ -8,11 +8,11 @@ import _ from 'lodash';
 import moment from 'moment';
 import { SearchResponse } from 'elasticsearch';
 import { APICaller } from 'kibana/server';
-import { buildAnomalyTableItems, AnomaliesTableRecord } from './build_anomaly_table_items';
+import { buildAnomalyTableItems } from './build_anomaly_table_items';
 import { ML_RESULTS_INDEX_PATTERN } from '../../../common/constants/index_patterns';
 import { ANOMALIES_TABLE_DEFAULT_QUERY_SIZE } from '../../../common/constants/search';
 import { getPartitionFieldsValuesFactory } from './get_partition_fields_values';
-import { AnomalyRecordDoc } from '../../../common/types/anomalies';
+import { AnomaliesTableRecord, AnomalyRecordDoc } from '../../../common/types/anomalies';
 
 // Service for carrying out Elasticsearch queries to obtain data for the
 // ML Results dashboards.
diff --git a/x-pack/plugins/ml/server/plugin.ts b/x-pack/plugins/ml/server/plugin.ts
index 8948d232b9e5e..c4b6028cdbb71 100644
--- a/x-pack/plugins/ml/server/plugin.ts
+++ b/x-pack/plugins/ml/server/plugin.ts
@@ -70,12 +70,15 @@ export class MlServerPlugin implements Plugin<MlSetupContract, MlStartContract,
         defaultMessage: 'Machine Learning',
       }),
       icon: PLUGIN_ICON,
+      order: 500,
       navLinkId: PLUGIN_ID,
       app: [PLUGIN_ID, 'kibana'],
       catalogue: [PLUGIN_ID],
-      privileges: {},
+      privileges: null,
       reserved: {
         privilege: {
+          app: [PLUGIN_ID, 'kibana'],
+          catalogue: [PLUGIN_ID],
           savedObject: {
             all: [],
             read: [],
diff --git a/x-pack/plugins/ml/server/routes/modules.ts b/x-pack/plugins/ml/server/routes/modules.ts
index 685119672a983..358cd0ac2871c 100644
--- a/x-pack/plugins/ml/server/routes/modules.ts
+++ b/x-pack/plugins/ml/server/routes/modules.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { schema } from '@kbn/config-schema';
+import { schema, TypeOf } from '@kbn/config-schema';
 
 import { RequestHandlerContext } from 'kibana/server';
 import { DatafeedOverride, JobOverride } from '../../common/types/modules';
@@ -36,16 +36,17 @@ function getModule(context: RequestHandlerContext, moduleId: string) {
 function saveModuleItems(
   context: RequestHandlerContext,
   moduleId: string,
-  prefix: string,
-  groups: string[],
-  indexPatternName: string,
-  query: any,
-  useDedicatedIndex: boolean,
-  startDatafeed: boolean,
-  start: number,
-  end: number,
-  jobOverrides: JobOverride[],
-  datafeedOverrides: DatafeedOverride[]
+  prefix?: string,
+  groups?: string[],
+  indexPatternName?: string,
+  query?: any,
+  useDedicatedIndex?: boolean,
+  startDatafeed?: boolean,
+  start?: number,
+  end?: number,
+  jobOverrides?: JobOverride | JobOverride[],
+  datafeedOverrides?: DatafeedOverride | DatafeedOverride[],
+  estimateModelMemory?: boolean
 ) {
   const dr = new DataRecognizer(
     context.ml!.mlClient.callAsCurrentUser,
@@ -62,7 +63,8 @@ function saveModuleItems(
     start,
     end,
     jobOverrides,
-    datafeedOverrides
+    datafeedOverrides,
+    estimateModelMemory
   );
 }
 
@@ -156,9 +158,7 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
     {
       path: '/api/ml/modules/setup/{moduleId}',
       validate: {
-        params: schema.object({
-          ...getModuleIdParamSchema(),
-        }),
+        params: schema.object(getModuleIdParamSchema()),
         body: setupModuleBodySchema,
       },
     },
@@ -177,7 +177,8 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
           end,
           jobOverrides,
           datafeedOverrides,
-        } = request.body;
+          estimateModelMemory,
+        } = request.body as TypeOf<typeof setupModuleBodySchema>;
 
         const result = await saveModuleItems(
           context,
@@ -191,7 +192,8 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
           start,
           end,
           jobOverrides,
-          datafeedOverrides
+          datafeedOverrides,
+          estimateModelMemory
         );
 
         return response.ok({ body: result });
@@ -214,9 +216,7 @@ export function dataRecognizer({ router, mlLicense }: RouteInitialization) {
     {
       path: '/api/ml/modules/jobs_exist/{moduleId}',
       validate: {
-        params: schema.object({
-          ...getModuleIdParamSchema(),
-        }),
+        params: schema.object(getModuleIdParamSchema()),
       },
     },
     mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
diff --git a/x-pack/plugins/ml/server/routes/schemas/datafeeds_schema.ts b/x-pack/plugins/ml/server/routes/schemas/datafeeds_schema.ts
index ee49da6538460..466e70197e3d1 100644
--- a/x-pack/plugins/ml/server/routes/schemas/datafeeds_schema.ts
+++ b/x-pack/plugins/ml/server/routes/schemas/datafeeds_schema.ts
@@ -24,7 +24,7 @@ export const datafeedConfigSchema = schema.object({
     })
   ),
   frequency: schema.maybe(schema.string()),
-  indices: schema.arrayOf(schema.string()),
+  indices: schema.maybe(schema.arrayOf(schema.string())),
   indexes: schema.maybe(schema.arrayOf(schema.string())),
   job_id: schema.maybe(schema.string()),
   query: schema.maybe(schema.any()),
diff --git a/x-pack/plugins/ml/server/routes/schemas/modules.ts b/x-pack/plugins/ml/server/routes/schemas/modules.ts
index 46b7e53c22a05..98e3d80f0ff84 100644
--- a/x-pack/plugins/ml/server/routes/schemas/modules.ts
+++ b/x-pack/plugins/ml/server/routes/schemas/modules.ts
@@ -17,6 +17,11 @@ export const setupModuleBodySchema = schema.object({
   end: schema.maybe(schema.number()),
   jobOverrides: schema.maybe(schema.any()),
   datafeedOverrides: schema.maybe(schema.any()),
+  /**
+   * Indicates whether an estimate of the model memory limit
+   * should be made by checking the cardinality of fields in the job configurations.
+   */
+  estimateModelMemory: schema.maybe(schema.boolean()),
 });
 
 export const getModuleIdParamSchema = (optional = false) => {
diff --git a/x-pack/plugins/ml/server/shared_services/providers/modules.ts b/x-pack/plugins/ml/server/shared_services/providers/modules.ts
index ffc977917ae46..ec876273c2c33 100644
--- a/x-pack/plugins/ml/server/shared_services/providers/modules.ts
+++ b/x-pack/plugins/ml/server/shared_services/providers/modules.ts
@@ -32,7 +32,8 @@ export interface ModulesProvider {
       start: number,
       end: number,
       jobOverrides: JobOverride[],
-      datafeedOverrides: DatafeedOverride[]
+      datafeedOverrides: DatafeedOverride[],
+      estimateModelMemory?: boolean
     ): Promise<DataRecognizerConfigResponse>;
   };
 }
@@ -65,7 +66,8 @@ export function getModulesProvider(isFullLicense: LicenseCheck): ModulesProvider
           start: number,
           end: number,
           jobOverrides: JobOverride[],
-          datafeedOverrides: DatafeedOverride[]
+          datafeedOverrides: DatafeedOverride[],
+          estimateModelMemory?: boolean
         ) {
           const dr = dataRecognizerFactory(callAsCurrentUser, savedObjectsClient);
           return dr.setupModuleItems(
@@ -79,7 +81,8 @@ export function getModulesProvider(isFullLicense: LicenseCheck): ModulesProvider
             start,
             end,
             jobOverrides,
-            datafeedOverrides
+            datafeedOverrides,
+            estimateModelMemory
           );
         },
       };
diff --git a/x-pack/plugins/monitoring/kibana.json b/x-pack/plugins/monitoring/kibana.json
index 8d69937c3677d..bbdf1a2e7cb76 100644
--- a/x-pack/plugins/monitoring/kibana.json
+++ b/x-pack/plugins/monitoring/kibana.json
@@ -3,8 +3,8 @@
   "version": "8.0.0",
   "kibanaVersion": "kibana",
   "configPath": ["monitoring"],
-  "requiredPlugins": ["usageCollection", "licensing", "features"],
-  "optionalPlugins": ["alerting", "actions", "infra"],
+  "requiredPlugins": ["licensing", "features"],
+  "optionalPlugins": ["alerting", "actions", "infra", "telemetryCollectionManager", "usageCollection"],
   "server": true,
   "ui": false
 }
diff --git a/x-pack/plugins/monitoring/server/plugin.ts b/x-pack/plugins/monitoring/server/plugin.ts
index bd1455a2c582f..b8216f037eabb 100644
--- a/x-pack/plugins/monitoring/server/plugin.ts
+++ b/x-pack/plugins/monitoring/server/plugin.ts
@@ -9,7 +9,7 @@ import { first } from 'rxjs/operators';
 import { i18n } from '@kbn/i18n';
 import { has, get } from 'lodash';
 import { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
-import { TelemetryCollectionManager } from 'src/legacy/core_plugins/telemetry/server/collection_manager';
+import { TelemetryCollectionManagerPluginSetup } from 'src/plugins/telemetry_collection_manager/server';
 import {
   LOGGING_TAG,
   KIBANA_MONITORING_LOGGING_TAG,
@@ -50,13 +50,13 @@ import { getLicenseExpiration } from './alerts/license_expiration';
 import { InfraPluginSetup } from '../../infra/server';
 
 export interface LegacyAPI {
-  telemetryCollectionManager: TelemetryCollectionManager;
   getServerStatus: () => string;
   infra: any;
 }
 
 interface PluginsSetup {
-  usageCollection: UsageCollectionSetup;
+  telemetryCollectionManager?: TelemetryCollectionManagerPluginSetup;
+  usageCollection?: UsageCollectionSetup;
   licensing: LicensingPluginSetup;
   features: FeaturesPluginSetupContract;
   alerting: AlertingPluginSetupContract;
@@ -120,7 +120,7 @@ export class Plugin {
       router: core.http.createRouter(),
       instanceUuid: core.uuid.getInstanceUuid(),
       esDataClient: core.elasticsearch.dataClient,
-      kibanaStatsCollector: plugins.usageCollection.getCollectorByType(
+      kibanaStatsCollector: plugins.usageCollection?.getCollectorByType(
         KIBANA_STATS_TYPE_MONITORING
       ),
     };
@@ -157,13 +157,22 @@ export class Plugin {
       );
     }
 
+    // Initialize telemetry
+    if (plugins.telemetryCollectionManager) {
+      registerMonitoringCollection(plugins.telemetryCollectionManager, this.cluster, {
+        maxBucketSize: config.ui.max_bucket_size,
+      });
+    }
+
     // Register collector objects for stats to show up in the APIs
-    registerCollectors(
-      plugins.usageCollection,
-      config,
-      core.metrics.getOpsMetrics$(),
-      get(legacyConfig, 'kibana.index')
-    );
+    if (plugins.usageCollection) {
+      registerCollectors(
+        plugins.usageCollection,
+        config,
+        core.metrics.getOpsMetrics$(),
+        get(legacyConfig, 'kibana.index')
+      );
+    }
 
     // If collection is enabled, create the bulk uploader
     const kibanaMonitoringLog = this.getLogger(KIBANA_MONITORING_LOGGING_TAG);
@@ -258,9 +267,11 @@ export class Plugin {
       navLinkId: 'monitoring',
       app: ['monitoring', 'kibana'],
       catalogue: ['monitoring'],
-      privileges: {},
+      privileges: null,
       reserved: {
         privilege: {
+          app: ['monitoring', 'kibana'],
+          catalogue: ['monitoring'],
           savedObject: {
             all: [],
             read: [],
@@ -275,9 +286,6 @@ export class Plugin {
   }
 
   async setupLegacy(legacyAPI: LegacyAPI) {
-    // Initialize telemetry
-    registerMonitoringCollection(this.cluster, legacyAPI.telemetryCollectionManager);
-
     // Set the stats getter
     this.bulkUploader.setKibanaStatusGetter(() => legacyAPI.getServerStatus());
   }
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.test.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.test.ts
index dcc7924fe171a..1a9f2a4da32c2 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.test.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.test.ts
@@ -9,26 +9,12 @@ import { getStackStats, getAllStats, handleAllStats } from './get_all_stats';
 import { ESClusterStats } from './get_es_stats';
 import { KibanaStats } from './get_kibana_stats';
 import { ClustersHighLevelStats } from './get_high_level_stats';
+import { coreMock } from 'src/core/server/mocks';
 
 describe('get_all_stats', () => {
-  const size = 123;
   const start = 0;
   const end = 1;
   const callCluster = sinon.stub();
-  const server = {
-    config: sinon.stub().returns({
-      get: sinon
-        .stub()
-        .withArgs('xpack.monitoring.elasticsearch.index_pattern')
-        .returns('.monitoring-es-N-*')
-        .withArgs('xpack.monitoring.kibana.index_pattern')
-        .returns('.monitoring-kibana-N-*')
-        .withArgs('xpack.monitoring.logstash.index_pattern')
-        .returns('.monitoring-logstash-N-*')
-        .withArgs('xpack.monitoring.max_bucket_size')
-        .returns(size),
-    }),
-  };
 
   const esClusters = [
     { cluster_uuid: 'a' },
@@ -186,13 +172,21 @@ describe('get_all_stats', () => {
         .returns(Promise.resolve({})); // Beats state
 
       expect(
-        await getAllStats([{ clusterUuid: 'a' }], {
-          callCluster: callCluster as any,
-          usageCollection: {} as any,
-          server,
-          start,
-          end,
-        })
+        await getAllStats(
+          [{ clusterUuid: 'a' }],
+          {
+            callCluster: callCluster as any,
+            usageCollection: {} as any,
+            start,
+            end,
+          },
+          {
+            logger: coreMock.createPluginInitializerContext().logger.get('test'),
+            isDev: true,
+            version: 'version',
+            maxBucketSize: 1,
+          }
+        )
       ).toStrictEqual(allClusters);
     });
 
@@ -204,13 +198,21 @@ describe('get_all_stats', () => {
       callCluster.withArgs('search').returns(Promise.resolve(clusterUuidsResponse));
 
       expect(
-        await getAllStats([], {
-          callCluster: callCluster as any,
-          usageCollection: {} as any,
-          server,
-          start,
-          end,
-        })
+        await getAllStats(
+          [],
+          {
+            callCluster: callCluster as any,
+            usageCollection: {} as any,
+            start,
+            end,
+          },
+          {
+            logger: coreMock.createPluginInitializerContext().logger.get('test'),
+            isDev: true,
+            version: 'version',
+            maxBucketSize: 1,
+          }
+        )
       ).toStrictEqual([]);
     });
   });
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts
index a6ed5254dabd5..b180730acfd36 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_all_stats.ts
@@ -6,7 +6,7 @@
 
 import { get, set, merge } from 'lodash';
 
-import { StatsGetter } from 'src/legacy/core_plugins/telemetry/server/collection_manager';
+import { StatsGetter } from 'src/plugins/telemetry_collection_manager/server';
 import { LOGSTASH_SYSTEM_ID, KIBANA_SYSTEM_ID, BEATS_SYSTEM_ID } from '../../common/constants';
 import { getElasticsearchStats, ESClusterStats } from './get_es_stats';
 import { getKibanaStats, KibanaStats } from './get_kibana_stats';
@@ -17,22 +17,27 @@ type PromiseReturnType<T extends (...args: any[]) => any> = ReturnType<T> extend
   ? R
   : T;
 
+export interface CustomContext {
+  maxBucketSize: number;
+}
+
 /**
  * Get statistics for all products joined by Elasticsearch cluster.
  * Returns the array of clusters joined with the Kibana and Logstash instances.
  *
  */
-export const getAllStats: StatsGetter = async (
+export const getAllStats: StatsGetter<CustomContext> = async (
   clustersDetails,
-  { server, callCluster, start, end }
+  { callCluster, start, end },
+  { maxBucketSize }
 ) => {
   const clusterUuids = clustersDetails.map(clusterDetails => clusterDetails.clusterUuid);
 
   const [esClusters, kibana, logstash, beats] = await Promise.all([
-    getElasticsearchStats(server, callCluster, clusterUuids), // cluster_stats, stack_stats.xpack, cluster_name/uuid, license, version
-    getKibanaStats(server, callCluster, clusterUuids, start, end), // stack_stats.kibana
-    getHighLevelStats(server, callCluster, clusterUuids, start, end, LOGSTASH_SYSTEM_ID), // stack_stats.logstash
-    getBeatsStats(server, callCluster, clusterUuids, start, end), // stack_stats.beats
+    getElasticsearchStats(callCluster, clusterUuids, maxBucketSize), // cluster_stats, stack_stats.xpack, cluster_name/uuid, license, version
+    getKibanaStats(callCluster, clusterUuids, start, end, maxBucketSize), // stack_stats.kibana
+    getHighLevelStats(callCluster, clusterUuids, start, end, LOGSTASH_SYSTEM_ID, maxBucketSize), // stack_stats.logstash
+    getBeatsStats(callCluster, clusterUuids, start, end), // stack_stats.beats
   ]);
 
   return handleAllStats(esClusters, { kibana, logstash, beats });
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.test.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.test.ts
index 310c01571c71d..c619db90c8975 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.test.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.test.ts
@@ -22,18 +22,16 @@ describe('Get Beats Stats', () => {
     const clusterUuids = ['aCluster', 'bCluster', 'cCluster'];
     const start = 100;
     const end = 200;
-    let server = { config: () => ({ get: sinon.stub() }) };
     let callCluster = sinon.stub();
 
     beforeEach(() => {
       const getStub = { get: sinon.stub() };
       getStub.get.withArgs('xpack.monitoring.beats.index_pattern').returns('beats-indices-*');
-      server = { config: () => getStub };
       callCluster = sinon.stub();
     });
 
     it('should set `from: 0, to: 10000` in the query', async () => {
-      await fetchBeatsStats(server, callCluster, clusterUuids, start, end, {} as any);
+      await fetchBeatsStats(callCluster, clusterUuids, start, end, {} as any);
       const { args } = callCluster.firstCall;
       const [api, { body }] = args;
 
@@ -43,7 +41,7 @@ describe('Get Beats Stats', () => {
     });
 
     it('should set `from: 10000, from: 10000` in the query', async () => {
-      await fetchBeatsStats(server, callCluster, clusterUuids, start, end, { page: 1 } as any);
+      await fetchBeatsStats(callCluster, clusterUuids, start, end, { page: 1 } as any);
       const { args } = callCluster.firstCall;
       const [api, { body }] = args;
 
@@ -53,7 +51,7 @@ describe('Get Beats Stats', () => {
     });
 
     it('should set `from: 20000, from: 10000` in the query', async () => {
-      await fetchBeatsStats(server, callCluster, clusterUuids, start, end, { page: 2 } as any);
+      await fetchBeatsStats(callCluster, clusterUuids, start, end, { page: 2 } as any);
       const { args } = callCluster.firstCall;
       const [api, { body }] = args;
 
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts
index cd588d7a90355..bf904e46516e0 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_beats_stats.ts
@@ -5,8 +5,8 @@
  */
 
 import { get } from 'lodash';
-import { StatsCollectionConfig } from 'src/legacy/core_plugins/telemetry/server/collection_manager';
 import { SearchResponse } from 'elasticsearch';
+import { StatsCollectionConfig } from 'src/plugins/telemetry_collection_manager/server';
 import { createQuery } from './create_query';
 import { INDEX_PATTERN_BEATS } from '../../common/constants';
 
@@ -308,7 +308,6 @@ export function processResults(
 
 /*
  * Create a set of result objects where each is the result of searching hits from Elasticsearch with a size of HITS_SIZE each time.
- * @param {Object} server - The server instance
  * @param {function} callCluster - The callWithRequest or callWithInternalUser handler
  * @param {Array} clusterUuids - The string Cluster UUIDs to fetch details for
  * @param {Date} start - Start time to limit the stats
@@ -319,7 +318,6 @@ export function processResults(
  * @return {Promise}
  */
 async function fetchBeatsByType(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
   clusterUuids: string[],
   start: StatsCollectionConfig['start'],
@@ -376,7 +374,7 @@ async function fetchBeatsByType(
       };
 
       // returns a promise and keeps the caller blocked from returning until the entire clusters object is built
-      return fetchBeatsByType(server, callCluster, clusterUuids, start, end, nextOptions, type);
+      return fetchBeatsByType(callCluster, clusterUuids, start, end, nextOptions, type);
     }
   }
 
@@ -384,25 +382,23 @@ async function fetchBeatsByType(
 }
 
 export async function fetchBeatsStats(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
   clusterUuids: string[],
   start: StatsCollectionConfig['start'],
   end: StatsCollectionConfig['end'],
   options: { page?: number } & BeatsProcessOptions
 ) {
-  return fetchBeatsByType(server, callCluster, clusterUuids, start, end, options, 'beats_stats');
+  return fetchBeatsByType(callCluster, clusterUuids, start, end, options, 'beats_stats');
 }
 
 export async function fetchBeatsStates(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
   clusterUuids: string[],
   start: StatsCollectionConfig['start'],
   end: StatsCollectionConfig['end'],
   options: { page?: number } & BeatsProcessOptions
 ) {
-  return fetchBeatsByType(server, callCluster, clusterUuids, start, end, options, 'beats_state');
+  return fetchBeatsByType(callCluster, clusterUuids, start, end, options, 'beats_state');
 }
 
 /*
@@ -410,7 +406,6 @@ export async function fetchBeatsStates(
  * @return {Object} - Beats stats in an object keyed by the cluster UUIDs
  */
 export async function getBeatsStats(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
   clusterUuids: string[],
   start: StatsCollectionConfig['start'],
@@ -425,8 +420,8 @@ export async function getBeatsStats(
   };
 
   await Promise.all([
-    fetchBeatsStats(server, callCluster, clusterUuids, start, end, options),
-    fetchBeatsStates(server, callCluster, clusterUuids, start, end, options),
+    fetchBeatsStats(callCluster, clusterUuids, start, end, options),
+    fetchBeatsStates(callCluster, clusterUuids, start, end, options),
   ]);
 
   return options.clusters;
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.test.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.test.ts
index 4f952b9dec6da..e8133afd95c20 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.test.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.test.ts
@@ -13,17 +13,6 @@ import {
 
 describe('get_cluster_uuids', () => {
   const callCluster = sinon.stub();
-  const size = 123;
-  const server = {
-    config: sinon.stub().returns({
-      get: sinon
-        .stub()
-        .withArgs('xpack.monitoring.elasticsearch.index_pattern')
-        .returns('.monitoring-es-N-*')
-        .withArgs('xpack.monitoring.max_bucket_size')
-        .returns(size),
-    }),
-  };
   const response = {
     aggregations: {
       cluster_uuids: {
@@ -41,7 +30,9 @@ describe('get_cluster_uuids', () => {
     it('returns cluster UUIDs', async () => {
       callCluster.withArgs('search').returns(Promise.resolve(response));
       expect(
-        await getClusterUuids({ server, callCluster, start, end, usageCollection: {} as any })
+        await getClusterUuids({ callCluster, start, end, usageCollection: {} as any }, {
+          maxBucketSize: 1,
+        } as any)
       ).toStrictEqual(expectedUuids);
     });
   });
@@ -50,7 +41,9 @@ describe('get_cluster_uuids', () => {
     it('searches for clusters', async () => {
       callCluster.returns(Promise.resolve(response));
       expect(
-        await fetchClusterUuids({ server, callCluster, start, end, usageCollection: {} as any })
+        await fetchClusterUuids({ callCluster, start, end, usageCollection: {} as any }, {
+          maxBucketSize: 1,
+        } as any)
       ).toStrictEqual(response);
     });
   });
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts
index 46b3007ae80e2..db025450ba833 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_cluster_uuids.ts
@@ -5,30 +5,33 @@
  */
 
 import { get } from 'lodash';
-// @ts-ignore
-import { createQuery } from './create_query';
-// @ts-ignore
-import { INDEX_PATTERN_ELASTICSEARCH } from '../../common/constants';
-
 import {
   ClusterDetailsGetter,
   StatsCollectionConfig,
   ClusterDetails,
-} from '../../../../../src/legacy/core_plugins/telemetry/server/collection_manager';
+} from 'src/plugins/telemetry_collection_manager/server';
+import { createQuery } from './create_query';
+import { INDEX_PATTERN_ELASTICSEARCH } from '../../common/constants';
+import { CustomContext } from './get_all_stats';
 
 /**
  * Get a list of Cluster UUIDs that exist within the specified timespan.
  */
-export const getClusterUuids: ClusterDetailsGetter = async (config: any) => {
-  const response = await fetchClusterUuids(config);
+export const getClusterUuids: ClusterDetailsGetter<CustomContext> = async (
+  config,
+  { maxBucketSize }
+) => {
+  const response = await fetchClusterUuids(config, maxBucketSize);
   return handleClusterUuidsResponse(response);
 };
 
 /**
  * Fetch the aggregated Cluster UUIDs from the monitoring cluster.
  */
-export function fetchClusterUuids({ server, callCluster, start, end }: StatsCollectionConfig) {
-  const config = server.config();
+export function fetchClusterUuids(
+  { callCluster, start, end }: StatsCollectionConfig,
+  maxBucketSize: number
+) {
   const params = {
     index: INDEX_PATTERN_ELASTICSEARCH,
     size: 0,
@@ -40,7 +43,7 @@ export function fetchClusterUuids({ server, callCluster, start, end }: StatsColl
         cluster_uuids: {
           terms: {
             field: 'cluster_uuid',
-            size: config.get('monitoring.ui.max_bucket_size'),
+            size: maxBucketSize,
           },
         },
       },
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.test.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.test.ts
index 70ed2240b47d4..52fb989bfd20f 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.test.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.test.ts
@@ -13,17 +13,6 @@ import {
 
 describe('get_es_stats', () => {
   const callWith = sinon.stub();
-  const size = 123;
-  const server = {
-    config: sinon.stub().returns({
-      get: sinon
-        .stub()
-        .withArgs('xpack.monitoring.elasticsearch.index_pattern')
-        .returns('.monitoring-es-N-*')
-        .withArgs('xpack.monitoring.max_bucket_size')
-        .returns(size),
-    }),
-  };
   const response = {
     hits: {
       hits: [
@@ -35,12 +24,13 @@ describe('get_es_stats', () => {
   };
   const expectedClusters = response.hits.hits.map(hit => hit._source);
   const clusterUuids = expectedClusters.map(cluster => cluster.cluster_uuid);
+  const maxBucketSize = 1;
 
   describe('getElasticsearchStats', () => {
     it('returns clusters', async () => {
       callWith.withArgs('search').returns(Promise.resolve(response));
 
-      expect(await getElasticsearchStats(server, callWith, clusterUuids)).toStrictEqual(
+      expect(await getElasticsearchStats(callWith, clusterUuids, maxBucketSize)).toStrictEqual(
         expectedClusters
       );
     });
@@ -50,7 +40,9 @@ describe('get_es_stats', () => {
     it('searches for clusters', async () => {
       callWith.returns(response);
 
-      expect(await fetchElasticsearchStats(server, callWith, clusterUuids)).toStrictEqual(response);
+      expect(await fetchElasticsearchStats(callWith, clusterUuids, maxBucketSize)).toStrictEqual(
+        response
+      );
     });
   });
 
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts
index 2f2fffd3f0823..37b6cbcf249d6 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_es_stats.ts
@@ -4,8 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { StatsCollectionConfig } from 'src/legacy/core_plugins/telemetry/server/collection_manager';
 import { SearchResponse } from 'elasticsearch';
+import { StatsCollectionConfig } from 'src/plugins/telemetry_collection_manager/server';
 import { INDEX_PATTERN_ELASTICSEARCH } from '../../common/constants';
 
 /**
@@ -16,11 +16,11 @@ import { INDEX_PATTERN_ELASTICSEARCH } from '../../common/constants';
  * @param {Array} clusterUuids The string Cluster UUIDs to fetch details for
  */
 export async function getElasticsearchStats(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
-  clusterUuids: string[]
+  clusterUuids: string[],
+  maxBucketSize: number
 ) {
-  const response = await fetchElasticsearchStats(server, callCluster, clusterUuids);
+  const response = await fetchElasticsearchStats(callCluster, clusterUuids, maxBucketSize);
   return handleElasticsearchStats(response);
 }
 
@@ -34,14 +34,13 @@ export async function getElasticsearchStats(
  * Returns the response for the aggregations to fetch details for the product.
  */
 export function fetchElasticsearchStats(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
-  clusterUuids: string[]
+  clusterUuids: string[],
+  maxBucketSize: number
 ) {
-  const config = server.config();
   const params = {
     index: INDEX_PATTERN_ELASTICSEARCH,
-    size: config.get('monitoring.ui.max_bucket_size'),
+    size: maxBucketSize,
     ignoreUnavailable: true,
     filterPath: [
       'hits.hits._source.cluster_uuid',
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.test.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.test.ts
index 76c80e2eb3d37..d308ddc13e40c 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.test.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.test.ts
@@ -13,21 +13,10 @@ import {
 
 describe('get_high_level_stats', () => {
   const callWith = sinon.stub();
-  const size = 123;
   const product = 'xyz';
   const cloudName = 'bare-metal';
   const start = 0;
   const end = 1;
-  const server = {
-    config: sinon.stub().returns({
-      get: sinon
-        .stub()
-        .withArgs(`xpack.monitoring.${product}.index_pattern`)
-        .returns(`.monitoring-${product}-N-*`)
-        .withArgs('xpack.monitoring.max_bucket_size')
-        .returns(size),
-    }),
-  };
   const response = {
     hits: {
       hits: [
@@ -238,13 +227,14 @@ describe('get_high_level_stats', () => {
     },
   };
   const clusterUuids = Object.keys(expectedClusters);
+  const maxBucketSize = 10;
 
   describe('getHighLevelStats', () => {
     it('returns clusters', async () => {
       callWith.withArgs('search').returns(Promise.resolve(response));
 
       expect(
-        await getHighLevelStats(server, callWith, clusterUuids, start, end, product)
+        await getHighLevelStats(callWith, clusterUuids, start, end, product, maxBucketSize)
       ).toStrictEqual(expectedClusters);
     });
   });
@@ -254,7 +244,7 @@ describe('get_high_level_stats', () => {
       callWith.returns(Promise.resolve(response));
 
       expect(
-        await fetchHighLevelStats(server, callWith, clusterUuids, start, end, product)
+        await fetchHighLevelStats(callWith, clusterUuids, start, end, product, maxBucketSize)
       ).toStrictEqual(response);
     });
   });
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts
index f67f80940d9f4..87a1fb7e6e5cf 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_high_level_stats.ts
@@ -5,8 +5,8 @@
  */
 
 import { get } from 'lodash';
-import { StatsCollectionConfig } from 'src/legacy/core_plugins/telemetry/server/collection_manager';
 import { SearchResponse } from 'elasticsearch';
+import { StatsCollectionConfig } from 'src/plugins/telemetry_collection_manager/server';
 import { createQuery } from './create_query';
 import {
   INDEX_PATTERN_KIBANA,
@@ -247,20 +247,20 @@ function getIndexPatternForStackProduct(product: string) {
  * Returns an object keyed by the cluster UUIDs to make grouping easier.
  */
 export async function getHighLevelStats(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
   clusterUuids: string[],
   start: StatsCollectionConfig['start'],
   end: StatsCollectionConfig['end'],
-  product: string
+  product: string,
+  maxBucketSize: number
 ) {
   const response = await fetchHighLevelStats(
-    server,
     callCluster,
     clusterUuids,
     start,
     end,
-    product
+    product,
+    maxBucketSize
   );
   return handleHighLevelStatsResponse(response, product);
 }
@@ -268,14 +268,13 @@ export async function getHighLevelStats(
 export async function fetchHighLevelStats<
   T extends { cluster_uuid?: string } = { cluster_uuid?: string }
 >(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
   clusterUuids: string[],
   start: StatsCollectionConfig['start'] | undefined,
   end: StatsCollectionConfig['end'] | undefined,
-  product: string
+  product: string,
+  maxBucketSize: number
 ): Promise<SearchResponse<T>> {
-  const config = server.config();
   const isKibanaIndex = product === KIBANA_SYSTEM_ID;
   const filters: object[] = [{ terms: { cluster_uuid: clusterUuids } }];
 
@@ -302,7 +301,7 @@ export async function fetchHighLevelStats<
 
   const params = {
     index: getIndexPatternForStackProduct(product),
-    size: config.get('monitoring.ui.max_bucket_size'),
+    size: maxBucketSize,
     headers: {
       'X-QUERY-SOURCE': TELEMETRY_QUERY_SOURCE,
     },
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_kibana_stats.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_kibana_stats.ts
index e2ad64ce04c6b..45df56b2139ff 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_kibana_stats.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_kibana_stats.ts
@@ -6,8 +6,8 @@
 
 import moment from 'moment';
 import { isEmpty } from 'lodash';
-import { StatsCollectionConfig } from 'src/legacy/core_plugins/telemetry/server/collection_manager';
 import { SearchResponse } from 'elasticsearch';
+import { StatsCollectionConfig } from 'src/plugins/telemetry_collection_manager/server';
 import { KIBANA_SYSTEM_ID, TELEMETRY_COLLECTION_INTERVAL } from '../../common/constants';
 import {
   fetchHighLevelStats,
@@ -173,20 +173,20 @@ export function ensureTimeSpan(
  * specialized usage data that comes with kibana stats (kibana_stats.usage).
  */
 export async function getKibanaStats(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
   clusterUuids: string[],
   start: StatsCollectionConfig['start'],
-  end: StatsCollectionConfig['end']
+  end: StatsCollectionConfig['end'],
+  maxBucketSize: number
 ) {
   const { start: safeStart, end: safeEnd } = ensureTimeSpan(start, end);
   const rawStats = await fetchHighLevelStats<KibanaUsageStats>(
-    server,
     callCluster,
     clusterUuids,
     safeStart,
     safeEnd,
-    KIBANA_SYSTEM_ID
+    KIBANA_SYSTEM_ID,
+    maxBucketSize
   );
   const highLevelStats = handleHighLevelStatsResponse(rawStats, KIBANA_SYSTEM_ID);
   const usageStats = getUsageStats(rawStats);
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.test.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.test.ts
index bb8326ce0b63a..16fa47afdb692 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.test.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.test.ts
@@ -9,17 +9,6 @@ import { getLicenses, handleLicenses, fetchLicenses } from './get_licenses';
 
 describe('get_licenses', () => {
   const callWith = sinon.stub();
-  const size = 123;
-  const server = {
-    config: sinon.stub().returns({
-      get: sinon
-        .stub()
-        .withArgs('xpack.monitoring.elasticsearch.index_pattern')
-        .returns('.monitoring-es-N-*')
-        .withArgs('xpack.monitoring.max_bucket_size')
-        .returns(size),
-    }),
-  };
   const response = {
     hits: {
       hits: [
@@ -42,7 +31,11 @@ describe('get_licenses', () => {
       callWith.withArgs('search').returns(Promise.resolve(response));
 
       expect(
-        await getLicenses(clusterUuids, { server, callCluster: callWith } as any)
+        await getLicenses(
+          clusterUuids,
+          { callCluster: callWith } as any,
+          { maxBucketSize: 1 } as any
+        )
       ).toStrictEqual(expectedLicenses);
     });
   });
@@ -53,9 +46,9 @@ describe('get_licenses', () => {
 
       expect(
         await fetchLicenses(
-          server,
           callWith,
-          clusterUuids.map(({ clusterUuid }) => clusterUuid)
+          clusterUuids.map(({ clusterUuid }) => clusterUuid),
+          { maxBucketSize: 1 } as any
         )
       ).toStrictEqual(response);
     });
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts b/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts
index 7364227e7dc92..0d41ac0f46814 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/get_licenses.ts
@@ -4,20 +4,25 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { SearchResponse } from 'elasticsearch';
 import {
-  StatsCollectionConfig,
+  ESLicense,
   LicenseGetter,
-} from 'src/legacy/core_plugins/telemetry/server/collection_manager';
-import { SearchResponse } from 'elasticsearch';
-import { ESLicense } from 'src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_license';
+  StatsCollectionConfig,
+} from 'src/plugins/telemetry_collection_manager/server';
 import { INDEX_PATTERN_ELASTICSEARCH } from '../../common/constants';
+import { CustomContext } from './get_all_stats';
 
 /**
  * Get statistics for all selected Elasticsearch clusters.
  */
-export const getLicenses: LicenseGetter = async (clustersDetails, { server, callCluster }) => {
+export const getLicenses: LicenseGetter<CustomContext> = async (
+  clustersDetails,
+  { callCluster },
+  { maxBucketSize }
+) => {
   const clusterUuids = clustersDetails.map(({ clusterUuid }) => clusterUuid);
-  const response = await fetchLicenses(server, callCluster, clusterUuids);
+  const response = await fetchLicenses(callCluster, clusterUuids, maxBucketSize);
   return handleLicenses(response);
 };
 
@@ -31,14 +36,13 @@ export const getLicenses: LicenseGetter = async (clustersDetails, { server, call
  * Returns the response for the aggregations to fetch details for the product.
  */
 export function fetchLicenses(
-  server: StatsCollectionConfig['server'],
   callCluster: StatsCollectionConfig['callCluster'],
-  clusterUuids: string[]
+  clusterUuids: string[],
+  maxBucketSize: number
 ) {
-  const config = server.config();
   const params = {
     index: INDEX_PATTERN_ELASTICSEARCH,
-    size: config.get('monitoring.ui.max_bucket_size'),
+    size: maxBucketSize,
     ignoreUnavailable: true,
     filterPath: ['hits.hits._source.cluster_uuid', 'hits.hits._source.license'],
     body: {
diff --git a/x-pack/plugins/monitoring/server/telemetry_collection/register_monitoring_collection.ts b/x-pack/plugins/monitoring/server/telemetry_collection/register_monitoring_collection.ts
index 7bc4e9cbf7558..d81f549de7522 100644
--- a/x-pack/plugins/monitoring/server/telemetry_collection/register_monitoring_collection.ts
+++ b/x-pack/plugins/monitoring/server/telemetry_collection/register_monitoring_collection.ts
@@ -5,29 +5,23 @@
  */
 
 import { ICustomClusterClient } from 'kibana/server';
-import { Cluster } from 'src/legacy/core_plugins/elasticsearch';
-// @ts-ignore
-import { getAllStats } from './get_all_stats';
+import { TelemetryCollectionManagerPluginSetup } from 'src/plugins/telemetry_collection_manager/server';
+import { getAllStats, CustomContext } from './get_all_stats';
 import { getClusterUuids } from './get_cluster_uuids';
 import { getLicenses } from './get_licenses';
 
 export function registerMonitoringCollection(
-  cluster: ICustomClusterClient,
-  telemetryCollectionManager: any
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup,
+  esCluster: ICustomClusterClient,
+  customContext: CustomContext
 ) {
-  // Create a legacy wrapper since telemetry is still in the legacy plugins
-  const legacyCluster: Cluster = {
-    callWithRequest: async (req: any, endpoint: string, params: any) =>
-      cluster.asScoped(req).callAsCurrentUser(endpoint, params),
-    callWithInternalUser: (endpoint: string, params: any) =>
-      cluster.callAsInternalUser(endpoint, params),
-  };
   telemetryCollectionManager.setCollection({
-    esCluster: legacyCluster,
+    esCluster,
     title: 'monitoring',
     priority: 2,
     statsGetter: getAllStats,
     clusterDetailsGetter: getClusterUuids,
     licenseGetter: getLicenses,
+    customContext,
   });
 }
diff --git a/x-pack/plugins/painless_lab/common/constants.ts b/x-pack/plugins/painless_lab/common/constants.ts
new file mode 100644
index 0000000000000..dfc7d8ae85a2c
--- /dev/null
+++ b/x-pack/plugins/painless_lab/common/constants.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { LicenseType } from '../../licensing/common/types';
+
+const basicLicense: LicenseType = 'basic';
+
+export const PLUGIN = {
+  id: 'painlessLab',
+  minimumLicenseType: basicLicense,
+};
+
+export const API_BASE_PATH = '/api/painless_lab';
diff --git a/x-pack/plugins/painless_lab/kibana.json b/x-pack/plugins/painless_lab/kibana.json
new file mode 100644
index 0000000000000..4b4ea24202846
--- /dev/null
+++ b/x-pack/plugins/painless_lab/kibana.json
@@ -0,0 +1,16 @@
+{
+  "id": "painlessLab",
+  "version": "8.0.0",
+  "kibanaVersion": "kibana",
+  "requiredPlugins": [
+    "devTools",
+    "licensing",
+    "home"
+  ],
+  "configPath": [
+    "xpack",
+    "painless_lab"
+  ],
+  "server": true,
+  "ui": true
+}
diff --git a/x-pack/plugins/painless_lab/public/application/components/editor.tsx b/x-pack/plugins/painless_lab/public/application/components/editor.tsx
new file mode 100644
index 0000000000000..b8891ce6524f5
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/components/editor.tsx
@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { CodeEditor } from '../../../../../../src/plugins/kibana_react/public';
+
+interface Props {
+  code: string;
+  onChange: (code: string) => void;
+}
+
+export function Editor({ code, onChange }: Props) {
+  return (
+    <CodeEditor
+      languageId="painless"
+      // 99% width allows the editor to resize horizontally. 100% prevents it from resizing.
+      width="99%"
+      height="100%"
+      value={code}
+      onChange={onChange}
+      options={{
+        fontSize: 12,
+        minimap: {
+          enabled: false,
+        },
+        scrollBeyondLastLine: false,
+        wordWrap: 'on',
+        wrappingIndent: 'indent',
+        automaticLayout: true,
+      }}
+    />
+  );
+}
diff --git a/x-pack/plugins/painless_lab/public/application/components/main.tsx b/x-pack/plugins/painless_lab/public/application/components/main.tsx
new file mode 100644
index 0000000000000..10907536e9cc2
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/components/main.tsx
@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, useEffect } from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiTitle } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { formatRequestPayload, formatJson } from '../lib/format';
+import { exampleScript } from '../constants';
+import { PayloadFormat } from '../types';
+import { useSubmitCode } from '../hooks';
+import { useAppContext } from '../context';
+import { OutputPane } from './output_pane';
+import { MainControls } from './main_controls';
+import { Editor } from './editor';
+import { RequestFlyout } from './request_flyout';
+
+export const Main: React.FunctionComponent = () => {
+  const {
+    store: { payload, validation },
+    updatePayload,
+    services: {
+      http,
+      chrome: { getIsNavDrawerLocked$ },
+    },
+    links,
+  } = useAppContext();
+
+  const [isRequestFlyoutOpen, setRequestFlyoutOpen] = useState(false);
+  const { inProgress, response, submit } = useSubmitCode(http);
+
+  // Live-update the output and persist payload state as the user changes it.
+  useEffect(() => {
+    if (validation.isValid) {
+      submit(payload);
+    }
+  }, [payload, submit, validation.isValid]);
+
+  const toggleRequestFlyout = () => {
+    setRequestFlyoutOpen(!isRequestFlyoutOpen);
+  };
+
+  const [isNavDrawerLocked, setIsNavDrawerLocked] = useState(false);
+
+  useEffect(() => {
+    const subscription = getIsNavDrawerLocked$().subscribe((newIsNavDrawerLocked: boolean) => {
+      setIsNavDrawerLocked(newIsNavDrawerLocked);
+    });
+
+    return () => subscription.unsubscribe();
+  });
+
+  return (
+    <div className="painlessLabMainContainer">
+      <EuiFlexGroup className="painlessLabPanelsContainer" responsive={false} gutterSize="none">
+        <EuiFlexItem>
+          <EuiTitle className="euiScreenReaderOnly">
+            <h1>
+              {i18n.translate('xpack.painlessLab.title', {
+                defaultMessage: 'Painless Lab',
+              })}
+            </h1>
+          </EuiTitle>
+
+          <Editor code={payload.code} onChange={nextCode => updatePayload({ code: nextCode })} />
+        </EuiFlexItem>
+
+        <EuiFlexItem>
+          <OutputPane isLoading={inProgress} response={response} />
+        </EuiFlexItem>
+      </EuiFlexGroup>
+
+      <MainControls
+        links={links}
+        isLoading={inProgress}
+        toggleRequestFlyout={toggleRequestFlyout}
+        isRequestFlyoutOpen={isRequestFlyoutOpen}
+        isNavDrawerLocked={isNavDrawerLocked}
+        reset={() => updatePayload({ code: exampleScript })}
+      />
+
+      {isRequestFlyoutOpen && (
+        <RequestFlyout
+          links={links}
+          onClose={() => setRequestFlyoutOpen(false)}
+          requestBody={formatRequestPayload(payload, PayloadFormat.PRETTY)}
+          response={response ? formatJson(response.result || response.error) : ''}
+        />
+      )}
+    </div>
+  );
+};
diff --git a/x-pack/plugins/painless_lab/public/application/components/main_controls.tsx b/x-pack/plugins/painless_lab/public/application/components/main_controls.tsx
new file mode 100644
index 0000000000000..6307c21e26dc4
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/components/main_controls.tsx
@@ -0,0 +1,145 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { useState } from 'react';
+import classNames from 'classnames';
+import {
+  EuiPopover,
+  EuiBottomBar,
+  EuiContextMenuItem,
+  EuiContextMenuPanel,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiButtonEmpty,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import { Links } from '../../links';
+
+interface Props {
+  toggleRequestFlyout: () => void;
+  isRequestFlyoutOpen: boolean;
+  isLoading: boolean;
+  reset: () => void;
+  links: Links;
+  isNavDrawerLocked: boolean;
+}
+
+export function MainControls({
+  toggleRequestFlyout,
+  isRequestFlyoutOpen,
+  reset,
+  links,
+  isNavDrawerLocked,
+}: Props) {
+  const [isHelpOpen, setIsHelpOpen] = useState(false);
+
+  const items = [
+    <EuiContextMenuItem
+      key="walkthrough"
+      icon="popout"
+      href={links.painlessWalkthrough}
+      target="_blank"
+      onClick={() => setIsHelpOpen(false)}
+    >
+      {i18n.translate('xpack.painlessLab.walkthroughButtonLabel', {
+        defaultMessage: 'Walkthrough',
+      })}
+    </EuiContextMenuItem>,
+
+    <EuiContextMenuItem
+      key="api"
+      icon="popout"
+      href={links.painlessAPIReference}
+      target="_blank"
+      onClick={() => setIsHelpOpen(false)}
+    >
+      {i18n.translate('xpack.painlessLab.apiReferenceButtonLabel', {
+        defaultMessage: 'API reference',
+      })}
+    </EuiContextMenuItem>,
+
+    <EuiContextMenuItem
+      key="languageSpec"
+      icon="popout"
+      href={links.painlessLangSpec}
+      target="_blank"
+      onClick={() => setIsHelpOpen(false)}
+    >
+      {i18n.translate('xpack.painlessLab.languageSpecButtonLabel', {
+        defaultMessage: 'Language spec',
+      })}
+    </EuiContextMenuItem>,
+
+    <EuiContextMenuItem
+      key="reset"
+      icon="bolt"
+      onClick={() => {
+        reset();
+        setIsHelpOpen(false);
+      }}
+    >
+      {i18n.translate('xpack.painlessLab.resetButtonLabel', {
+        defaultMessage: 'Reset script',
+      })}
+    </EuiContextMenuItem>,
+  ];
+
+  const classes = classNames('painlessLab__bottomBar', {
+    'painlessLab__bottomBar-isNavDrawerLocked': isNavDrawerLocked,
+  });
+
+  return (
+    <EuiBottomBar paddingSize="s" className={classes}>
+      <EuiFlexGroup gutterSize="s" justifyContent="spaceBetween">
+        <EuiFlexItem grow={false}>
+          <EuiFlexGroup gutterSize="s" justifyContent="flexStart">
+            <EuiFlexItem grow={false}>
+              <EuiPopover
+                id="painlessLabHelpContextMenu"
+                button={
+                  <EuiButtonEmpty
+                    size="s"
+                    iconType="help"
+                    iconSide="left"
+                    color="ghost"
+                    onClick={() => setIsHelpOpen(!isHelpOpen)}
+                  >
+                    {i18n.translate('xpack.painlessLab.helpButtonLabel', {
+                      defaultMessage: 'Help',
+                    })}
+                  </EuiButtonEmpty>
+                }
+                isOpen={isHelpOpen}
+                closePopover={() => setIsHelpOpen(false)}
+                panelPaddingSize="none"
+                withTitle
+                anchorPosition="upRight"
+              >
+                <EuiContextMenuPanel items={items} />
+              </EuiPopover>
+            </EuiFlexItem>
+          </EuiFlexGroup>
+        </EuiFlexItem>
+        <EuiFlexItem grow={false}>
+          <EuiButtonEmpty
+            size="s"
+            color="ghost"
+            onClick={toggleRequestFlyout}
+            data-test-subj="btnViewRequest"
+          >
+            {isRequestFlyoutOpen
+              ? i18n.translate('xpack.painlessLab.hideRequestButtonLabel', {
+                  defaultMessage: 'Hide API request',
+                })
+              : i18n.translate('xpack.painlessLab.showRequestButtonLabel', {
+                  defaultMessage: 'Show API request',
+                })}
+          </EuiButtonEmpty>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    </EuiBottomBar>
+  );
+}
diff --git a/x-pack/plugins/painless_lab/public/application/components/output_pane/context_tab.tsx b/x-pack/plugins/painless_lab/public/application/components/output_pane/context_tab.tsx
new file mode 100644
index 0000000000000..47efd524f092a
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/components/output_pane/context_tab.tsx
@@ -0,0 +1,202 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import {
+  EuiFieldText,
+  EuiFormRow,
+  EuiPanel,
+  EuiSpacer,
+  EuiIcon,
+  EuiToolTip,
+  EuiLink,
+  EuiText,
+  EuiSuperSelect,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+
+import { CodeEditor } from '../../../../../../../src/plugins/kibana_react/public';
+import { painlessContextOptions } from '../../constants';
+import { useAppContext } from '../../context';
+
+export const ContextTab: FunctionComponent = () => {
+  const {
+    store: { payload, validation },
+    updatePayload,
+    links,
+  } = useAppContext();
+  const { context, document, index, query } = payload;
+
+  return (
+    <>
+      <EuiSpacer size="m" />
+      <EuiFormRow
+        label={
+          <EuiToolTip
+            content={i18n.translate('xpack.painlessLab.contextFieldTooltipText', {
+              defaultMessage: 'Different contexts provide different functions on the ctx object',
+            })}
+          >
+            <span>
+              <FormattedMessage
+                id="xpack.painlessLab.contextFieldLabel"
+                defaultMessage="Execution context"
+              />{' '}
+              <EuiIcon type="questionInCircle" color="subdued" />
+            </span>
+          </EuiToolTip>
+        }
+        labelAppend={
+          <EuiText size="xs">
+            <EuiLink href={links.painlessExecuteAPIContexts} target="_blank">
+              {i18n.translate('xpack.painlessLab.contextFieldDocLinkText', {
+                defaultMessage: 'Context docs',
+              })}
+            </EuiLink>
+          </EuiText>
+        }
+        fullWidth
+      >
+        <EuiSuperSelect
+          options={painlessContextOptions}
+          valueOfSelected={context}
+          onChange={nextContext => updatePayload({ context: nextContext })}
+          itemLayoutAlign="top"
+          hasDividers
+          fullWidth
+        />
+      </EuiFormRow>
+
+      {['filter', 'score'].indexOf(context) !== -1 && (
+        <EuiFormRow
+          label={
+            <EuiToolTip
+              content={i18n.translate('xpack.painlessLab.indexFieldTooltipText', {
+                defaultMessage: `Index mappings must be compatible with the sample document's fields`,
+              })}
+            >
+              <span>
+                <FormattedMessage
+                  id="xpack.painlessLab.indexFieldLabel"
+                  defaultMessage="Index name"
+                />{' '}
+                <EuiIcon type="questionInCircle" color="subdued" />
+              </span>
+            </EuiToolTip>
+          }
+          fullWidth
+          isInvalid={!validation.fields.index}
+          error={
+            validation.fields.index
+              ? []
+              : [
+                  i18n.translate('xpack.painlessLab.indexFieldMissingErrorMessage', {
+                    defaultMessage: 'Enter an index name',
+                  }),
+                ]
+          }
+        >
+          <EuiFieldText
+            fullWidth
+            value={index || ''}
+            onChange={e => {
+              const nextIndex = e.target.value;
+              updatePayload({ index: nextIndex });
+            }}
+            isInvalid={!validation.fields.index}
+          />
+        </EuiFormRow>
+      )}
+      {/* Query DSL Code Editor */}
+      {'score'.indexOf(context) !== -1 && (
+        <EuiFormRow
+          label={
+            <EuiToolTip
+              content={i18n.translate('xpack.painlessLab.queryFieldTooltipText', {
+                defaultMessage:
+                  'Use query to specify that that _score will be used to calculate score.',
+              })}
+            >
+              <span>
+                <FormattedMessage id="xpack.painlessLab.queryFieldLabel" defaultMessage="Query" />{' '}
+                <EuiIcon type="questionInCircle" color="subdued" />
+              </span>
+            </EuiToolTip>
+          }
+          labelAppend={
+            <EuiText size="xs">
+              <EuiLink href={links.esQueryDSL} target="_blank">
+                {i18n.translate('xpack.painlessLab.queryFieldDocLinkText', {
+                  defaultMessage: 'Query DSL docs',
+                })}
+              </EuiLink>
+            </EuiText>
+          }
+          fullWidth
+        >
+          <EuiPanel paddingSize="s">
+            <CodeEditor
+              languageId="json"
+              height={150}
+              value={query}
+              onChange={nextQuery => updatePayload({ query: nextQuery })}
+              options={{
+                fontSize: 12,
+                minimap: {
+                  enabled: false,
+                },
+                scrollBeyondLastLine: false,
+                wordWrap: 'on',
+                wrappingIndent: 'indent',
+                automaticLayout: true,
+              }}
+            />
+          </EuiPanel>
+        </EuiFormRow>
+      )}
+      {['filter', 'score'].indexOf(context) !== -1 && (
+        <EuiFormRow
+          label={
+            <EuiToolTip
+              content={i18n.translate('xpack.painlessLab.documentFieldTooltipText', {
+                defaultMessage: "Your script can access this document's fields",
+              })}
+            >
+              <span>
+                <FormattedMessage
+                  id="xpack.painlessLab.documentFieldLabel"
+                  defaultMessage="Sample document (JSON)"
+                />{' '}
+                <EuiIcon type="questionInCircle" color="subdued" />
+              </span>
+            </EuiToolTip>
+          }
+          fullWidth
+        >
+          <EuiPanel paddingSize="s">
+            <CodeEditor
+              languageId="json"
+              height={400}
+              value={document}
+              onChange={nextDocument => updatePayload({ document: nextDocument })}
+              options={{
+                fontSize: 12,
+                minimap: {
+                  enabled: false,
+                },
+                scrollBeyondLastLine: false,
+                wordWrap: 'on',
+                wrappingIndent: 'indent',
+                automaticLayout: true,
+              }}
+            />
+          </EuiPanel>
+        </EuiFormRow>
+      )}
+    </>
+  );
+};
diff --git a/x-pack/plugins/security/public/authentication/login/components/basic_login_form/index.ts b/x-pack/plugins/painless_lab/public/application/components/output_pane/index.ts
similarity index 82%
rename from x-pack/plugins/security/public/authentication/login/components/basic_login_form/index.ts
rename to x-pack/plugins/painless_lab/public/application/components/output_pane/index.ts
index 3c1350ba590a6..85b7a7816b5aa 100644
--- a/x-pack/plugins/security/public/authentication/login/components/basic_login_form/index.ts
+++ b/x-pack/plugins/painless_lab/public/application/components/output_pane/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { BasicLoginForm } from './basic_login_form';
+export { OutputPane } from './output_pane';
diff --git a/x-pack/plugins/painless_lab/public/application/components/output_pane/output_pane.tsx b/x-pack/plugins/painless_lab/public/application/components/output_pane/output_pane.tsx
new file mode 100644
index 0000000000000..e6a97bb02f738
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/components/output_pane/output_pane.tsx
@@ -0,0 +1,79 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import {
+  EuiIcon,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiLoadingSpinner,
+  EuiPanel,
+  EuiTabbedContent,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+import { Response } from '../../types';
+import { OutputTab } from './output_tab';
+import { ParametersTab } from './parameters_tab';
+import { ContextTab } from './context_tab';
+
+interface Props {
+  isLoading: boolean;
+  response?: Response;
+}
+
+export const OutputPane: FunctionComponent<Props> = ({ isLoading, response }) => {
+  const outputTabLabel = (
+    <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
+      <EuiFlexItem grow={false}>
+        {isLoading ? (
+          <EuiLoadingSpinner size="m" />
+        ) : response && response.error ? (
+          <EuiIcon type="alert" color="danger" />
+        ) : (
+          <EuiIcon type="check" color="secondary" />
+        )}
+      </EuiFlexItem>
+
+      <EuiFlexItem grow={false}>
+        {i18n.translate('xpack.painlessLab.outputTabLabel', {
+          defaultMessage: 'Output',
+        })}
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+
+  return (
+    <EuiPanel className="painlessLabRightPane">
+      <EuiTabbedContent
+        className="painlessLabRightPane__tabs"
+        size="s"
+        tabs={[
+          {
+            id: 'output',
+            // TODO: Currently this causes an Eui prop error because it is expecting string, but we give it React.ReactNode - should fix.
+            name: outputTabLabel as any,
+            content: <OutputTab response={response} />,
+          },
+          {
+            id: 'parameters',
+            name: i18n.translate('xpack.painlessLab.parametersTabLabel', {
+              defaultMessage: 'Parameters',
+            }),
+            content: <ParametersTab />,
+          },
+          {
+            id: 'context',
+            name: i18n.translate('xpack.painlessLab.contextTabLabel', {
+              defaultMessage: 'Context',
+            }),
+            content: <ContextTab />,
+          },
+        ]}
+      />
+    </EuiPanel>
+  );
+};
diff --git a/x-pack/plugins/painless_lab/public/application/components/output_pane/output_tab.tsx b/x-pack/plugins/painless_lab/public/application/components/output_pane/output_tab.tsx
new file mode 100644
index 0000000000000..8969e5421640a
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/components/output_pane/output_tab.tsx
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { EuiCodeBlock, EuiSpacer } from '@elastic/eui';
+
+import { formatResponse } from '../../lib/format';
+import { Response } from '../../types';
+
+interface Props {
+  response?: Response;
+}
+
+export function OutputTab({ response }: Props) {
+  return (
+    <>
+      <EuiSpacer size="m" />
+      <EuiCodeBlock language="json" paddingSize="s" isCopyable>
+        {formatResponse(response)}
+      </EuiCodeBlock>
+    </>
+  );
+}
diff --git a/x-pack/plugins/painless_lab/public/application/components/output_pane/parameters_tab.tsx b/x-pack/plugins/painless_lab/public/application/components/output_pane/parameters_tab.tsx
new file mode 100644
index 0000000000000..7c8bce0f7b21b
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/components/output_pane/parameters_tab.tsx
@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { FunctionComponent } from 'react';
+import {
+  EuiFormRow,
+  EuiPanel,
+  EuiSpacer,
+  EuiIcon,
+  EuiToolTip,
+  EuiLink,
+  EuiText,
+} from '@elastic/eui';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { monaco } from '@kbn/ui-shared-deps/monaco';
+import { i18n } from '@kbn/i18n';
+import { CodeEditor } from '../../../../../../../src/plugins/kibana_react/public';
+
+import { useAppContext } from '../../context';
+
+export const ParametersTab: FunctionComponent = () => {
+  const {
+    store: { payload },
+    updatePayload,
+    links,
+  } = useAppContext();
+  return (
+    <>
+      <EuiSpacer size="m" />
+      <EuiFormRow
+        label={
+          <EuiToolTip
+            content={i18n.translate('xpack.painlessLab.parametersFieldTooltipText', {
+              defaultMessage: 'These variables are assigned to the "params" object in your script',
+            })}
+          >
+            <span>
+              <FormattedMessage
+                id="xpack.painlessLab.parametersFieldLabel"
+                defaultMessage="Parameters (JSON)"
+              />{' '}
+              <EuiIcon type="questionInCircle" color="subdued" />
+            </span>
+          </EuiToolTip>
+        }
+        fullWidth
+        labelAppend={
+          <EuiText size="xs">
+            <EuiLink href={links.modulesScriptingPreferParams} target="_blank">
+              {i18n.translate('xpack.painlessLab.parametersFieldDocLinkText', {
+                defaultMessage: 'Parameters docs',
+              })}
+            </EuiLink>
+          </EuiText>
+        }
+      >
+        <EuiPanel paddingSize="s">
+          <CodeEditor
+            languageId="json"
+            height={600}
+            value={payload.parameters}
+            onChange={nextParams => updatePayload({ parameters: nextParams })}
+            options={{
+              fontSize: 12,
+              minimap: {
+                enabled: false,
+              },
+              scrollBeyondLastLine: false,
+              wordWrap: 'on',
+              wrappingIndent: 'indent',
+              automaticLayout: true,
+            }}
+            editorDidMount={(editor: monaco.editor.IStandaloneCodeEditor) => {
+              // Updating tab size for the editor
+              const model = editor.getModel();
+              if (model) {
+                model.updateOptions({ tabSize: 2 });
+              }
+            }}
+          />
+        </EuiPanel>
+      </EuiFormRow>
+    </>
+  );
+};
diff --git a/x-pack/plugins/painless_lab/public/application/components/request_flyout.tsx b/x-pack/plugins/painless_lab/public/application/components/request_flyout.tsx
new file mode 100644
index 0000000000000..123df91f4346a
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/components/request_flyout.tsx
@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { FunctionComponent } from 'react';
+import {
+  EuiCodeBlock,
+  EuiTabbedContent,
+  EuiTitle,
+  EuiFlyout,
+  EuiFlyoutHeader,
+  EuiFlyoutBody,
+  EuiButtonEmpty,
+  EuiFlexGroup,
+  EuiFlexItem,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { Links } from '../../links';
+
+interface Props {
+  onClose: any;
+  requestBody: string;
+  links: Links;
+  response?: string;
+}
+
+export const RequestFlyout: FunctionComponent<Props> = ({
+  onClose,
+  requestBody,
+  response,
+  links,
+}) => {
+  return (
+    <EuiFlyout onClose={onClose} maxWidth={640}>
+      <EuiFlyoutHeader>
+        <EuiFlexGroup gutterSize="xs" alignItems="flexEnd">
+          <EuiFlexItem>
+            {/* We need an extra div to get out of flex grow */}
+            <div>
+              <EuiTitle size="m">
+                <h2>
+                  {i18n.translate('xpack.painlessLab.flyoutTitle', {
+                    defaultMessage: 'API request',
+                  })}
+                </h2>
+              </EuiTitle>
+            </div>
+          </EuiFlexItem>
+
+          <EuiFlexItem grow={false}>
+            <EuiButtonEmpty
+              size="s"
+              flush="right"
+              href={links.painlessExecuteAPI}
+              target="_blank"
+              iconType="help"
+            >
+              {i18n.translate('xpack.painlessLab.flyoutDocLink', {
+                defaultMessage: 'API documentation',
+              })}
+            </EuiButtonEmpty>
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      </EuiFlyoutHeader>
+
+      <EuiFlyoutBody>
+        <EuiTabbedContent
+          size="s"
+          tabs={[
+            {
+              id: 'request',
+              name: 'Request',
+              content: (
+                <EuiCodeBlock language="json" paddingSize="s" isCopyable>
+                  {'POST _scripts/painless/_execute\n'}
+                  {requestBody}
+                </EuiCodeBlock>
+              ),
+            },
+            {
+              id: 'response',
+              name: 'Response',
+              content: (
+                <EuiCodeBlock language="json" paddingSize="s" isCopyable>
+                  {response}
+                </EuiCodeBlock>
+              ),
+            },
+          ]}
+        />
+
+        <div className="painlessLabBottomBarPlaceholder" />
+      </EuiFlyoutBody>
+    </EuiFlyout>
+  );
+};
diff --git a/x-pack/plugins/painless_lab/public/application/constants.tsx b/x-pack/plugins/painless_lab/public/application/constants.tsx
new file mode 100644
index 0000000000000..d8430dbfc7d9d
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/constants.tsx
@@ -0,0 +1,135 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+
+import { EuiText } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+
+const defaultLabel = i18n.translate('xpack.painlessLab.contextDefaultLabel', {
+  defaultMessage: 'Basic',
+});
+
+const filterLabel = i18n.translate('xpack.painlessLab.contextFilterLabel', {
+  defaultMessage: 'Filter',
+});
+
+const scoreLabel = i18n.translate('xpack.painlessLab.contextScoreLabel', {
+  defaultMessage: 'Score',
+});
+
+export const painlessContextOptions = [
+  {
+    value: 'painless_test',
+    inputDisplay: defaultLabel,
+    dropdownDisplay: (
+      <>
+        <strong>{defaultLabel}</strong>
+        <EuiText size="s" color="subdued">
+          <p className="euiTextColor--subdued">
+            {i18n.translate('xpack.painlessLab.context.defaultLabel', {
+              defaultMessage: 'The script result will be converted to a string',
+            })}
+          </p>
+        </EuiText>
+      </>
+    ),
+  },
+  {
+    value: 'filter',
+    inputDisplay: filterLabel,
+    dropdownDisplay: (
+      <>
+        <strong>{filterLabel}</strong>
+        <EuiText size="s" color="subdued">
+          <p className="euiTextColor--subdued">
+            {i18n.translate('xpack.painlessLab.context.filterLabel', {
+              defaultMessage: "Use the context of a filter's script query",
+            })}
+          </p>
+        </EuiText>
+      </>
+    ),
+  },
+  {
+    value: 'score',
+    inputDisplay: scoreLabel,
+    dropdownDisplay: (
+      <>
+        <strong>{scoreLabel}</strong>
+        <EuiText size="s" color="subdued">
+          <p className="euiTextColor--subdued">
+            {i18n.translate('xpack.painlessLab.context.scoreLabel', {
+              defaultMessage: 'Use the context of a script_score function in function_score query',
+            })}
+          </p>
+        </EuiText>
+      </>
+    ),
+  },
+];
+
+// Render a smiley face as an example.
+export const exampleScript = `boolean isInCircle(def posX, def posY, def circleX, def circleY, def radius) {
+  double distanceFromCircleCenter = Math.sqrt(Math.pow(circleX - posX, 2) + Math.pow(circleY - posY, 2));
+  return distanceFromCircleCenter <= radius;
+}
+
+boolean isOnCircle(def posX, def posY, def circleX, def circleY, def radius, def thickness, def squashY) {
+  double distanceFromCircleCenter = Math.sqrt(Math.pow(circleX - posX, 2) + Math.pow((circleY - posY) / squashY, 2));
+  return (
+    distanceFromCircleCenter >= radius - thickness
+    && distanceFromCircleCenter <= radius + thickness
+  );
+}
+
+def result = '';
+int charCount = 0;
+
+// Canvas dimensions
+int width = 31;
+int height = 31;
+double halfWidth = Math.floor(width * 0.5);
+double halfHeight = Math.floor(height * 0.5);
+
+// Style constants
+double strokeWidth = 0.6;
+
+// Smiley face configuration
+int headSize = 13;
+double headSquashY = 0.78;
+int eyePositionX = 10;
+int eyePositionY = 12;
+int eyeSize = 1;
+int mouthSize = 15;
+int mouthPositionX = width / 2;
+int mouthPositionY = 5;
+int mouthOffsetY = 11;
+
+for (int y = 0; y < height; y++) {
+  for (int x = 0; x < width; x++) {
+    boolean isHead = isOnCircle(x, y, halfWidth, halfHeight, headSize, strokeWidth, headSquashY);
+    boolean isLeftEye = isInCircle(x, y, eyePositionX, eyePositionY, eyeSize);
+    boolean isRightEye = isInCircle(x, y, width - eyePositionX - 1, eyePositionY, eyeSize);
+    boolean isMouth = isOnCircle(x, y, mouthPositionX, mouthPositionY, mouthSize, strokeWidth, 1) && y > mouthPositionY + mouthOffsetY;
+
+    if (isLeftEye || isRightEye || isMouth || isHead) {
+      result += "*";
+    } else {
+      result += ".";
+    }
+
+    result += " ";
+
+    // Make sure the smiley face doesn't deform as the container changes width.
+    charCount++;
+    if (charCount % width === 0) {
+      result += "\\\\n";
+    }
+  }
+}
+
+return result;`;
diff --git a/x-pack/plugins/painless_lab/public/application/context/context.tsx b/x-pack/plugins/painless_lab/public/application/context/context.tsx
new file mode 100644
index 0000000000000..0fb5842dfea58
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/context/context.tsx
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { createContext, ReactNode, useState, useContext } from 'react';
+import { HttpSetup, ChromeStart } from 'src/core/public';
+
+import { Links } from '../../links';
+import { Store, Payload, Validation } from '../types';
+import { initialPayload } from './initial_payload';
+
+interface AppContextProviderArgs {
+  children: ReactNode;
+  value: {
+    http: HttpSetup;
+    links: Links;
+    chrome: ChromeStart;
+  };
+}
+
+interface ContextValue {
+  store: Store;
+  updatePayload: (changes: Partial<Payload>) => void;
+  services: {
+    http: HttpSetup;
+    chrome: ChromeStart;
+  };
+  links: Links;
+}
+
+const AppContext = createContext<ContextValue>(undefined as any);
+
+const validatePayload = (payload: Payload): Validation => {
+  const { index } = payload;
+
+  // For now just validate that the user has entered an index.
+  const indexExists = Boolean(index || index.trim());
+
+  return {
+    isValid: indexExists,
+    fields: {
+      index: indexExists,
+    },
+  };
+};
+
+export const AppContextProvider = ({
+  children,
+  value: { http, links, chrome },
+}: AppContextProviderArgs) => {
+  const PAINLESS_LAB_KEY = 'painlessLabState';
+
+  const [store, setStore] = useState<Store>(() => {
+    // Using a callback here ensures these values are only calculated on the first render.
+    const defaultPayload = {
+      ...initialPayload,
+      ...JSON.parse(localStorage.getItem(PAINLESS_LAB_KEY) || '{}'),
+    };
+
+    return {
+      payload: defaultPayload,
+      validation: validatePayload(defaultPayload),
+    };
+  });
+
+  const updatePayload = (changes: Partial<Payload>): void => {
+    const nextPayload = {
+      ...store.payload,
+      ...changes,
+    };
+    // Persist state locally so we can load it up when the user reopens the app.
+    localStorage.setItem(PAINLESS_LAB_KEY, JSON.stringify(nextPayload));
+
+    setStore({
+      payload: nextPayload,
+      validation: validatePayload(nextPayload),
+    });
+  };
+
+  return (
+    <AppContext.Provider value={{ updatePayload, store, services: { http, chrome }, links }}>
+      {children}
+    </AppContext.Provider>
+  );
+};
+
+export const useAppContext = () => {
+  const ctx = useContext(AppContext);
+  if (!ctx) {
+    throw new Error('AppContext can only be used inside of AppContextProvider!');
+  }
+  return ctx;
+};
diff --git a/x-pack/plugins/painless_lab/public/application/context/index.tsx b/x-pack/plugins/painless_lab/public/application/context/index.tsx
new file mode 100644
index 0000000000000..7a685137b7a4f
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/context/index.tsx
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { AppContextProvider, useAppContext } from './context';
diff --git a/x-pack/plugins/painless_lab/public/application/context/initial_payload.ts b/x-pack/plugins/painless_lab/public/application/context/initial_payload.ts
new file mode 100644
index 0000000000000..4d9d8ad8b3ae7
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/context/initial_payload.ts
@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { exampleScript, painlessContextOptions } from '../constants';
+
+export const initialPayload = {
+  context: painlessContextOptions[0].value,
+  code: exampleScript,
+  parameters: `{
+  "string_parameter": "string value",
+  "number_parameter": 1.5,
+  "boolean_parameter": true
+}`,
+  index: 'my-index',
+  document: `{
+  "my_field": "field_value"
+}`,
+  query: '',
+};
diff --git a/x-pack/plugins/security/common/model/kibana_privileges/index.ts b/x-pack/plugins/painless_lab/public/application/hooks/index.ts
similarity index 81%
rename from x-pack/plugins/security/common/model/kibana_privileges/index.ts
rename to x-pack/plugins/painless_lab/public/application/hooks/index.ts
index ab9baa1356c4b..159ff96d2278c 100644
--- a/x-pack/plugins/security/common/model/kibana_privileges/index.ts
+++ b/x-pack/plugins/painless_lab/public/application/hooks/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { KibanaPrivileges } from './kibana_privileges';
+export { useSubmitCode } from './use_submit_code';
diff --git a/x-pack/plugins/painless_lab/public/application/hooks/use_submit_code.ts b/x-pack/plugins/painless_lab/public/application/hooks/use_submit_code.ts
new file mode 100644
index 0000000000000..36cd4f280ac4c
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/hooks/use_submit_code.ts
@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { useRef, useCallback, useState } from 'react';
+import { HttpSetup } from 'kibana/public';
+import { debounce } from 'lodash';
+
+import { API_BASE_PATH } from '../../../common/constants';
+import { Response, PayloadFormat, Payload } from '../types';
+import { formatRequestPayload } from '../lib/format';
+
+const DEBOUNCE_MS = 800;
+
+export const useSubmitCode = (http: HttpSetup) => {
+  const currentRequestIdRef = useRef(0);
+  const [response, setResponse] = useState<Response | undefined>(undefined);
+  const [inProgress, setInProgress] = useState(false);
+
+  const submit = useCallback(
+    debounce(
+      async (config: Payload) => {
+        setInProgress(true);
+
+        // Prevent an older request that resolves after a more recent request from clobbering it.
+        // We store the resulting ID in this closure for comparison when the request resolves.
+        const requestId = ++currentRequestIdRef.current;
+
+        try {
+          const result = await http.post(`${API_BASE_PATH}/execute`, {
+            // Stringify the string, because http runs it through JSON.parse, and we want to actually
+            // send a JSON string.
+            body: JSON.stringify(formatRequestPayload(config, PayloadFormat.UGLY)),
+          });
+
+          if (currentRequestIdRef.current === requestId) {
+            setResponse(result);
+            setInProgress(false);
+          }
+          // else ignore this response...
+        } catch (error) {
+          if (currentRequestIdRef.current === requestId) {
+            setResponse({
+              error,
+            });
+            setInProgress(false);
+          }
+          // else ignore this response...
+        }
+      },
+      DEBOUNCE_MS,
+      { trailing: true }
+    ),
+    [http]
+  );
+
+  return {
+    response,
+    inProgress,
+    submit,
+  };
+};
diff --git a/x-pack/plugins/painless_lab/public/application/index.tsx b/x-pack/plugins/painless_lab/public/application/index.tsx
new file mode 100644
index 0000000000000..ebcb84bbce83c
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/index.tsx
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { render, unmountComponentAtNode } from 'react-dom';
+import { CoreSetup, CoreStart } from 'kibana/public';
+import { HttpSetup, ChromeStart } from 'src/core/public';
+import { createKibanaReactContext } from '../../../../../src/plugins/kibana_react/public';
+
+import { Links } from '../links';
+import { AppContextProvider } from './context';
+import { Main } from './components/main';
+
+interface AppDependencies {
+  http: HttpSetup;
+  I18nContext: CoreStart['i18n']['Context'];
+  uiSettings: CoreSetup['uiSettings'];
+  links: Links;
+  chrome: ChromeStart;
+}
+
+export function renderApp(
+  element: HTMLElement | null,
+  { http, I18nContext, uiSettings, links, chrome }: AppDependencies
+) {
+  if (!element) {
+    return () => undefined;
+  }
+  const { Provider: KibanaReactContextProvider } = createKibanaReactContext({
+    uiSettings,
+  });
+  render(
+    <I18nContext>
+      <KibanaReactContextProvider>
+        <AppContextProvider value={{ http, links, chrome }}>
+          <Main />
+        </AppContextProvider>
+      </KibanaReactContextProvider>
+    </I18nContext>,
+    element
+  );
+  return () => unmountComponentAtNode(element);
+}
diff --git a/x-pack/plugins/painless_lab/public/application/lib/__snapshots__/format.test.ts.snap b/x-pack/plugins/painless_lab/public/application/lib/__snapshots__/format.test.ts.snap
new file mode 100644
index 0000000000000..4df90d1b3abe1
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/lib/__snapshots__/format.test.ts.snap
@@ -0,0 +1,205 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`formatRequestPayload pretty formats a complex multi-line script 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"\\"\\"// Here's a comment and a variable, then a loop.
+    double halfWidth = Math.floor(width * 0.5);
+    for (int y = 0; y < height; y++) {
+      return \\"results here\\\\\\\\n\\";
+    }
+    
+    return result;\\"\\"\\"
+  }
+}"
+`;
+
+exports[`formatRequestPayload pretty formats a single-line script 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"\\"\\"return \\"ok\\";\\"\\"\\"
+  }
+}"
+`;
+
+exports[`formatRequestPayload pretty formats code and parameters 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"\\"\\"return \\"ok\\";\\"\\"\\",
+    \\"params\\": {
+      \\"a\\": {
+        \\"b\\": \\"c\\",
+        \\"d\\": \\"e\\"
+      }
+    }
+  }
+}"
+`;
+
+exports[`formatRequestPayload pretty formats code, context, index, and document 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"\\"\\"return \\"ok\\";\\"\\"\\"
+  },
+  \\"context\\": \\"filter\\",
+  \\"context_setup\\": {
+    \\"index\\": \\"index\\",
+    \\"document\\": {
+      \\"a\\": {
+        \\"b\\": \\"c\\",
+        \\"d\\": \\"e\\"
+      }
+    }
+  }
+}"
+`;
+
+exports[`formatRequestPayload pretty formats code, parameters, and context 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"\\"\\"return \\"ok\\";\\"\\"\\",
+    \\"params\\": {
+      \\"a\\": {
+        \\"b\\": \\"c\\",
+        \\"d\\": \\"e\\"
+      }
+    }
+  },
+  \\"context\\": \\"filter\\",
+  \\"context_setup\\": {
+    \\"index\\": \\"\\",
+    \\"document\\": 
+  }
+}"
+`;
+
+exports[`formatRequestPayload pretty formats code, parameters, context, index, and document 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"\\"\\"return \\"ok\\";\\"\\"\\",
+    \\"params\\": {
+      \\"a\\": {
+        \\"b\\": \\"c\\",
+        \\"d\\": \\"e\\"
+      }
+    }
+  },
+  \\"context\\": \\"filter\\",
+  \\"context_setup\\": {
+    \\"index\\": \\"index\\",
+    \\"document\\": {
+      \\"a\\": {
+        \\"b\\": \\"c\\",
+        \\"d\\": \\"e\\"
+      }
+    }
+  }
+}"
+`;
+
+exports[`formatRequestPayload pretty formats no script 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"\\"\\"\\"\\"\\"
+  }
+}"
+`;
+
+exports[`formatRequestPayload ugly formats a complex multi-line script 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"// Here's a comment and a variable, then a loop.\\\\ndouble halfWidth = Math.floor(width * 0.5);\\\\nfor (int y = 0; y < height; y++) {\\\\n  return \\\\\\"results here\\\\\\\\\\\\\\\\n\\\\\\";\\\\n}\\\\n\\\\nreturn result;\\"
+  }
+}"
+`;
+
+exports[`formatRequestPayload ugly formats a single-line script 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"return \\\\\\"ok\\\\\\";\\"
+  }
+}"
+`;
+
+exports[`formatRequestPayload ugly formats code and parameters 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"return \\\\\\"ok\\\\\\";\\",
+    \\"params\\": {
+  \\"a\\": {
+    \\"b\\": \\"c\\",
+    \\"d\\": \\"e\\"
+  }
+}
+  }
+}"
+`;
+
+exports[`formatRequestPayload ugly formats code, context, index, and document 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"return \\\\\\"ok\\\\\\";\\"
+  },
+  \\"context\\": \\"filter\\",
+  \\"context_setup\\": {
+    \\"index\\": \\"index\\",
+    \\"document\\": {
+  \\"a\\": {
+    \\"b\\": \\"c\\",
+    \\"d\\": \\"e\\"
+  }
+}
+  }
+}"
+`;
+
+exports[`formatRequestPayload ugly formats code, parameters, and context 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"return \\\\\\"ok\\\\\\";\\",
+    \\"params\\": {
+  \\"a\\": {
+    \\"b\\": \\"c\\",
+    \\"d\\": \\"e\\"
+  }
+}
+  },
+  \\"context\\": \\"filter\\",
+  \\"context_setup\\": {
+    \\"index\\": \\"undefined\\",
+    \\"document\\": undefined
+  }
+}"
+`;
+
+exports[`formatRequestPayload ugly formats code, parameters, context, index, and document 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": \\"return \\\\\\"ok\\\\\\";\\",
+    \\"params\\": {
+  \\"a\\": {
+    \\"b\\": \\"c\\",
+    \\"d\\": \\"e\\"
+  }
+}
+  },
+  \\"context\\": \\"filter\\",
+  \\"context_setup\\": {
+    \\"index\\": \\"index\\",
+    \\"document\\": {
+  \\"a\\": {
+    \\"b\\": \\"c\\",
+    \\"d\\": \\"e\\"
+  }
+}
+  }
+}"
+`;
+
+exports[`formatRequestPayload ugly formats no script 1`] = `
+"{
+  \\"script\\": {
+    \\"source\\": undefined
+  }
+}"
+`;
diff --git a/x-pack/plugins/painless_lab/public/application/lib/format.test.ts b/x-pack/plugins/painless_lab/public/application/lib/format.test.ts
new file mode 100644
index 0000000000000..5f0022ebbc089
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/lib/format.test.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PayloadFormat } from '../types';
+import { formatRequestPayload } from './format';
+
+describe('formatRequestPayload', () => {
+  Object.values(PayloadFormat).forEach(format => {
+    describe(`${format} formats`, () => {
+      test('no script', () => {
+        expect(formatRequestPayload({}, format)).toMatchSnapshot();
+      });
+
+      test('a single-line script', () => {
+        const code = 'return "ok";';
+        expect(formatRequestPayload({ code }, format)).toMatchSnapshot();
+      });
+
+      test('a complex multi-line script', () => {
+        const code = `// Here's a comment and a variable, then a loop.
+double halfWidth = Math.floor(width * 0.5);
+for (int y = 0; y < height; y++) {
+  return "results here\\\\n";
+}
+
+return result;`;
+        expect(formatRequestPayload({ code }, format)).toMatchSnapshot();
+      });
+
+      test('code and parameters', () => {
+        const code = 'return "ok";';
+        const parameters = `{
+  "a": {
+    "b": "c",
+    "d": "e"
+  }
+}`;
+        expect(formatRequestPayload({ code, parameters }, format)).toMatchSnapshot();
+      });
+
+      test('code, parameters, and context', () => {
+        const code = 'return "ok";';
+        const parameters = `{
+  "a": {
+    "b": "c",
+    "d": "e"
+  }
+}`;
+        const context = 'filter';
+        expect(formatRequestPayload({ code, parameters, context }, format)).toMatchSnapshot();
+      });
+
+      test('code, context, index, and document', () => {
+        const code = 'return "ok";';
+        const context = 'filter';
+        const index = 'index';
+        const document = `{
+  "a": {
+    "b": "c",
+    "d": "e"
+  }
+}`;
+        expect(formatRequestPayload({ code, context, index, document }, format)).toMatchSnapshot();
+      });
+
+      test('code, parameters, context, index, and document', () => {
+        const code = 'return "ok";';
+        const parameters = `{
+  "a": {
+    "b": "c",
+    "d": "e"
+  }
+}`;
+        const context = 'filter';
+        const index = 'index';
+        const document = parameters;
+        expect(
+          formatRequestPayload({ code, parameters, context, index, document }, format)
+        ).toMatchSnapshot();
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/painless_lab/public/application/lib/format.ts b/x-pack/plugins/painless_lab/public/application/lib/format.ts
new file mode 100644
index 0000000000000..15ecdf682d247
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/lib/format.ts
@@ -0,0 +1,117 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Response, ExecutionError, PayloadFormat, Payload } from '../types';
+
+function prettifyPayload(payload = '', indentationLevel = 0) {
+  const indentation = new Array(indentationLevel + 1).join(' ');
+  return payload.replace(/\n/g, `\n${indentation}`);
+}
+
+/**
+ * Values should be preserved as strings so that floating point precision,
+ * e.g. 1.0, is preserved instead of being coerced to an integer, e.g. 1.
+ */
+export function formatRequestPayload(
+  { code, context, parameters, index, document, query }: Partial<Payload>,
+  format: PayloadFormat = PayloadFormat.UGLY
+): string {
+  const isAdvancedContext = context === 'filter' || context === 'score';
+
+  let formattedCode: string | undefined;
+  let formattedParameters: string | undefined;
+  let formattedContext: string | undefined;
+  let formattedIndex: string | undefined;
+  let formattedDocument: string | undefined;
+  let formattedQuery: string | undefined;
+
+  if (format === PayloadFormat.UGLY) {
+    formattedCode = JSON.stringify(code);
+    formattedParameters = parameters;
+    formattedContext = context;
+    formattedIndex = index;
+    formattedDocument = document;
+    formattedQuery = query;
+  } else {
+    // Triple quote the code because it's multiline.
+    formattedCode = `"""${prettifyPayload(code, 4)}"""`;
+    formattedParameters = prettifyPayload(parameters, 4);
+    formattedContext = prettifyPayload(context, 6);
+    formattedIndex = prettifyPayload(index);
+    formattedDocument = prettifyPayload(document, 4);
+    formattedQuery = prettifyPayload(query, 4);
+  }
+
+  const requestPayload = `{
+  "script": {
+    "source": ${formattedCode}${
+    parameters
+      ? `,
+    "params": ${formattedParameters}`
+      : ``
+  }
+  }${
+    isAdvancedContext
+      ? `,
+  "context": "${formattedContext}",
+  "context_setup": {
+    "index": "${formattedIndex}",
+    "document": ${formattedDocument}${
+          query && context === 'score'
+            ? `,
+    "query": ${formattedQuery}`
+            : ''
+        }
+  }`
+      : ``
+  }
+}`;
+  return requestPayload;
+}
+
+/**
+ * Stringify a given object to JSON in a formatted way
+ */
+export function formatJson(json: unknown): string {
+  try {
+    return JSON.stringify(json, null, 2);
+  } catch (e) {
+    return `Invalid JSON ${String(json)}`;
+  }
+}
+
+export function formatResponse(response?: Response): string {
+  if (!response) {
+    return '';
+  }
+  if (typeof response.result === 'string') {
+    return response.result.replace(/\\n/g, '\n');
+  } else if (response.error) {
+    return formatExecutionError(response.error);
+  }
+  return formatJson(response);
+}
+
+export function formatExecutionError(executionErrorOrError: ExecutionError | Error): string {
+  if (executionErrorOrError instanceof Error) {
+    return executionErrorOrError.message;
+  }
+
+  if (
+    executionErrorOrError.script_stack &&
+    executionErrorOrError.caused_by &&
+    executionErrorOrError.position
+  ) {
+    return `Unhandled Exception ${executionErrorOrError.caused_by.type}
+
+${executionErrorOrError.caused_by.reason}
+
+Stack:
+${formatJson(executionErrorOrError.script_stack)}
+`;
+  }
+  return formatJson(executionErrorOrError);
+}
diff --git a/x-pack/plugins/painless_lab/public/application/types.ts b/x-pack/plugins/painless_lab/public/application/types.ts
new file mode 100644
index 0000000000000..d800558ef7ecc
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/application/types.ts
@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export interface Store {
+  payload: Payload;
+  validation: Validation;
+}
+
+export interface Payload {
+  context: string;
+  code: string;
+  parameters: string;
+  index: string;
+  document: string;
+  query: string;
+}
+
+export interface Validation {
+  isValid: boolean;
+  fields: {
+    index: boolean;
+  };
+}
+
+// TODO: This should be an enumerated list
+export type Context = string;
+
+export enum PayloadFormat {
+  UGLY = 'ugly',
+  PRETTY = 'pretty',
+}
+
+export interface Response {
+  error?: ExecutionError | Error;
+  result?: string;
+}
+
+export type ExecutionErrorScriptStack = string[];
+
+export interface ExecutionErrorPosition {
+  start: number;
+  end: number;
+  offset: number;
+}
+
+export interface ExecutionError {
+  script_stack?: ExecutionErrorScriptStack;
+  caused_by?: {
+    type: string;
+    reason: string;
+  };
+  message?: string;
+  position: ExecutionErrorPosition;
+  script: string;
+}
diff --git a/x-pack/plugins/painless_lab/public/index.scss b/x-pack/plugins/painless_lab/public/index.scss
new file mode 100644
index 0000000000000..29a5761255278
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/index.scss
@@ -0,0 +1 @@
+@import 'styles/index';
diff --git a/x-pack/plugins/security/public/authentication/login/login_state.ts b/x-pack/plugins/painless_lab/public/index.ts
similarity index 63%
rename from x-pack/plugins/security/public/authentication/login/login_state.ts
rename to x-pack/plugins/painless_lab/public/index.ts
index 6ca38296706fe..da357e52af676 100644
--- a/x-pack/plugins/security/public/authentication/login/login_state.ts
+++ b/x-pack/plugins/painless_lab/public/index.ts
@@ -4,9 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { LoginLayout } from '../../../common/licensing';
+import './styles/_index.scss';
+import { PainlessLabUIPlugin } from './plugin';
 
-export interface LoginState {
-  layout: LoginLayout;
-  allowLogin: boolean;
+export function plugin() {
+  return new PainlessLabUIPlugin();
 }
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__fixtures__/index.ts b/x-pack/plugins/painless_lab/public/lib/index.ts
similarity index 79%
rename from x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__fixtures__/index.ts
rename to x-pack/plugins/painless_lab/public/lib/index.ts
index 09e449f61356f..2421307b7c107 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__fixtures__/index.ts
+++ b/x-pack/plugins/painless_lab/public/lib/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { rawKibanaPrivileges } from './raw_kibana_privileges';
+export { monacoPainlessLang } from './monaco_painless_lang';
diff --git a/x-pack/plugins/painless_lab/public/lib/monaco_painless_lang.ts b/x-pack/plugins/painless_lab/public/lib/monaco_painless_lang.ts
new file mode 100644
index 0000000000000..602697064a768
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/lib/monaco_painless_lang.ts
@@ -0,0 +1,174 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as monaco from 'monaco-editor';
+
+/**
+ * Extends the default type for a Monarch language so we can use
+ * attribute references (like @keywords to reference the keywords list)
+ * in the defined tokenizer
+ */
+interface Language extends monaco.languages.IMonarchLanguage {
+  default: string;
+  brackets: any;
+  keywords: string[];
+  symbols: RegExp;
+  escapes: RegExp;
+  digits: RegExp;
+  primitives: string[];
+  octaldigits: RegExp;
+  binarydigits: RegExp;
+  constants: string[];
+  operators: string[];
+}
+
+export const monacoPainlessLang = {
+  default: '',
+  // painless does not use < >, so we define our own
+  brackets: [
+    ['{', '}', 'delimiter.curly'],
+    ['[', ']', 'delimiter.square'],
+    ['(', ')', 'delimiter.parenthesis'],
+  ],
+  keywords: [
+    'if',
+    'in',
+    'else',
+    'while',
+    'do',
+    'for',
+    'continue',
+    'break',
+    'return',
+    'new',
+    'try',
+    'catch',
+    'throw',
+    'this',
+    'instanceof',
+  ],
+  primitives: ['void', 'boolean', 'byte', 'short', 'char', 'int', 'long', 'float', 'double', 'def'],
+  constants: ['true', 'false'],
+  operators: [
+    '=',
+    '>',
+    '<',
+    '!',
+    '~',
+    '?',
+    '?:',
+    '?.',
+    ':',
+    '==',
+    '===',
+    '<=',
+    '>=',
+    '!=',
+    '!==',
+    '&&',
+    '||',
+    '++',
+    '--',
+    '+',
+    '-',
+    '*',
+    '/',
+    '&',
+    '|',
+    '^',
+    '%',
+    '<<',
+    '>>',
+    '>>>',
+    '+=',
+    '-=',
+    '*=',
+    '/=',
+    '&=',
+    '|=',
+    '^=',
+    '%=',
+    '<<=',
+    '>>=',
+    '>>>=',
+    '->',
+    '::',
+    '=~',
+    '==~',
+  ],
+  symbols: /[=><!~?:&|+\-*\/^%]+/,
+  escapes: /\\(?:[abfnrtv\\"']|x[0-9A-Fa-f]{1,4}|u[0-9A-Fa-f]{4}|U[0-9A-Fa-f]{8})/,
+  digits: /\d+(_+\d+)*/,
+  octaldigits: /[0-7]+(_+[0-7]+)*/,
+  binarydigits: /[0-1]+(_+[0-1]+)*/,
+  hexdigits: /[[0-9a-fA-F]+(_+[0-9a-fA-F]+)*/,
+  tokenizer: {
+    root: [
+      // identifiers and keywords
+      [
+        /[a-zA-Z_][\w]*/,
+        {
+          cases: {
+            '@keywords': 'keyword',
+            '@primitives': 'type',
+            '@constants': 'constant',
+            '@default': 'identifier',
+          },
+        },
+      ],
+      // whitespace
+      [/[ \t\r\n]+/, '@whitespace'],
+      // comments
+      // [/\/\*/, 'comment', '@comment'],
+      [/\/\/.*$/, 'comment'],
+      // brackets
+      [/[{}()\[\]]/, '@brackets'],
+      // operators
+      [
+        /@symbols/,
+        {
+          cases: {
+            '@operators': 'operators',
+            '@default': '',
+          },
+        },
+      ],
+      // numbers
+      [/(@digits)[eE]([\-+]?(@digits))?[fFdD]?/, 'number.float'],
+      [/(@digits)\.(@digits)([eE][\-+]?(@digits))?[fFdD]?/, 'number.float'],
+      [/0[xX](@hexdigits)[Ll]?/, 'number.hex'],
+      [/0(@octaldigits)[Ll]?/, 'number.octal'],
+      [/0[bB](@binarydigits)[Ll]?/, 'number.binary'],
+      [/(@digits)[fFdD]/, 'number.float'],
+      [/(@digits)[lL]?/, 'number'],
+      // delimiter: after numbers due to conflict with decimals and dot
+      [/[;,.]/, 'delimiter'],
+      // strings double quoted
+      [/"([^"\\]|\\.)*$/, 'string.invalid'], // string without termination
+      [/"/, 'string', '@string_dq'],
+      // strings single quoted
+      [/'([^'\\]|\\.)*$/, 'string.invalid'], // string without termination
+      [/'/, 'string', '@string_sq'],
+    ],
+    comment: [
+      [/[^\/*]+/, 'comment'],
+      [/\*\//, 'comment', '@pop'],
+      [/[\/*]/, 'comment'],
+    ],
+    string_dq: [
+      [/[^\\"]+/, 'string'],
+      [/@escapes/, 'string.escape'],
+      [/\\./, 'string.escape.invalid'],
+      [/"/, 'string', '@pop'],
+    ],
+    string_sq: [
+      [/[^\\']+/, 'string'],
+      [/@escapes/, 'string.escape'],
+      [/\\./, 'string.escape.invalid'],
+      [/'/, 'string', '@pop'],
+    ],
+  },
+} as Language;
diff --git a/x-pack/plugins/painless_lab/public/links.ts b/x-pack/plugins/painless_lab/public/links.ts
new file mode 100644
index 0000000000000..8f610140c3f34
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/links.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { DocLinksStart } from 'src/core/public';
+
+export type Links = ReturnType<typeof getLinks>;
+
+export const getLinks = ({ DOC_LINK_VERSION, ELASTIC_WEBSITE_URL }: DocLinksStart) =>
+  Object.freeze({
+    painlessExecuteAPI: `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/painless/${DOC_LINK_VERSION}/painless-execute-api.html`,
+    painlessExecuteAPIContexts: `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/painless/${DOC_LINK_VERSION}/painless-execute-api.html#_contexts`,
+    painlessAPIReference: `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/painless/${DOC_LINK_VERSION}/painless-api-reference.html`,
+    painlessWalkthrough: `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/painless/${DOC_LINK_VERSION}/painless-walkthrough.html`,
+    painlessLangSpec: `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/painless/${DOC_LINK_VERSION}/painless-lang-spec.html`,
+    esQueryDSL: `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/reference/${DOC_LINK_VERSION}/query-dsl.html`,
+    modulesScriptingPreferParams: `${ELASTIC_WEBSITE_URL}guide/en/elasticsearch/reference/${DOC_LINK_VERSION}/modules-scripting-using.html#prefer-params`,
+  });
diff --git a/x-pack/plugins/painless_lab/public/plugin.tsx b/x-pack/plugins/painless_lab/public/plugin.tsx
new file mode 100644
index 0000000000000..b9ca7031cf670
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/plugin.tsx
@@ -0,0 +1,114 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { Plugin, CoreStart, CoreSetup } from 'kibana/public';
+import { first } from 'rxjs/operators';
+import { EuiBetaBadge, EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+
+import { FeatureCatalogueCategory } from '../../../../src/plugins/home/public';
+import { LICENSE_CHECK_STATE } from '../../licensing/public';
+
+import { PLUGIN } from '../common/constants';
+
+import { PluginDependencies } from './types';
+import { getLinks } from './links';
+import { LanguageService } from './services';
+
+export class PainlessLabUIPlugin implements Plugin<void, void, PluginDependencies> {
+  languageService = new LanguageService();
+
+  async setup(
+    { http, getStartServices, uiSettings }: CoreSetup,
+    { devTools, home, licensing }: PluginDependencies
+  ) {
+    home.featureCatalogue.register({
+      id: PLUGIN.id,
+      title: i18n.translate('xpack.painlessLab.registryProviderTitle', {
+        defaultMessage: 'Painless Lab (beta)',
+      }),
+      description: i18n.translate('xpack.painlessLab.registryProviderDescription', {
+        defaultMessage: 'Simulate and debug painless code.',
+      }),
+      icon: '',
+      path: '/app/kibana#/dev_tools/painless_lab',
+      showOnHomePage: false,
+      category: FeatureCatalogueCategory.ADMIN,
+    });
+
+    devTools.register({
+      id: 'painless_lab',
+      order: 7,
+      title: (
+        <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
+          <EuiFlexItem grow={false}>
+            {i18n.translate('xpack.painlessLab.displayName', {
+              defaultMessage: 'Painless Lab',
+            })}
+          </EuiFlexItem>
+
+          <EuiFlexItem grow={false} className="painlessLab__betaLabelContainer">
+            <EuiBetaBadge
+              label={i18n.translate('xpack.painlessLab.displayNameBetaLabel', {
+                defaultMessage: 'Beta',
+              })}
+              tooltipContent={i18n.translate('xpack.painlessLab.displayNameBetaTooltipText', {
+                defaultMessage: 'This feature might change drastically in future releases',
+              })}
+            />
+          </EuiFlexItem>
+        </EuiFlexGroup>
+      ) as any,
+      enableRouting: false,
+      disabled: false,
+      mount: async (ctx, { element }) => {
+        const [core] = await getStartServices();
+
+        const {
+          i18n: { Context: I18nContext },
+          notifications,
+          docLinks,
+          chrome,
+        } = core;
+
+        this.languageService.setup();
+
+        const license = await licensing.license$.pipe(first()).toPromise();
+        const { state, message: invalidLicenseMessage } = license.check(
+          PLUGIN.id,
+          PLUGIN.minimumLicenseType
+        );
+        const isValidLicense = state === LICENSE_CHECK_STATE.Valid;
+
+        if (!isValidLicense) {
+          notifications.toasts.addDanger(invalidLicenseMessage as string);
+          window.location.hash = '/dev_tools';
+          return () => {};
+        }
+
+        const { renderApp } = await import('./application');
+        const tearDownApp = renderApp(element, {
+          I18nContext,
+          http,
+          uiSettings,
+          links: getLinks(docLinks),
+          chrome,
+        });
+
+        return () => {
+          tearDownApp();
+        };
+      },
+    });
+  }
+
+  async start(core: CoreStart, plugins: any) {}
+
+  async stop() {
+    this.languageService.stop();
+  }
+}
diff --git a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/index.ts b/x-pack/plugins/painless_lab/public/services/index.ts
similarity index 76%
rename from x-pack/legacy/plugins/xpack_main/server/telemetry_collection/index.ts
rename to x-pack/plugins/painless_lab/public/services/index.ts
index 0b13957d7089c..20bec9de24550 100644
--- a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/index.ts
+++ b/x-pack/plugins/painless_lab/public/services/index.ts
@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { registerMonitoringCollection } from './register_xpack_collection';
+export { LanguageService } from './language_service';
diff --git a/x-pack/plugins/painless_lab/public/services/language_service.ts b/x-pack/plugins/painless_lab/public/services/language_service.ts
new file mode 100644
index 0000000000000..efff9cd0e78d5
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/services/language_service.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+// It is important that we use this specific monaco instance so that
+// editor settings are registered against the instance our React component
+// uses.
+import { monaco } from '@kbn/ui-shared-deps/monaco';
+
+// @ts-ignore
+import workerSrc from 'raw-loader!monaco-editor/min/vs/base/worker/workerMain.js';
+
+import { monacoPainlessLang } from '../lib';
+
+const LANGUAGE_ID = 'painless';
+
+// Safely check whether these globals are present
+const CAN_CREATE_WORKER = typeof Blob === 'function' && typeof Worker === 'function';
+
+export class LanguageService {
+  private originalMonacoEnvironment: any;
+
+  public setup() {
+    monaco.languages.register({ id: LANGUAGE_ID });
+    monaco.languages.setMonarchTokensProvider(LANGUAGE_ID, monacoPainlessLang);
+
+    if (CAN_CREATE_WORKER) {
+      this.originalMonacoEnvironment = (window as any).MonacoEnvironment;
+      (window as any).MonacoEnvironment = {
+        getWorker: () => {
+          const blob = new Blob([workerSrc], { type: 'application/javascript' });
+          return new Worker(window.URL.createObjectURL(blob));
+        },
+      };
+    }
+  }
+
+  public stop() {
+    if (CAN_CREATE_WORKER) {
+      (window as any).MonacoEnvironment = this.originalMonacoEnvironment;
+    }
+  }
+}
diff --git a/x-pack/plugins/painless_lab/public/styles/_index.scss b/x-pack/plugins/painless_lab/public/styles/_index.scss
new file mode 100644
index 0000000000000..f68dbe302511a
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/styles/_index.scss
@@ -0,0 +1,58 @@
+@import '@elastic/eui/src/components/header/variables';
+@import '@elastic/eui/src/components/nav_drawer/variables';
+
+/**
+ * This is a very brittle way of preventing the editor and other content from disappearing
+ * behind the bottom bar.
+ */
+$bottomBarHeight:  calc(#{$euiSize} * 3);
+
+.painlessLabBottomBarPlaceholder {
+  height: $bottomBarHeight
+}
+
+.painlessLabRightPane {
+  border-right: none;
+  border-top: none;
+  border-bottom: none;
+  border-radius: 0;
+  padding-top: 0;
+  height: 100%;
+}
+
+.painlessLabRightPane__tabs {
+  display: flex;
+  flex-direction: column;
+  height: 100%;
+
+  [role="tabpanel"] {
+    height: 100%;
+    overflow-y: auto;
+  }
+}
+
+.painlessLab__betaLabelContainer {
+  line-height: 0;
+}
+
+.painlessLabMainContainer {
+  height: calc(100vh - calc(#{$euiHeaderChildSize} * 2) - #{$bottomBarHeight});
+}
+
+.painlessLabPanelsContainer {
+  // The panels container should adopt the height of the main container
+  height: 100%;
+}
+
+/**
+ * 1. Hack EUI so the bottom bar doesn't obscure the nav drawer flyout, but is also not obscured
+ *    by the main content area.
+ */
+.painlessLab__bottomBar {
+  z-index: 5; /* 1 */
+  left: $euiNavDrawerWidthCollapsed;
+}
+
+.painlessLab__bottomBar-isNavDrawerLocked {
+  left: $euiNavDrawerWidthExpanded;
+}
diff --git a/x-pack/plugins/painless_lab/public/types.ts b/x-pack/plugins/painless_lab/public/types.ts
new file mode 100644
index 0000000000000..9153f4c28de8d
--- /dev/null
+++ b/x-pack/plugins/painless_lab/public/types.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { HomePublicPluginSetup } from '../../../../src/plugins/home/public';
+import { DevToolsSetup } from '../../../../src/plugins/dev_tools/public';
+import { LicensingPluginSetup } from '../../licensing/public';
+
+export interface PluginDependencies {
+  licensing: LicensingPluginSetup;
+  home: HomePublicPluginSetup;
+  devTools: DevToolsSetup;
+}
diff --git a/x-pack/plugins/painless_lab/server/index.ts b/x-pack/plugins/painless_lab/server/index.ts
new file mode 100644
index 0000000000000..96ea9a163deca
--- /dev/null
+++ b/x-pack/plugins/painless_lab/server/index.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { PluginInitializerContext } from 'kibana/server';
+import { PainlessLabServerPlugin } from './plugin';
+
+export const plugin = (ctx: PluginInitializerContext) => {
+  return new PainlessLabServerPlugin(ctx);
+};
diff --git a/x-pack/plugins/painless_lab/server/lib/index.ts b/x-pack/plugins/painless_lab/server/lib/index.ts
new file mode 100644
index 0000000000000..a9a3c61472d8c
--- /dev/null
+++ b/x-pack/plugins/painless_lab/server/lib/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { isEsError } from './is_es_error';
diff --git a/x-pack/plugins/painless_lab/server/lib/is_es_error.ts b/x-pack/plugins/painless_lab/server/lib/is_es_error.ts
new file mode 100644
index 0000000000000..4137293cf39c0
--- /dev/null
+++ b/x-pack/plugins/painless_lab/server/lib/is_es_error.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as legacyElasticsearch from 'elasticsearch';
+
+const esErrorsParent = legacyElasticsearch.errors._Abstract;
+
+export function isEsError(err: Error) {
+  return err instanceof esErrorsParent;
+}
diff --git a/x-pack/plugins/painless_lab/server/plugin.ts b/x-pack/plugins/painless_lab/server/plugin.ts
new file mode 100644
index 0000000000000..74629a0b035ed
--- /dev/null
+++ b/x-pack/plugins/painless_lab/server/plugin.ts
@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { i18n } from '@kbn/i18n';
+import { CoreSetup, Logger, Plugin, PluginInitializerContext } from 'kibana/server';
+
+import { PLUGIN } from '../common/constants';
+import { License } from './services';
+import { Dependencies } from './types';
+import { registerExecuteRoute } from './routes/api';
+
+export class PainlessLabServerPlugin implements Plugin {
+  private readonly license: License;
+  private readonly logger: Logger;
+
+  constructor({ logger }: PluginInitializerContext) {
+    this.logger = logger.get();
+    this.license = new License();
+  }
+
+  async setup({ http }: CoreSetup, { licensing }: Dependencies) {
+    const router = http.createRouter();
+
+    this.license.setup(
+      {
+        pluginId: PLUGIN.id,
+        minimumLicenseType: PLUGIN.minimumLicenseType,
+        defaultErrorMessage: i18n.translate('xpack.painlessLab.licenseCheckErrorMessage', {
+          defaultMessage: 'License check failed',
+        }),
+      },
+      {
+        licensing,
+        logger: this.logger,
+      }
+    );
+
+    registerExecuteRoute({ router, license: this.license });
+  }
+
+  start() {}
+
+  stop() {}
+}
diff --git a/x-pack/plugins/painless_lab/server/routes/api/execute.ts b/x-pack/plugins/painless_lab/server/routes/api/execute.ts
new file mode 100644
index 0000000000000..55adb5e0410cc
--- /dev/null
+++ b/x-pack/plugins/painless_lab/server/routes/api/execute.ts
@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { schema } from '@kbn/config-schema';
+
+import { API_BASE_PATH } from '../../../common/constants';
+import { RouteDependencies } from '../../types';
+import { isEsError } from '../../lib';
+
+const bodySchema = schema.string();
+
+export function registerExecuteRoute({ router, license }: RouteDependencies) {
+  router.post(
+    {
+      path: `${API_BASE_PATH}/execute`,
+      validate: {
+        body: bodySchema,
+      },
+    },
+    license.guardApiRoute(async (ctx, req, res) => {
+      const body = req.body;
+
+      try {
+        const callAsCurrentUser = ctx.core.elasticsearch.dataClient.callAsCurrentUser;
+        const response = await callAsCurrentUser('scriptsPainlessExecute', {
+          body,
+        });
+
+        return res.ok({
+          body: response,
+        });
+      } catch (e) {
+        if (isEsError(e)) {
+          // Assume invalid painless script was submitted
+          // Return 200 with error object
+          return res.ok({
+            body: e.body,
+          });
+        }
+        return res.internalError({ body: e });
+      }
+    })
+  );
+}
diff --git a/x-pack/plugins/painless_lab/server/routes/api/index.ts b/x-pack/plugins/painless_lab/server/routes/api/index.ts
new file mode 100644
index 0000000000000..62f05971d59cc
--- /dev/null
+++ b/x-pack/plugins/painless_lab/server/routes/api/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { registerExecuteRoute } from './execute';
diff --git a/x-pack/plugins/painless_lab/server/services/index.ts b/x-pack/plugins/painless_lab/server/services/index.ts
new file mode 100644
index 0000000000000..b7a45e59549eb
--- /dev/null
+++ b/x-pack/plugins/painless_lab/server/services/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { License } from './license';
diff --git a/x-pack/plugins/painless_lab/server/services/license.ts b/x-pack/plugins/painless_lab/server/services/license.ts
new file mode 100644
index 0000000000000..1c9d77198f928
--- /dev/null
+++ b/x-pack/plugins/painless_lab/server/services/license.ts
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { Logger } from 'src/core/server';
+import {
+  KibanaRequest,
+  KibanaResponseFactory,
+  RequestHandler,
+  RequestHandlerContext,
+} from 'kibana/server';
+
+import { LicensingPluginSetup } from '../../../licensing/server';
+import { LicenseType, LICENSE_CHECK_STATE } from '../../../licensing/common/types';
+
+export interface LicenseStatus {
+  isValid: boolean;
+  message?: string;
+}
+
+interface SetupSettings {
+  pluginId: string;
+  minimumLicenseType: LicenseType;
+  defaultErrorMessage: string;
+}
+
+export class License {
+  private licenseStatus: LicenseStatus = {
+    isValid: false,
+    message: 'Invalid License',
+  };
+
+  setup(
+    { pluginId, minimumLicenseType, defaultErrorMessage }: SetupSettings,
+    { licensing, logger }: { licensing: LicensingPluginSetup; logger: Logger }
+  ) {
+    licensing.license$.subscribe(license => {
+      const { state, message } = license.check(pluginId, minimumLicenseType);
+      const hasRequiredLicense = state === LICENSE_CHECK_STATE.Valid;
+
+      if (hasRequiredLicense) {
+        this.licenseStatus = { isValid: true };
+      } else {
+        this.licenseStatus = {
+          isValid: false,
+          message: message || defaultErrorMessage,
+        };
+        if (message) {
+          logger.info(message);
+        }
+      }
+    });
+  }
+
+  guardApiRoute<P, Q, B>(handler: RequestHandler<P, Q, B>) {
+    const license = this;
+
+    return function licenseCheck(
+      ctx: RequestHandlerContext,
+      request: KibanaRequest<P, Q, B>,
+      response: KibanaResponseFactory
+    ) {
+      const licenseStatus = license.getStatus();
+
+      if (!licenseStatus.isValid) {
+        return response.customError({
+          body: {
+            message: licenseStatus.message || '',
+          },
+          statusCode: 403,
+        });
+      }
+
+      return handler(ctx, request, response);
+    };
+  }
+
+  getStatus() {
+    return this.licenseStatus;
+  }
+}
diff --git a/x-pack/plugins/painless_lab/server/types.ts b/x-pack/plugins/painless_lab/server/types.ts
new file mode 100644
index 0000000000000..541a31dd175ec
--- /dev/null
+++ b/x-pack/plugins/painless_lab/server/types.ts
@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { IRouter } from 'src/core/server';
+import { LicensingPluginSetup } from '../../licensing/server';
+import { License } from './services';
+
+export interface RouteDependencies {
+  router: IRouter;
+  license: License;
+}
+
+export interface Dependencies {
+  licensing: LicensingPluginSetup;
+}
diff --git a/x-pack/plugins/security/common/licensing/license_features.ts b/x-pack/plugins/security/common/licensing/license_features.ts
index bef328f54de03..5184ab0e962bd 100644
--- a/x-pack/plugins/security/common/licensing/license_features.ts
+++ b/x-pack/plugins/security/common/licensing/license_features.ts
@@ -48,6 +48,11 @@ export interface SecurityLicenseFeatures {
    */
   readonly allowRbac: boolean;
 
+  /**
+   * Indicates whether we allow sub-feature privileges.
+   */
+  readonly allowSubFeaturePrivileges: boolean;
+
   /**
    * Describes the layout of the login form if it's displayed.
    */
diff --git a/x-pack/plugins/security/common/licensing/license_service.test.ts b/x-pack/plugins/security/common/licensing/license_service.test.ts
index 40e8901970af8..dfc94042ef930 100644
--- a/x-pack/plugins/security/common/licensing/license_service.test.ts
+++ b/x-pack/plugins/security/common/licensing/license_service.test.ts
@@ -22,6 +22,7 @@ describe('license features', function() {
       allowRoleFieldLevelSecurity: false,
       layout: 'error-es-unavailable',
       allowRbac: false,
+      allowSubFeaturePrivileges: false,
     });
   });
 
@@ -40,6 +41,7 @@ describe('license features', function() {
       allowRoleFieldLevelSecurity: false,
       layout: 'error-xpack-unavailable',
       allowRbac: false,
+      allowSubFeaturePrivileges: false,
     });
   });
 
@@ -62,6 +64,7 @@ describe('license features', function() {
             "allowRbac": false,
             "allowRoleDocumentLevelSecurity": false,
             "allowRoleFieldLevelSecurity": false,
+            "allowSubFeaturePrivileges": false,
             "layout": "error-xpack-unavailable",
             "showLinks": false,
             "showLogin": true,
@@ -79,6 +82,7 @@ describe('license features', function() {
             "allowRbac": false,
             "allowRoleDocumentLevelSecurity": false,
             "allowRoleFieldLevelSecurity": false,
+            "allowSubFeaturePrivileges": false,
             "showLinks": false,
             "showLogin": false,
             "showRoleMappingsManagement": false,
@@ -90,7 +94,7 @@ describe('license features', function() {
     }
   });
 
-  it('should show login page and other security elements, allow RBAC but forbid role mappings and document level security if license is basic.', () => {
+  it('should show login page and other security elements, allow RBAC but forbid role mappings, DLS, and sub-feature privileges if license is basic.', () => {
     const mockRawLicense = licensingMock.createLicense({
       features: { security: { isEnabled: true, isAvailable: true } },
     });
@@ -108,6 +112,7 @@ describe('license features', function() {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRbac: true,
+      allowSubFeaturePrivileges: false,
     });
     expect(getFeatureSpy).toHaveBeenCalledTimes(1);
     expect(getFeatureSpy).toHaveBeenCalledWith('security');
@@ -129,10 +134,11 @@ describe('license features', function() {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRbac: false,
+      allowSubFeaturePrivileges: false,
     });
   });
 
-  it('should allow role mappings, but not DLS/FLS if license = gold', () => {
+  it('should allow role mappings and sub-feature privileges, but not DLS/FLS if license = gold', () => {
     const mockRawLicense = licensingMock.createLicense({
       license: { mode: 'gold', type: 'gold' },
       features: { security: { isEnabled: true, isAvailable: true } },
@@ -149,10 +155,11 @@ describe('license features', function() {
       allowRoleDocumentLevelSecurity: false,
       allowRoleFieldLevelSecurity: false,
       allowRbac: true,
+      allowSubFeaturePrivileges: true,
     });
   });
 
-  it('should allow to login, allow RBAC, allow role mappings, and document level security if license >= platinum', () => {
+  it('should allow to login, allow RBAC, role mappings, sub-feature privileges, and DLS if license >= platinum', () => {
     const mockRawLicense = licensingMock.createLicense({
       license: { mode: 'platinum', type: 'platinum' },
       features: { security: { isEnabled: true, isAvailable: true } },
@@ -169,6 +176,7 @@ describe('license features', function() {
       allowRoleDocumentLevelSecurity: true,
       allowRoleFieldLevelSecurity: true,
       allowRbac: true,
+      allowSubFeaturePrivileges: true,
     });
   });
 });
diff --git a/x-pack/plugins/security/common/licensing/license_service.ts b/x-pack/plugins/security/common/licensing/license_service.ts
index 2c2039c5e2e92..34bc44b88e40d 100644
--- a/x-pack/plugins/security/common/licensing/license_service.ts
+++ b/x-pack/plugins/security/common/licensing/license_service.ts
@@ -74,6 +74,7 @@ export class SecurityLicenseService {
         allowRoleDocumentLevelSecurity: false,
         allowRoleFieldLevelSecurity: false,
         allowRbac: false,
+        allowSubFeaturePrivileges: false,
         layout:
           rawLicense !== undefined && !rawLicense?.isAvailable
             ? 'error-xpack-unavailable'
@@ -90,16 +91,18 @@ export class SecurityLicenseService {
         allowRoleDocumentLevelSecurity: false,
         allowRoleFieldLevelSecurity: false,
         allowRbac: false,
+        allowSubFeaturePrivileges: false,
       };
     }
 
-    const showRoleMappingsManagement = rawLicense.hasAtLeast('gold');
+    const isLicenseGoldOrBetter = rawLicense.hasAtLeast('gold');
     const isLicensePlatinumOrBetter = rawLicense.hasAtLeast('platinum');
     return {
       showLogin: true,
       allowLogin: true,
       showLinks: true,
-      showRoleMappingsManagement,
+      showRoleMappingsManagement: isLicenseGoldOrBetter,
+      allowSubFeaturePrivileges: isLicenseGoldOrBetter,
       // Only platinum and trial licenses are compliant with field- and document-level security.
       allowRoleDocumentLevelSecurity: isLicensePlatinumOrBetter,
       allowRoleFieldLevelSecurity: isLicensePlatinumOrBetter,
diff --git a/x-pack/plugins/security/common/login_state.ts b/x-pack/plugins/security/common/login_state.ts
new file mode 100644
index 0000000000000..4342e82d2f90b
--- /dev/null
+++ b/x-pack/plugins/security/common/login_state.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { LoginLayout } from './licensing';
+
+export interface LoginSelector {
+  enabled: boolean;
+  providers: Array<{ type: string; name: string; description?: string }>;
+}
+
+export interface LoginState {
+  layout: LoginLayout;
+  allowLogin: boolean;
+  showLoginForm: boolean;
+  requiresSecureConnection: boolean;
+  selector: LoginSelector;
+}
diff --git a/x-pack/plugins/security/common/model/authenticated_user.mock.ts b/x-pack/plugins/security/common/model/authenticated_user.mock.ts
index 220b284e76591..f8b0d27efcbf4 100644
--- a/x-pack/plugins/security/common/model/authenticated_user.mock.ts
+++ b/x-pack/plugins/security/common/model/authenticated_user.mock.ts
@@ -15,7 +15,7 @@ export function mockAuthenticatedUser(user: Partial<AuthenticatedUser> = {}) {
     enabled: true,
     authentication_realm: { name: 'native1', type: 'native' },
     lookup_realm: { name: 'native1', type: 'native' },
-    authentication_provider: 'basic',
+    authentication_provider: 'basic1',
     ...user,
   };
 }
diff --git a/x-pack/plugins/security/common/model/index.ts b/x-pack/plugins/security/common/model/index.ts
index 88da416cf715b..59d4908c67ffb 100644
--- a/x-pack/plugins/security/common/model/index.ts
+++ b/x-pack/plugins/security/common/model/index.ts
@@ -8,8 +8,8 @@ export { ApiKey, ApiKeyToInvalidate } from './api_key';
 export { User, EditUser, getUserDisplayName } from './user';
 export { AuthenticatedUser, canUserChangePassword } from './authenticated_user';
 export { BuiltinESPrivileges } from './builtin_es_privileges';
-export { FeaturesPrivileges } from './features_privileges';
 export { RawKibanaPrivileges, RawKibanaFeaturePrivileges } from './raw_kibana_privileges';
+export { FeaturesPrivileges } from './features_privileges';
 export {
   Role,
   RoleIndexPrivilege,
@@ -22,7 +22,6 @@ export {
   prepareRoleClone,
   getExtendedRoleDeprecationNotice,
 } from './role';
-export { KibanaPrivileges } from './kibana_privileges';
 export {
   InlineRoleTemplate,
   StoredRoleTemplate,
diff --git a/x-pack/plugins/security/common/model/kibana_privileges/feature_privileges.ts b/x-pack/plugins/security/common/model/kibana_privileges/feature_privileges.ts
deleted file mode 100644
index fd4cdf33028eb..0000000000000
--- a/x-pack/plugins/security/common/model/kibana_privileges/feature_privileges.ts
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { FeaturesPrivileges } from '../features_privileges';
-import { RawKibanaFeaturePrivileges } from '../raw_kibana_privileges';
-
-export class KibanaFeaturePrivileges {
-  constructor(private readonly featurePrivilegesMap: RawKibanaFeaturePrivileges) {}
-
-  public getAllPrivileges(): FeaturesPrivileges {
-    return Object.entries(this.featurePrivilegesMap).reduce((acc, [featureId, privileges]) => {
-      return {
-        ...acc,
-        [featureId]: Object.keys(privileges),
-      };
-    }, {});
-  }
-
-  public getPrivileges(featureId: string): string[] {
-    const featurePrivileges = this.featurePrivilegesMap[featureId];
-    if (featurePrivileges == null) {
-      return [];
-    }
-
-    return Object.keys(featurePrivileges);
-  }
-
-  public getActions(featureId: string, privilege: string): string[] {
-    if (!this.featurePrivilegesMap[featureId]) {
-      return [];
-    }
-    return this.featurePrivilegesMap[featureId][privilege] || [];
-  }
-}
diff --git a/x-pack/plugins/security/common/model/kibana_privileges/global_privileges.ts b/x-pack/plugins/security/common/model/kibana_privileges/global_privileges.ts
deleted file mode 100644
index ffe55b813217f..0000000000000
--- a/x-pack/plugins/security/common/model/kibana_privileges/global_privileges.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export class KibanaGlobalPrivileges {
-  constructor(private readonly globalPrivilegesMap: Record<string, string[]>) {}
-
-  public getAllPrivileges(): string[] {
-    return Object.keys(this.globalPrivilegesMap);
-  }
-
-  public getActions(privilege: string): string[] {
-    return this.globalPrivilegesMap[privilege] || [];
-  }
-}
diff --git a/x-pack/plugins/security/common/model/kibana_privileges/kibana_privileges.ts b/x-pack/plugins/security/common/model/kibana_privileges/kibana_privileges.ts
deleted file mode 100644
index 61e5f083a7798..0000000000000
--- a/x-pack/plugins/security/common/model/kibana_privileges/kibana_privileges.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { RawKibanaPrivileges } from '../raw_kibana_privileges';
-import { KibanaFeaturePrivileges } from './feature_privileges';
-import { KibanaGlobalPrivileges } from './global_privileges';
-import { KibanaSpacesPrivileges } from './spaces_privileges';
-
-export class KibanaPrivileges {
-  constructor(private readonly rawKibanaPrivileges: RawKibanaPrivileges) {}
-
-  public getGlobalPrivileges() {
-    return new KibanaGlobalPrivileges(this.rawKibanaPrivileges.global);
-  }
-
-  public getSpacesPrivileges() {
-    return new KibanaSpacesPrivileges(this.rawKibanaPrivileges.space);
-  }
-
-  public getFeaturePrivileges() {
-    return new KibanaFeaturePrivileges(this.rawKibanaPrivileges.features);
-  }
-}
diff --git a/x-pack/plugins/security/common/model/kibana_privileges/spaces_privileges.ts b/x-pack/plugins/security/common/model/kibana_privileges/spaces_privileges.ts
deleted file mode 100644
index 5c8b4196a2b55..0000000000000
--- a/x-pack/plugins/security/common/model/kibana_privileges/spaces_privileges.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export class KibanaSpacesPrivileges {
-  constructor(private readonly spacesPrivilegesMap: Record<string, string[]>) {}
-
-  public getAllPrivileges(): string[] {
-    return Object.keys(this.spacesPrivilegesMap);
-  }
-
-  public getActions(privilege: string): string[] {
-    return this.spacesPrivilegesMap[privilege] || [];
-  }
-}
diff --git a/x-pack/plugins/security/common/parse_next.test.ts b/x-pack/plugins/security/common/parse_next.test.ts
index b5e6c7dca41d8..11a843d397ded 100644
--- a/x-pack/plugins/security/common/parse_next.test.ts
+++ b/x-pack/plugins/security/common/parse_next.test.ts
@@ -34,6 +34,15 @@ describe('parseNext', () => {
       expect(parseNext(href, basePath)).toEqual(`${next}#${hash}`);
     });
 
+    it('should properly handle multiple next with hash', () => {
+      const basePath = '/iqf';
+      const next1 = `${basePath}/app/kibana`;
+      const next2 = `${basePath}/app/ml`;
+      const hash = '/discover/New-Saved-Search';
+      const href = `${basePath}/login?next=${next1}&next=${next2}#${hash}`;
+      expect(parseNext(href, basePath)).toEqual(`${next1}#${hash}`);
+    });
+
     it('should properly decode special characters', () => {
       const basePath = '/iqf';
       const next = `${encodeURIComponent(basePath)}%2Fapp%2Fkibana`;
@@ -118,6 +127,14 @@ describe('parseNext', () => {
       expect(parseNext(href)).toEqual(`${next}#${hash}`);
     });
 
+    it('should properly handle multiple next with hash', () => {
+      const next1 = '/app/kibana';
+      const next2 = '/app/ml';
+      const hash = '/discover/New-Saved-Search';
+      const href = `/login?next=${next1}&next=${next2}#${hash}`;
+      expect(parseNext(href)).toEqual(`${next1}#${hash}`);
+    });
+
     it('should properly decode special characters', () => {
       const next = '%2Fapp%2Fkibana';
       const hash = '/discover/New-Saved-Search';
diff --git a/x-pack/plugins/security/common/parse_next.ts b/x-pack/plugins/security/common/parse_next.ts
index 834acd783abbe..7cbe335825a5a 100644
--- a/x-pack/plugins/security/common/parse_next.ts
+++ b/x-pack/plugins/security/common/parse_next.ts
@@ -40,5 +40,5 @@ export function parseNext(href: string, basePath = '') {
     return `${basePath}/`;
   }
 
-  return query.next + (hash || '');
+  return next + (hash || '');
 }
diff --git a/x-pack/plugins/security/public/account_management/account_management_app.ts b/x-pack/plugins/security/public/account_management/account_management_app.ts
index 8a14a772a1eef..cd3ef34858b19 100644
--- a/x-pack/plugins/security/public/account_management/account_management_app.ts
+++ b/x-pack/plugins/security/public/account_management/account_management_app.ts
@@ -5,14 +5,14 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, AppMountParameters } from 'src/core/public';
+import { StartServicesAccessor, ApplicationSetup, AppMountParameters } from 'src/core/public';
 import { AuthenticationServiceSetup } from '../authentication';
 import { UserAPIClient } from '../management';
 
 interface CreateDeps {
-  application: CoreSetup['application'];
+  application: ApplicationSetup;
   authc: AuthenticationServiceSetup;
-  getStartServices: CoreSetup['getStartServices'];
+  getStartServices: StartServicesAccessor;
 }
 
 export const accountManagementApp = Object.freeze({
diff --git a/x-pack/plugins/security/public/authentication/authentication_service.ts b/x-pack/plugins/security/public/authentication/authentication_service.ts
index 7b88b0f8573ba..979f7095cf933 100644
--- a/x-pack/plugins/security/public/authentication/authentication_service.ts
+++ b/x-pack/plugins/security/public/authentication/authentication_service.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ApplicationSetup, CoreSetup, HttpSetup } from 'src/core/public';
+import { ApplicationSetup, StartServicesAccessor, HttpSetup } from 'src/core/public';
 import { AuthenticatedUser } from '../../common/model';
 import { ConfigType } from '../config';
 import { PluginStartDependencies } from '../plugin';
@@ -17,7 +17,7 @@ interface SetupParams {
   application: ApplicationSetup;
   config: ConfigType;
   http: HttpSetup;
-  getStartServices: CoreSetup<PluginStartDependencies>['getStartServices'];
+  getStartServices: StartServicesAccessor<PluginStartDependencies>;
 }
 
 export interface AuthenticationServiceSetup {
diff --git a/x-pack/plugins/security/public/authentication/logged_out/logged_out_app.ts b/x-pack/plugins/security/public/authentication/logged_out/logged_out_app.ts
index b7f2615318791..2849111e7efeb 100644
--- a/x-pack/plugins/security/public/authentication/logged_out/logged_out_app.ts
+++ b/x-pack/plugins/security/public/authentication/logged_out/logged_out_app.ts
@@ -5,12 +5,17 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, AppMountParameters, HttpSetup } from 'src/core/public';
+import {
+  StartServicesAccessor,
+  ApplicationSetup,
+  AppMountParameters,
+  HttpSetup,
+} from 'src/core/public';
 
 interface CreateDeps {
-  application: CoreSetup['application'];
+  application: ApplicationSetup;
   http: HttpSetup;
-  getStartServices: CoreSetup['getStartServices'];
+  getStartServices: StartServicesAccessor;
 }
 
 export const loggedOutApp = Object.freeze({
diff --git a/x-pack/plugins/security/public/authentication/login/__snapshots__/login_page.test.tsx.snap b/x-pack/plugins/security/public/authentication/login/__snapshots__/login_page.test.tsx.snap
index 30715be1db232..ecbdfedac1dd3 100644
--- a/x-pack/plugins/security/public/authentication/login/__snapshots__/login_page.test.tsx.snap
+++ b/x-pack/plugins/security/public/authentication/login/__snapshots__/login_page.test.tsx.snap
@@ -23,7 +23,7 @@ exports[`LoginPage disabled form states renders as expected when an unknown logi
 <DisabledLoginForm
   message={
     <FormattedMessage
-      defaultMessage="Refer to the Kibana logs for more details and refresh to try again."
+      defaultMessage="See the Kibana logs for details and try reloading the page."
       id="xpack.security.loginPage.unknownLayoutMessage"
       values={Object {}}
     />
@@ -38,6 +38,25 @@ exports[`LoginPage disabled form states renders as expected when an unknown logi
 />
 `;
 
+exports[`LoginPage disabled form states renders as expected when login is not enabled 1`] = `
+<DisabledLoginForm
+  message={
+    <FormattedMessage
+      defaultMessage="Contact your system administrator."
+      id="xpack.security.loginPage.noLoginMethodsAvailableMessage"
+      values={Object {}}
+    />
+  }
+  title={
+    <FormattedMessage
+      defaultMessage="Login is disabled."
+      id="xpack.security.loginPage.noLoginMethodsAvailableTitle"
+      values={Object {}}
+    />
+  }
+/>
+`;
+
 exports[`LoginPage disabled form states renders as expected when secure connection is required but not present 1`] = `
 <DisabledLoginForm
   message={
@@ -77,7 +96,7 @@ exports[`LoginPage disabled form states renders as expected when xpack is not av
 `;
 
 exports[`LoginPage enabled form state renders as expected 1`] = `
-<BasicLoginForm
+<LoginForm
   http={
     Object {
       "addLoadingCountSource": [MockFunction],
@@ -85,11 +104,32 @@ exports[`LoginPage enabled form state renders as expected 1`] = `
     }
   }
   loginAssistanceMessage=""
+  notifications={
+    Object {
+      "toasts": Object {
+        "add": [MockFunction],
+        "addDanger": [MockFunction],
+        "addError": [MockFunction],
+        "addInfo": [MockFunction],
+        "addSuccess": [MockFunction],
+        "addWarning": [MockFunction],
+        "get$": [MockFunction],
+        "remove": [MockFunction],
+      },
+    }
+  }
+  selector={
+    Object {
+      "enabled": false,
+      "providers": Array [],
+    }
+  }
+  showLoginForm={true}
 />
 `;
 
 exports[`LoginPage enabled form state renders as expected when info message is set 1`] = `
-<BasicLoginForm
+<LoginForm
   http={
     Object {
       "addLoadingCountSource": [MockFunction],
@@ -98,11 +138,32 @@ exports[`LoginPage enabled form state renders as expected when info message is s
   }
   infoMessage="Your session has timed out. Please log in again."
   loginAssistanceMessage=""
+  notifications={
+    Object {
+      "toasts": Object {
+        "add": [MockFunction],
+        "addDanger": [MockFunction],
+        "addError": [MockFunction],
+        "addInfo": [MockFunction],
+        "addSuccess": [MockFunction],
+        "addWarning": [MockFunction],
+        "get$": [MockFunction],
+        "remove": [MockFunction],
+      },
+    }
+  }
+  selector={
+    Object {
+      "enabled": false,
+      "providers": Array [],
+    }
+  }
+  showLoginForm={true}
 />
 `;
 
 exports[`LoginPage enabled form state renders as expected when loginAssistanceMessage is set 1`] = `
-<BasicLoginForm
+<LoginForm
   http={
     Object {
       "addLoadingCountSource": [MockFunction],
@@ -111,6 +172,27 @@ exports[`LoginPage enabled form state renders as expected when loginAssistanceMe
   }
   infoMessage="Your session has timed out. Please log in again."
   loginAssistanceMessage="This is an *important* message"
+  notifications={
+    Object {
+      "toasts": Object {
+        "add": [MockFunction],
+        "addDanger": [MockFunction],
+        "addError": [MockFunction],
+        "addInfo": [MockFunction],
+        "addSuccess": [MockFunction],
+        "addWarning": [MockFunction],
+        "get$": [MockFunction],
+        "remove": [MockFunction],
+      },
+    }
+  }
+  selector={
+    Object {
+      "enabled": false,
+      "providers": Array [],
+    }
+  }
+  showLoginForm={true}
 />
 `;
 
@@ -172,7 +254,7 @@ exports[`LoginPage page renders as expected 1`] = `
       gutterSize="l"
     >
       <EuiFlexItem>
-        <BasicLoginForm
+        <LoginForm
           http={
             Object {
               "addLoadingCountSource": [MockFunction],
@@ -180,6 +262,27 @@ exports[`LoginPage page renders as expected 1`] = `
             }
           }
           loginAssistanceMessage=""
+          notifications={
+            Object {
+              "toasts": Object {
+                "add": [MockFunction],
+                "addDanger": [MockFunction],
+                "addError": [MockFunction],
+                "addInfo": [MockFunction],
+                "addSuccess": [MockFunction],
+                "addWarning": [MockFunction],
+                "get$": [MockFunction],
+                "remove": [MockFunction],
+              },
+            }
+          }
+          selector={
+            Object {
+              "enabled": false,
+              "providers": Array [],
+            }
+          }
+          showLoginForm={true}
         />
       </EuiFlexItem>
     </EuiFlexGroup>
diff --git a/x-pack/plugins/security/public/authentication/login/components/basic_login_form/__snapshots__/basic_login_form.test.tsx.snap b/x-pack/plugins/security/public/authentication/login/components/basic_login_form/__snapshots__/basic_login_form.test.tsx.snap
deleted file mode 100644
index b09f398ed5ed9..0000000000000
--- a/x-pack/plugins/security/public/authentication/login/components/basic_login_form/__snapshots__/basic_login_form.test.tsx.snap
+++ /dev/null
@@ -1,95 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`BasicLoginForm renders as expected 1`] = `
-<Fragment>
-  <EuiText
-    size="s"
-  >
-    <ReactMarkdown
-      astPlugins={Array []}
-      escapeHtml={true}
-      plugins={Array []}
-      rawSourcePos={false}
-      renderers={Object {}}
-      skipHtml={false}
-      sourcePos={false}
-      transformLinkUri={[Function]}
-    />
-  </EuiText>
-  <EuiPanel>
-    <form
-      onSubmit={[Function]}
-    >
-      <EuiFormRow
-        describedByIds={Array []}
-        display="row"
-        fullWidth={false}
-        hasChildLabel={true}
-        hasEmptyLabelSpace={false}
-        label={
-          <FormattedMessage
-            defaultMessage="Username"
-            id="xpack.security.login.basicLoginForm.usernameFormRowLabel"
-            values={Object {}}
-          />
-        }
-        labelType="label"
-      >
-        <EuiFieldText
-          aria-required={true}
-          data-test-subj="loginUsername"
-          disabled={false}
-          id="username"
-          inputRef={[Function]}
-          isInvalid={false}
-          name="username"
-          onChange={[Function]}
-          value=""
-        />
-      </EuiFormRow>
-      <EuiFormRow
-        describedByIds={Array []}
-        display="row"
-        fullWidth={false}
-        hasChildLabel={true}
-        hasEmptyLabelSpace={false}
-        label={
-          <FormattedMessage
-            defaultMessage="Password"
-            id="xpack.security.login.basicLoginForm.passwordFormRowLabel"
-            values={Object {}}
-          />
-        }
-        labelType="label"
-      >
-        <EuiFieldText
-          aria-required={true}
-          autoComplete="off"
-          data-test-subj="loginPassword"
-          disabled={false}
-          id="password"
-          isInvalid={false}
-          name="password"
-          onChange={[Function]}
-          type="password"
-          value=""
-        />
-      </EuiFormRow>
-      <EuiButton
-        color="primary"
-        data-test-subj="loginSubmit"
-        fill={true}
-        isLoading={false}
-        onClick={[Function]}
-        type="submit"
-      >
-        <FormattedMessage
-          defaultMessage="Log in"
-          id="xpack.security.login.basicLoginForm.logInButtonLabel"
-          values={Object {}}
-        />
-      </EuiButton>
-    </form>
-  </EuiPanel>
-</Fragment>
-`;
diff --git a/x-pack/plugins/security/public/authentication/login/components/basic_login_form/basic_login_form.test.tsx b/x-pack/plugins/security/public/authentication/login/components/basic_login_form/basic_login_form.test.tsx
deleted file mode 100644
index e62fd7191dfae..0000000000000
--- a/x-pack/plugins/security/public/authentication/login/components/basic_login_form/basic_login_form.test.tsx
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React from 'react';
-import { act } from '@testing-library/react';
-import { EuiButton, EuiCallOut } from '@elastic/eui';
-import { mountWithIntl, nextTick, shallowWithIntl } from 'test_utils/enzyme_helpers';
-import { BasicLoginForm } from './basic_login_form';
-
-import { coreMock } from '../../../../../../../../src/core/public/mocks';
-
-describe('BasicLoginForm', () => {
-  beforeAll(() => {
-    Object.defineProperty(window, 'location', {
-      value: { href: 'https://some-host/bar' },
-      writable: true,
-    });
-  });
-
-  afterAll(() => {
-    delete (window as any).location;
-  });
-
-  it('renders as expected', () => {
-    expect(
-      shallowWithIntl(
-        <BasicLoginForm http={coreMock.createStart().http} loginAssistanceMessage="" />
-      )
-    ).toMatchSnapshot();
-  });
-
-  it('renders an info message when provided.', () => {
-    const wrapper = shallowWithIntl(
-      <BasicLoginForm
-        http={coreMock.createStart().http}
-        infoMessage={'Hey this is an info message'}
-        loginAssistanceMessage=""
-      />
-    );
-
-    expect(wrapper.find(EuiCallOut).props().title).toEqual('Hey this is an info message');
-  });
-
-  it('renders an invalid credentials message', async () => {
-    const mockHTTP = coreMock.createStart({ basePath: '/some-base-path' }).http;
-    mockHTTP.post.mockRejectedValue({ response: { status: 401 } });
-
-    const wrapper = mountWithIntl(<BasicLoginForm http={mockHTTP} loginAssistanceMessage="" />);
-
-    wrapper.find('input[name="username"]').simulate('change', { target: { value: 'username' } });
-    wrapper.find('input[name="password"]').simulate('change', { target: { value: 'password' } });
-    wrapper.find(EuiButton).simulate('click');
-
-    await act(async () => {
-      await nextTick();
-      wrapper.update();
-    });
-
-    expect(wrapper.find(EuiCallOut).props().title).toEqual(
-      `Invalid username or password. Please try again.`
-    );
-  });
-
-  it('renders unknown error message', async () => {
-    const mockHTTP = coreMock.createStart({ basePath: '/some-base-path' }).http;
-    mockHTTP.post.mockRejectedValue({ response: { status: 500 } });
-
-    const wrapper = mountWithIntl(<BasicLoginForm http={mockHTTP} loginAssistanceMessage="" />);
-
-    wrapper.find('input[name="username"]').simulate('change', { target: { value: 'username' } });
-    wrapper.find('input[name="password"]').simulate('change', { target: { value: 'password' } });
-    wrapper.find(EuiButton).simulate('click');
-
-    await act(async () => {
-      await nextTick();
-      wrapper.update();
-    });
-
-    expect(wrapper.find(EuiCallOut).props().title).toEqual(`Oops! Error. Try again.`);
-  });
-
-  it('properly redirects after successful login', async () => {
-    window.location.href = `https://some-host/login?next=${encodeURIComponent(
-      '/some-base-path/app/kibana#/home?_g=()'
-    )}`;
-    const mockHTTP = coreMock.createStart({ basePath: '/some-base-path' }).http;
-    mockHTTP.post.mockResolvedValue({});
-
-    const wrapper = mountWithIntl(<BasicLoginForm http={mockHTTP} loginAssistanceMessage="" />);
-
-    wrapper.find('input[name="username"]').simulate('change', { target: { value: 'username1' } });
-    wrapper.find('input[name="password"]').simulate('change', { target: { value: 'password1' } });
-    wrapper.find(EuiButton).simulate('click');
-
-    await act(async () => {
-      await nextTick();
-      wrapper.update();
-    });
-
-    expect(mockHTTP.post).toHaveBeenCalledTimes(1);
-    expect(mockHTTP.post).toHaveBeenCalledWith('/internal/security/login', {
-      body: JSON.stringify({ username: 'username1', password: 'password1' }),
-    });
-
-    expect(window.location.href).toBe('/some-base-path/app/kibana#/home?_g=()');
-    expect(wrapper.find(EuiCallOut).exists()).toBe(false);
-  });
-});
diff --git a/x-pack/plugins/security/public/authentication/login/components/basic_login_form/basic_login_form.tsx b/x-pack/plugins/security/public/authentication/login/components/basic_login_form/basic_login_form.tsx
deleted file mode 100644
index 7302ee9bf9851..0000000000000
--- a/x-pack/plugins/security/public/authentication/login/components/basic_login_form/basic_login_form.tsx
+++ /dev/null
@@ -1,219 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import React, { ChangeEvent, Component, FormEvent, Fragment, MouseEvent } from 'react';
-import ReactMarkdown from 'react-markdown';
-import {
-  EuiButton,
-  EuiCallOut,
-  EuiFieldText,
-  EuiFormRow,
-  EuiPanel,
-  EuiSpacer,
-  EuiText,
-} from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
-import { FormattedMessage } from '@kbn/i18n/react';
-import { HttpStart, IHttpFetchError } from 'src/core/public';
-import { parseNext } from '../../../../../common/parse_next';
-
-interface Props {
-  http: HttpStart;
-  infoMessage?: string;
-  loginAssistanceMessage: string;
-}
-
-interface State {
-  hasError: boolean;
-  isLoading: boolean;
-  username: string;
-  password: string;
-  message: string;
-}
-
-export class BasicLoginForm extends Component<Props, State> {
-  public state = {
-    hasError: false,
-    isLoading: false,
-    username: '',
-    password: '',
-    message: '',
-  };
-
-  public render() {
-    return (
-      <Fragment>
-        {this.renderLoginAssistanceMessage()}
-        {this.renderMessage()}
-        <EuiPanel>
-          <form onSubmit={this.submit}>
-            <EuiFormRow
-              label={
-                <FormattedMessage
-                  id="xpack.security.login.basicLoginForm.usernameFormRowLabel"
-                  defaultMessage="Username"
-                />
-              }
-            >
-              <EuiFieldText
-                id="username"
-                name="username"
-                data-test-subj="loginUsername"
-                value={this.state.username}
-                onChange={this.onUsernameChange}
-                disabled={this.state.isLoading}
-                isInvalid={false}
-                aria-required={true}
-                inputRef={this.setUsernameInputRef}
-              />
-            </EuiFormRow>
-
-            <EuiFormRow
-              label={
-                <FormattedMessage
-                  id="xpack.security.login.basicLoginForm.passwordFormRowLabel"
-                  defaultMessage="Password"
-                />
-              }
-            >
-              <EuiFieldText
-                autoComplete="off"
-                id="password"
-                name="password"
-                data-test-subj="loginPassword"
-                type="password"
-                value={this.state.password}
-                onChange={this.onPasswordChange}
-                disabled={this.state.isLoading}
-                isInvalid={false}
-                aria-required={true}
-              />
-            </EuiFormRow>
-
-            <EuiButton
-              fill
-              type="submit"
-              color="primary"
-              onClick={this.submit}
-              isLoading={this.state.isLoading}
-              data-test-subj="loginSubmit"
-            >
-              <FormattedMessage
-                id="xpack.security.login.basicLoginForm.logInButtonLabel"
-                defaultMessage="Log in"
-              />
-            </EuiButton>
-          </form>
-        </EuiPanel>
-      </Fragment>
-    );
-  }
-
-  private renderLoginAssistanceMessage = () => {
-    return (
-      <Fragment>
-        <EuiText size="s">
-          <ReactMarkdown>{this.props.loginAssistanceMessage}</ReactMarkdown>
-        </EuiText>
-      </Fragment>
-    );
-  };
-
-  private renderMessage = () => {
-    if (this.state.message) {
-      return (
-        <Fragment>
-          <EuiCallOut
-            size="s"
-            color="danger"
-            data-test-subj="loginErrorMessage"
-            title={this.state.message}
-            role="alert"
-          />
-          <EuiSpacer size="l" />
-        </Fragment>
-      );
-    }
-
-    if (this.props.infoMessage) {
-      return (
-        <Fragment>
-          <EuiCallOut
-            size="s"
-            color="primary"
-            data-test-subj="loginInfoMessage"
-            title={this.props.infoMessage}
-            role="status"
-          />
-          <EuiSpacer size="l" />
-        </Fragment>
-      );
-    }
-
-    return null;
-  };
-
-  private setUsernameInputRef(ref: HTMLInputElement) {
-    if (ref) {
-      ref.focus();
-    }
-  }
-
-  private isFormValid = () => {
-    const { username, password } = this.state;
-
-    return username && password;
-  };
-
-  private onUsernameChange = (e: ChangeEvent<HTMLInputElement>) => {
-    this.setState({
-      username: e.target.value,
-    });
-  };
-
-  private onPasswordChange = (e: ChangeEvent<HTMLInputElement>) => {
-    this.setState({
-      password: e.target.value,
-    });
-  };
-
-  private submit = async (e: MouseEvent<HTMLButtonElement> | FormEvent<HTMLFormElement>) => {
-    e.preventDefault();
-
-    if (!this.isFormValid()) {
-      return;
-    }
-
-    this.setState({
-      isLoading: true,
-      message: '',
-    });
-
-    const { http } = this.props;
-    const { username, password } = this.state;
-
-    try {
-      await http.post('/internal/security/login', { body: JSON.stringify({ username, password }) });
-      window.location.href = parseNext(window.location.href, http.basePath.serverBasePath);
-    } catch (error) {
-      const message =
-        (error as IHttpFetchError).response?.status === 401
-          ? i18n.translate(
-              'xpack.security.login.basicLoginForm.invalidUsernameOrPasswordErrorMessage',
-              { defaultMessage: 'Invalid username or password. Please try again.' }
-            )
-          : i18n.translate('xpack.security.login.basicLoginForm.unknownErrorMessage', {
-              defaultMessage: 'Oops! Error. Try again.',
-            });
-
-      this.setState({
-        hasError: true,
-        message,
-        isLoading: false,
-      });
-    }
-  };
-}
diff --git a/x-pack/plugins/security/public/authentication/login/components/index.ts b/x-pack/plugins/security/public/authentication/login/components/index.ts
index 5f267f7c4caa2..3113a177d433e 100644
--- a/x-pack/plugins/security/public/authentication/login/components/index.ts
+++ b/x-pack/plugins/security/public/authentication/login/components/index.ts
@@ -4,5 +4,5 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { BasicLoginForm } from './basic_login_form';
+export { LoginForm } from './login_form';
 export { DisabledLoginForm } from './disabled_login_form';
diff --git a/x-pack/plugins/security/public/authentication/login/components/login_form/__snapshots__/login_form.test.tsx.snap b/x-pack/plugins/security/public/authentication/login/components/login_form/__snapshots__/login_form.test.tsx.snap
new file mode 100644
index 0000000000000..a25498a637c2f
--- /dev/null
+++ b/x-pack/plugins/security/public/authentication/login/components/login_form/__snapshots__/login_form.test.tsx.snap
@@ -0,0 +1,240 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`LoginForm login selector renders as expected with login form 1`] = `
+<Fragment>
+  <EuiButton
+    fullWidth={true}
+    isDisabled={false}
+    isLoading={false}
+    key="saml1"
+    onClick={[Function]}
+  >
+    Login w/SAML
+  </EuiButton>
+  <EuiSpacer
+    size="m"
+  />
+  <EuiButton
+    fullWidth={true}
+    isDisabled={false}
+    isLoading={false}
+    key="pki1"
+    onClick={[Function]}
+  >
+    Login w/PKI
+  </EuiButton>
+  <EuiSpacer
+    size="m"
+  />
+  <EuiText
+    color="subdued"
+    textAlign="center"
+  >
+    ―――  
+    <FormattedMessage
+      defaultMessage="OR"
+      id="xpack.security.loginPage.loginSelectorOR"
+      values={Object {}}
+    />
+      ―――
+  </EuiText>
+  <EuiSpacer
+    size="m"
+  />
+  <EuiPanel>
+    <form
+      onSubmit={[Function]}
+    >
+      <EuiFormRow
+        describedByIds={Array []}
+        display="row"
+        fullWidth={false}
+        hasChildLabel={true}
+        hasEmptyLabelSpace={false}
+        label={
+          <FormattedMessage
+            defaultMessage="Username"
+            id="xpack.security.login.basicLoginForm.usernameFormRowLabel"
+            values={Object {}}
+          />
+        }
+        labelType="label"
+      >
+        <EuiFieldText
+          aria-required={true}
+          data-test-subj="loginUsername"
+          disabled={false}
+          id="username"
+          inputRef={[Function]}
+          isInvalid={false}
+          name="username"
+          onChange={[Function]}
+          value=""
+        />
+      </EuiFormRow>
+      <EuiFormRow
+        describedByIds={Array []}
+        display="row"
+        fullWidth={false}
+        hasChildLabel={true}
+        hasEmptyLabelSpace={false}
+        label={
+          <FormattedMessage
+            defaultMessage="Password"
+            id="xpack.security.login.basicLoginForm.passwordFormRowLabel"
+            values={Object {}}
+          />
+        }
+        labelType="label"
+      >
+        <EuiFieldText
+          aria-required={true}
+          autoComplete="off"
+          data-test-subj="loginPassword"
+          disabled={false}
+          id="password"
+          isInvalid={false}
+          name="password"
+          onChange={[Function]}
+          type="password"
+          value=""
+        />
+      </EuiFormRow>
+      <EuiButton
+        color="primary"
+        data-test-subj="loginSubmit"
+        fill={true}
+        isDisabled={false}
+        isLoading={false}
+        onClick={[Function]}
+        type="submit"
+      >
+        <FormattedMessage
+          defaultMessage="Log in"
+          id="xpack.security.login.basicLoginForm.logInButtonLabel"
+          values={Object {}}
+        />
+      </EuiButton>
+    </form>
+  </EuiPanel>
+</Fragment>
+`;
+
+exports[`LoginForm login selector renders as expected without login form for providers with and without description 1`] = `
+<Fragment>
+  <EuiButton
+    fullWidth={true}
+    isDisabled={false}
+    isLoading={false}
+    key="saml1"
+    onClick={[Function]}
+  >
+    Login w/SAML
+  </EuiButton>
+  <EuiSpacer
+    size="m"
+  />
+  <EuiButton
+    fullWidth={true}
+    isDisabled={false}
+    isLoading={false}
+    key="pki1"
+    onClick={[Function]}
+  >
+    <FormattedMessage
+      defaultMessage="Login with {providerType}/{providerName}"
+      id="xpack.security.loginPage.loginProviderDescription"
+      values={
+        Object {
+          "providerName": "pki1",
+          "providerType": "pki",
+        }
+      }
+    />
+  </EuiButton>
+  <EuiSpacer
+    size="m"
+  />
+</Fragment>
+`;
+
+exports[`LoginForm renders as expected 1`] = `
+<Fragment>
+  <EuiPanel>
+    <form
+      onSubmit={[Function]}
+    >
+      <EuiFormRow
+        describedByIds={Array []}
+        display="row"
+        fullWidth={false}
+        hasChildLabel={true}
+        hasEmptyLabelSpace={false}
+        label={
+          <FormattedMessage
+            defaultMessage="Username"
+            id="xpack.security.login.basicLoginForm.usernameFormRowLabel"
+            values={Object {}}
+          />
+        }
+        labelType="label"
+      >
+        <EuiFieldText
+          aria-required={true}
+          data-test-subj="loginUsername"
+          disabled={false}
+          id="username"
+          inputRef={[Function]}
+          isInvalid={false}
+          name="username"
+          onChange={[Function]}
+          value=""
+        />
+      </EuiFormRow>
+      <EuiFormRow
+        describedByIds={Array []}
+        display="row"
+        fullWidth={false}
+        hasChildLabel={true}
+        hasEmptyLabelSpace={false}
+        label={
+          <FormattedMessage
+            defaultMessage="Password"
+            id="xpack.security.login.basicLoginForm.passwordFormRowLabel"
+            values={Object {}}
+          />
+        }
+        labelType="label"
+      >
+        <EuiFieldText
+          aria-required={true}
+          autoComplete="off"
+          data-test-subj="loginPassword"
+          disabled={false}
+          id="password"
+          isInvalid={false}
+          name="password"
+          onChange={[Function]}
+          type="password"
+          value=""
+        />
+      </EuiFormRow>
+      <EuiButton
+        color="primary"
+        data-test-subj="loginSubmit"
+        fill={true}
+        isDisabled={false}
+        isLoading={false}
+        onClick={[Function]}
+        type="submit"
+      >
+        <FormattedMessage
+          defaultMessage="Log in"
+          id="xpack.security.login.basicLoginForm.logInButtonLabel"
+          values={Object {}}
+        />
+      </EuiButton>
+    </form>
+  </EuiPanel>
+</Fragment>
+`;
diff --git a/x-pack/plugins/security/public/authentication/login/components/login_form/index.ts b/x-pack/plugins/security/public/authentication/login/components/login_form/index.ts
new file mode 100644
index 0000000000000..c09a8dad4945c
--- /dev/null
+++ b/x-pack/plugins/security/public/authentication/login/components/login_form/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { LoginForm } from './login_form';
diff --git a/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.test.tsx b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.test.tsx
new file mode 100644
index 0000000000000..c17c10a2c5148
--- /dev/null
+++ b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.test.tsx
@@ -0,0 +1,272 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { act } from '@testing-library/react';
+import { EuiButton, EuiCallOut } from '@elastic/eui';
+import { mountWithIntl, nextTick, shallowWithIntl } from 'test_utils/enzyme_helpers';
+import { LoginForm } from './login_form';
+
+import { coreMock } from '../../../../../../../../src/core/public/mocks';
+
+describe('LoginForm', () => {
+  beforeAll(() => {
+    Object.defineProperty(window, 'location', {
+      value: { href: 'https://some-host/bar' },
+      writable: true,
+    });
+  });
+
+  afterAll(() => {
+    delete (window as any).location;
+  });
+
+  it('renders as expected', () => {
+    const coreStartMock = coreMock.createStart();
+    expect(
+      shallowWithIntl(
+        <LoginForm
+          http={coreStartMock.http}
+          notifications={coreStartMock.notifications}
+          loginAssistanceMessage=""
+          showLoginForm={true}
+          selector={{ enabled: false, providers: [] }}
+        />
+      )
+    ).toMatchSnapshot();
+  });
+
+  it('renders an info message when provided.', () => {
+    const coreStartMock = coreMock.createStart();
+    const wrapper = shallowWithIntl(
+      <LoginForm
+        http={coreStartMock.http}
+        notifications={coreStartMock.notifications}
+        infoMessage={'Hey this is an info message'}
+        loginAssistanceMessage=""
+        showLoginForm={true}
+        selector={{ enabled: false, providers: [] }}
+      />
+    );
+
+    expect(wrapper.find(EuiCallOut).props().title).toEqual('Hey this is an info message');
+  });
+
+  it('renders an invalid credentials message', async () => {
+    const coreStartMock = coreMock.createStart({ basePath: '/some-base-path' });
+    coreStartMock.http.post.mockRejectedValue({ response: { status: 401 } });
+
+    const wrapper = mountWithIntl(
+      <LoginForm
+        http={coreStartMock.http}
+        notifications={coreStartMock.notifications}
+        loginAssistanceMessage=""
+        showLoginForm={true}
+        selector={{ enabled: false, providers: [] }}
+      />
+    );
+
+    wrapper.find('input[name="username"]').simulate('change', { target: { value: 'username' } });
+    wrapper.find('input[name="password"]').simulate('change', { target: { value: 'password' } });
+    wrapper.find(EuiButton).simulate('click');
+
+    await act(async () => {
+      await nextTick();
+      wrapper.update();
+    });
+
+    expect(wrapper.find(EuiCallOut).props().title).toEqual(
+      `Invalid username or password. Please try again.`
+    );
+  });
+
+  it('renders unknown error message', async () => {
+    const coreStartMock = coreMock.createStart({ basePath: '/some-base-path' });
+    coreStartMock.http.post.mockRejectedValue({ response: { status: 500 } });
+
+    const wrapper = mountWithIntl(
+      <LoginForm
+        http={coreStartMock.http}
+        notifications={coreStartMock.notifications}
+        loginAssistanceMessage=""
+        showLoginForm={true}
+        selector={{ enabled: false, providers: [] }}
+      />
+    );
+
+    wrapper.find('input[name="username"]').simulate('change', { target: { value: 'username' } });
+    wrapper.find('input[name="password"]').simulate('change', { target: { value: 'password' } });
+    wrapper.find(EuiButton).simulate('click');
+
+    await act(async () => {
+      await nextTick();
+      wrapper.update();
+    });
+
+    expect(wrapper.find(EuiCallOut).props().title).toEqual(`Oops! Error. Try again.`);
+  });
+
+  it('properly redirects after successful login', async () => {
+    window.location.href = `https://some-host/login?next=${encodeURIComponent(
+      '/some-base-path/app/kibana#/home?_g=()'
+    )}`;
+    const coreStartMock = coreMock.createStart({ basePath: '/some-base-path' });
+    coreStartMock.http.post.mockResolvedValue({});
+
+    const wrapper = mountWithIntl(
+      <LoginForm
+        http={coreStartMock.http}
+        notifications={coreStartMock.notifications}
+        loginAssistanceMessage=""
+        showLoginForm={true}
+        selector={{ enabled: false, providers: [] }}
+      />
+    );
+
+    wrapper.find('input[name="username"]').simulate('change', { target: { value: 'username1' } });
+    wrapper.find('input[name="password"]').simulate('change', { target: { value: 'password1' } });
+    wrapper.find(EuiButton).simulate('click');
+
+    await act(async () => {
+      await nextTick();
+      wrapper.update();
+    });
+
+    expect(coreStartMock.http.post).toHaveBeenCalledTimes(1);
+    expect(coreStartMock.http.post).toHaveBeenCalledWith('/internal/security/login', {
+      body: JSON.stringify({ username: 'username1', password: 'password1' }),
+    });
+
+    expect(window.location.href).toBe('/some-base-path/app/kibana#/home?_g=()');
+    expect(wrapper.find(EuiCallOut).exists()).toBe(false);
+  });
+
+  describe('login selector', () => {
+    it('renders as expected with login form', async () => {
+      const coreStartMock = coreMock.createStart();
+      expect(
+        shallowWithIntl(
+          <LoginForm
+            http={coreStartMock.http}
+            notifications={coreStartMock.notifications}
+            loginAssistanceMessage=""
+            showLoginForm={true}
+            selector={{
+              enabled: true,
+              providers: [
+                { type: 'saml', name: 'saml1', description: 'Login w/SAML' },
+                { type: 'pki', name: 'pki1', description: 'Login w/PKI' },
+              ],
+            }}
+          />
+        )
+      ).toMatchSnapshot();
+    });
+
+    it('renders as expected without login form for providers with and without description', async () => {
+      const coreStartMock = coreMock.createStart();
+      expect(
+        shallowWithIntl(
+          <LoginForm
+            http={coreStartMock.http}
+            notifications={coreStartMock.notifications}
+            loginAssistanceMessage=""
+            showLoginForm={false}
+            selector={{
+              enabled: true,
+              providers: [
+                { type: 'saml', name: 'saml1', description: 'Login w/SAML' },
+                { type: 'pki', name: 'pki1' },
+              ],
+            }}
+          />
+        )
+      ).toMatchSnapshot();
+    });
+
+    it('properly redirects after successful login', async () => {
+      const currentURL = `https://some-host/login?next=${encodeURIComponent(
+        '/some-base-path/app/kibana#/home?_g=()'
+      )}`;
+
+      const coreStartMock = coreMock.createStart({ basePath: '/some-base-path' });
+      coreStartMock.http.post.mockResolvedValue({
+        location: 'https://external-idp/login?optional-arg=2#optional-hash',
+      });
+
+      window.location.href = currentURL;
+      const wrapper = mountWithIntl(
+        <LoginForm
+          http={coreStartMock.http}
+          notifications={coreStartMock.notifications}
+          loginAssistanceMessage=""
+          showLoginForm={true}
+          selector={{
+            enabled: true,
+            providers: [
+              { type: 'saml', name: 'saml1', description: 'Login w/SAML' },
+              { type: 'pki', name: 'pki1', description: 'Login w/PKI' },
+            ],
+          }}
+        />
+      );
+
+      wrapper.findWhere(node => node.key() === 'saml1').simulate('click');
+
+      await act(async () => {
+        await nextTick();
+        wrapper.update();
+      });
+
+      expect(coreStartMock.http.post).toHaveBeenCalledTimes(1);
+      expect(coreStartMock.http.post).toHaveBeenCalledWith('/internal/security/login_with', {
+        body: JSON.stringify({ providerType: 'saml', providerName: 'saml1', currentURL }),
+      });
+
+      expect(window.location.href).toBe('https://external-idp/login?optional-arg=2#optional-hash');
+      expect(wrapper.find(EuiCallOut).exists()).toBe(false);
+      expect(coreStartMock.notifications.toasts.addError).not.toHaveBeenCalled();
+    });
+
+    it('shows error toast if login fails', async () => {
+      const currentURL = `https://some-host/login?next=${encodeURIComponent(
+        '/some-base-path/app/kibana#/home?_g=()'
+      )}`;
+
+      const failureReason = new Error('Oh no!');
+      const coreStartMock = coreMock.createStart({ basePath: '/some-base-path' });
+      coreStartMock.http.post.mockRejectedValue(failureReason);
+
+      window.location.href = currentURL;
+      const wrapper = mountWithIntl(
+        <LoginForm
+          http={coreStartMock.http}
+          notifications={coreStartMock.notifications}
+          loginAssistanceMessage=""
+          showLoginForm={true}
+          selector={{ enabled: true, providers: [{ type: 'saml', name: 'saml1' }] }}
+        />
+      );
+
+      wrapper.findWhere(node => node.key() === 'saml1').simulate('click');
+
+      await act(async () => {
+        await nextTick();
+        wrapper.update();
+      });
+
+      expect(coreStartMock.http.post).toHaveBeenCalledTimes(1);
+      expect(coreStartMock.http.post).toHaveBeenCalledWith('/internal/security/login_with', {
+        body: JSON.stringify({ providerType: 'saml', providerName: 'saml1', currentURL }),
+      });
+
+      expect(window.location.href).toBe(currentURL);
+      expect(coreStartMock.notifications.toasts.addError).toHaveBeenCalledWith(failureReason, {
+        title: 'Could not perform login.',
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx
new file mode 100644
index 0000000000000..a028eb1ba4b70
--- /dev/null
+++ b/x-pack/plugins/security/public/authentication/login/components/login_form/login_form.tsx
@@ -0,0 +1,343 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { ChangeEvent, Component, FormEvent, Fragment, MouseEvent } from 'react';
+import ReactMarkdown from 'react-markdown';
+import {
+  EuiButton,
+  EuiCallOut,
+  EuiFieldText,
+  EuiFormRow,
+  EuiPanel,
+  EuiSpacer,
+  EuiText,
+} from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { HttpStart, IHttpFetchError, NotificationsStart } from 'src/core/public';
+import { parseNext } from '../../../../../common/parse_next';
+import { LoginSelector } from '../../../../../common/login_state';
+
+interface Props {
+  http: HttpStart;
+  notifications: NotificationsStart;
+  selector: LoginSelector;
+  showLoginForm: boolean;
+  infoMessage?: string;
+  loginAssistanceMessage: string;
+}
+
+interface State {
+  loadingState:
+    | { type: LoadingStateType.None }
+    | { type: LoadingStateType.Form }
+    | { type: LoadingStateType.Selector; providerName: string };
+  username: string;
+  password: string;
+  message:
+    | { type: MessageType.None }
+    | { type: MessageType.Danger | MessageType.Info; content: string };
+}
+
+enum LoadingStateType {
+  None,
+  Form,
+  Selector,
+}
+
+enum MessageType {
+  None,
+  Info,
+  Danger,
+}
+
+export class LoginForm extends Component<Props, State> {
+  public state: State = {
+    loadingState: { type: LoadingStateType.None },
+    username: '',
+    password: '',
+    message: this.props.infoMessage
+      ? { type: MessageType.Info, content: this.props.infoMessage }
+      : { type: MessageType.None },
+  };
+
+  public render() {
+    return (
+      <Fragment>
+        {this.renderLoginAssistanceMessage()}
+        {this.renderMessage()}
+        {this.renderSelector()}
+        {this.renderLoginForm()}
+      </Fragment>
+    );
+  }
+
+  private renderLoginForm = () => {
+    if (!this.props.showLoginForm) {
+      return null;
+    }
+
+    return (
+      <EuiPanel>
+        <form onSubmit={this.submitLoginForm}>
+          <EuiFormRow
+            label={
+              <FormattedMessage
+                id="xpack.security.login.basicLoginForm.usernameFormRowLabel"
+                defaultMessage="Username"
+              />
+            }
+          >
+            <EuiFieldText
+              id="username"
+              name="username"
+              data-test-subj="loginUsername"
+              value={this.state.username}
+              onChange={this.onUsernameChange}
+              disabled={!this.isLoadingState(LoadingStateType.None)}
+              isInvalid={false}
+              aria-required={true}
+              inputRef={this.setUsernameInputRef}
+            />
+          </EuiFormRow>
+
+          <EuiFormRow
+            label={
+              <FormattedMessage
+                id="xpack.security.login.basicLoginForm.passwordFormRowLabel"
+                defaultMessage="Password"
+              />
+            }
+          >
+            <EuiFieldText
+              autoComplete="off"
+              id="password"
+              name="password"
+              data-test-subj="loginPassword"
+              type="password"
+              value={this.state.password}
+              onChange={this.onPasswordChange}
+              disabled={!this.isLoadingState(LoadingStateType.None)}
+              isInvalid={false}
+              aria-required={true}
+            />
+          </EuiFormRow>
+
+          <EuiButton
+            fill
+            type="submit"
+            color="primary"
+            onClick={this.submitLoginForm}
+            isDisabled={!this.isLoadingState(LoadingStateType.None)}
+            isLoading={this.isLoadingState(LoadingStateType.Form)}
+            data-test-subj="loginSubmit"
+          >
+            <FormattedMessage
+              id="xpack.security.login.basicLoginForm.logInButtonLabel"
+              defaultMessage="Log in"
+            />
+          </EuiButton>
+        </form>
+      </EuiPanel>
+    );
+  };
+
+  private renderLoginAssistanceMessage = () => {
+    if (!this.props.loginAssistanceMessage) {
+      return null;
+    }
+
+    return (
+      <Fragment>
+        <EuiText size="s">
+          <ReactMarkdown>{this.props.loginAssistanceMessage}</ReactMarkdown>
+        </EuiText>
+      </Fragment>
+    );
+  };
+
+  private renderMessage = () => {
+    const { message } = this.state;
+    if (message.type === MessageType.Danger) {
+      return (
+        <Fragment>
+          <EuiCallOut
+            size="s"
+            color="danger"
+            data-test-subj="loginErrorMessage"
+            title={message.content}
+            role="alert"
+          />
+          <EuiSpacer size="l" />
+        </Fragment>
+      );
+    }
+
+    if (message.type === MessageType.Info) {
+      return (
+        <Fragment>
+          <EuiCallOut
+            size="s"
+            color="primary"
+            data-test-subj="loginInfoMessage"
+            title={message.content}
+            role="status"
+          />
+          <EuiSpacer size="l" />
+        </Fragment>
+      );
+    }
+
+    return null;
+  };
+
+  private renderSelector = () => {
+    const showLoginSelector =
+      this.props.selector.enabled && this.props.selector.providers.length > 0;
+    if (!showLoginSelector) {
+      return null;
+    }
+
+    const loginSelectorAndLoginFormSeparator = showLoginSelector && this.props.showLoginForm && (
+      <>
+        <EuiText textAlign="center" color="subdued">
+          ―――&nbsp;&nbsp;
+          <FormattedMessage id="xpack.security.loginPage.loginSelectorOR" defaultMessage="OR" />
+          &nbsp;&nbsp;―――
+        </EuiText>
+        <EuiSpacer size="m" />
+      </>
+    );
+
+    return (
+      <>
+        {this.props.selector.providers.map((provider, index) => (
+          <Fragment key={index}>
+            <EuiButton
+              key={provider.name}
+              fullWidth={true}
+              isDisabled={!this.isLoadingState(LoadingStateType.None)}
+              isLoading={this.isLoadingState(LoadingStateType.Selector, provider.name)}
+              onClick={() => this.loginWithSelector(provider.type, provider.name)}
+            >
+              {provider.description ?? (
+                <FormattedMessage
+                  id="xpack.security.loginPage.loginProviderDescription"
+                  defaultMessage="Login with {providerType}/{providerName}"
+                  values={{
+                    providerType: provider.type,
+                    providerName: provider.name,
+                  }}
+                />
+              )}
+            </EuiButton>
+            <EuiSpacer size="m" />
+          </Fragment>
+        ))}
+        {loginSelectorAndLoginFormSeparator}
+      </>
+    );
+  };
+
+  private setUsernameInputRef(ref: HTMLInputElement) {
+    if (ref) {
+      ref.focus();
+    }
+  }
+
+  private isFormValid = () => {
+    const { username, password } = this.state;
+
+    return username && password;
+  };
+
+  private onUsernameChange = (e: ChangeEvent<HTMLInputElement>) => {
+    this.setState({
+      username: e.target.value,
+    });
+  };
+
+  private onPasswordChange = (e: ChangeEvent<HTMLInputElement>) => {
+    this.setState({
+      password: e.target.value,
+    });
+  };
+
+  private submitLoginForm = async (
+    e: MouseEvent<HTMLButtonElement> | FormEvent<HTMLFormElement>
+  ) => {
+    e.preventDefault();
+
+    if (!this.isFormValid()) {
+      return;
+    }
+
+    this.setState({
+      loadingState: { type: LoadingStateType.Form },
+      message: { type: MessageType.None },
+    });
+
+    const { http } = this.props;
+    const { username, password } = this.state;
+
+    try {
+      await http.post('/internal/security/login', { body: JSON.stringify({ username, password }) });
+      window.location.href = parseNext(window.location.href, http.basePath.serverBasePath);
+    } catch (error) {
+      const message =
+        (error as IHttpFetchError).response?.status === 401
+          ? i18n.translate(
+              'xpack.security.login.basicLoginForm.invalidUsernameOrPasswordErrorMessage',
+              { defaultMessage: 'Invalid username or password. Please try again.' }
+            )
+          : i18n.translate('xpack.security.login.basicLoginForm.unknownErrorMessage', {
+              defaultMessage: 'Oops! Error. Try again.',
+            });
+
+      this.setState({
+        message: { type: MessageType.Danger, content: message },
+        loadingState: { type: LoadingStateType.None },
+      });
+    }
+  };
+
+  private loginWithSelector = async (providerType: string, providerName: string) => {
+    this.setState({
+      loadingState: { type: LoadingStateType.Selector, providerName },
+      message: { type: MessageType.None },
+    });
+
+    try {
+      const { location } = await this.props.http.post<{ location: string }>(
+        '/internal/security/login_with',
+        { body: JSON.stringify({ providerType, providerName, currentURL: window.location.href }) }
+      );
+
+      window.location.href = location;
+    } catch (err) {
+      this.props.notifications.toasts.addError(err, {
+        title: i18n.translate('xpack.security.loginPage.loginSelectorErrorMessage', {
+          defaultMessage: 'Could not perform login.',
+        }),
+      });
+
+      this.setState({ loadingState: { type: LoadingStateType.None } });
+    }
+  };
+
+  private isLoadingState(type: LoadingStateType.None | LoadingStateType.Form): boolean;
+  private isLoadingState(type: LoadingStateType.Selector, providerName: string): boolean;
+  private isLoadingState(type: LoadingStateType, providerName?: string) {
+    const { loadingState } = this.state;
+    if (loadingState.type !== type) {
+      return false;
+    }
+
+    return (
+      loadingState.type !== LoadingStateType.Selector || loadingState.providerName === providerName
+    );
+  }
+}
diff --git a/x-pack/plugins/security/public/authentication/login/login_app.test.ts b/x-pack/plugins/security/public/authentication/login/login_app.test.ts
index 051f08058ed8d..2597a935f45df 100644
--- a/x-pack/plugins/security/public/authentication/login/login_app.test.ts
+++ b/x-pack/plugins/security/public/authentication/login/login_app.test.ts
@@ -38,7 +38,6 @@ describe('loginApp', () => {
   it('properly renders application', async () => {
     const coreSetupMock = coreMock.createSetup();
     const coreStartMock = coreMock.createStart();
-    coreStartMock.injectedMetadata.getInjectedVar.mockReturnValue(true);
     coreSetupMock.getStartServices.mockResolvedValue([coreStartMock, {}]);
     const containerMock = document.createElement('div');
 
@@ -55,16 +54,13 @@ describe('loginApp', () => {
       history: (scopedHistoryMock.create() as unknown) as ScopedHistory,
     });
 
-    expect(coreStartMock.injectedMetadata.getInjectedVar).toHaveBeenCalledTimes(1);
-    expect(coreStartMock.injectedMetadata.getInjectedVar).toHaveBeenCalledWith('secureCookies');
-
     const mockRenderApp = jest.requireMock('./login_page').renderLoginPage;
     expect(mockRenderApp).toHaveBeenCalledTimes(1);
     expect(mockRenderApp).toHaveBeenCalledWith(coreStartMock.i18n, containerMock, {
       http: coreStartMock.http,
+      notifications: coreStartMock.notifications,
       fatalErrors: coreStartMock.fatalErrors,
       loginAssistanceMessage: 'some-message',
-      requiresSecureConnection: true,
     });
   });
 });
diff --git a/x-pack/plugins/security/public/authentication/login/login_app.ts b/x-pack/plugins/security/public/authentication/login/login_app.ts
index 4f4bf3903a1fa..1ecb5dcfd7990 100644
--- a/x-pack/plugins/security/public/authentication/login/login_app.ts
+++ b/x-pack/plugins/security/public/authentication/login/login_app.ts
@@ -5,13 +5,18 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, AppMountParameters, HttpSetup } from 'src/core/public';
+import {
+  StartServicesAccessor,
+  AppMountParameters,
+  ApplicationSetup,
+  HttpSetup,
+} from 'src/core/public';
 import { ConfigType } from '../../config';
 
 interface CreateDeps {
-  application: CoreSetup['application'];
+  application: ApplicationSetup;
   http: HttpSetup;
-  getStartServices: CoreSetup['getStartServices'];
+  getStartServices: StartServicesAccessor;
   config: Pick<ConfigType, 'loginAssistanceMessage'>;
 }
 
@@ -31,11 +36,9 @@ export const loginApp = Object.freeze({
         ]);
         return renderLoginPage(coreStart.i18n, element, {
           http: coreStart.http,
+          notifications: coreStart.notifications,
           fatalErrors: coreStart.fatalErrors,
           loginAssistanceMessage: config.loginAssistanceMessage,
-          requiresSecureConnection: coreStart.injectedMetadata.getInjectedVar(
-            'secureCookies'
-          ) as boolean,
         });
       },
     });
diff --git a/x-pack/plugins/security/public/authentication/login/login_page.test.tsx b/x-pack/plugins/security/public/authentication/login/login_page.test.tsx
index 294434cd08ebc..c4be57d8d7db7 100644
--- a/x-pack/plugins/security/public/authentication/login/login_page.test.tsx
+++ b/x-pack/plugins/security/public/authentication/login/login_page.test.tsx
@@ -8,15 +8,18 @@ import React from 'react';
 import { shallow } from 'enzyme';
 import { act } from '@testing-library/react';
 import { nextTick } from 'test_utils/enzyme_helpers';
-import { LoginState } from './login_state';
+import { LoginState } from '../../../common/login_state';
 import { LoginPage } from './login_page';
 import { coreMock } from '../../../../../../src/core/public/mocks';
-import { DisabledLoginForm, BasicLoginForm } from './components';
+import { DisabledLoginForm, LoginForm } from './components';
 
 const createLoginState = (options?: Partial<LoginState>) => {
   return {
     allowLogin: true,
     layout: 'form',
+    requiresSecureConnection: false,
+    showLoginForm: true,
+    selector: { enabled: false, providers: [] },
     ...options,
   } as LoginState;
 };
@@ -55,9 +58,9 @@ describe('LoginPage', () => {
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage=""
-          requiresSecureConnection={false}
         />
       );
 
@@ -74,14 +77,14 @@ describe('LoginPage', () => {
   describe('disabled form states', () => {
     it('renders as expected when secure connection is required but not present', async () => {
       const coreStartMock = coreMock.createStart();
-      httpMock.get.mockResolvedValue(createLoginState());
+      httpMock.get.mockResolvedValue(createLoginState({ requiresSecureConnection: true }));
 
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage=""
-          requiresSecureConnection={true}
         />
       );
 
@@ -100,9 +103,9 @@ describe('LoginPage', () => {
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage=""
-          requiresSecureConnection={false}
         />
       );
 
@@ -121,9 +124,9 @@ describe('LoginPage', () => {
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage=""
-          requiresSecureConnection={false}
         />
       );
 
@@ -144,9 +147,30 @@ describe('LoginPage', () => {
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
+          fatalErrors={coreStartMock.fatalErrors}
+          loginAssistanceMessage=""
+        />
+      );
+
+      await act(async () => {
+        await nextTick();
+        wrapper.update();
+      });
+
+      expect(wrapper.find(DisabledLoginForm)).toMatchSnapshot();
+    });
+
+    it('renders as expected when login is not enabled', async () => {
+      const coreStartMock = coreMock.createStart();
+      httpMock.get.mockResolvedValue(createLoginState({ showLoginForm: false }));
+
+      const wrapper = shallow(
+        <LoginPage
+          http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage=""
-          requiresSecureConnection={false}
         />
       );
 
@@ -167,9 +191,9 @@ describe('LoginPage', () => {
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage=""
-          requiresSecureConnection={false}
         />
       );
 
@@ -179,7 +203,7 @@ describe('LoginPage', () => {
         resetHttpMock(); // so the calls don't show in the BasicLoginForm snapshot
       });
 
-      expect(wrapper.find(BasicLoginForm)).toMatchSnapshot();
+      expect(wrapper.find(LoginForm)).toMatchSnapshot();
     });
 
     it('renders as expected when info message is set', async () => {
@@ -190,9 +214,9 @@ describe('LoginPage', () => {
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage=""
-          requiresSecureConnection={false}
         />
       );
 
@@ -202,7 +226,7 @@ describe('LoginPage', () => {
         resetHttpMock(); // so the calls don't show in the BasicLoginForm snapshot
       });
 
-      expect(wrapper.find(BasicLoginForm)).toMatchSnapshot();
+      expect(wrapper.find(LoginForm)).toMatchSnapshot();
     });
 
     it('renders as expected when loginAssistanceMessage is set', async () => {
@@ -212,9 +236,9 @@ describe('LoginPage', () => {
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage="This is an *important* message"
-          requiresSecureConnection={false}
         />
       );
 
@@ -224,7 +248,7 @@ describe('LoginPage', () => {
         resetHttpMock(); // so the calls don't show in the BasicLoginForm snapshot
       });
 
-      expect(wrapper.find(BasicLoginForm)).toMatchSnapshot();
+      expect(wrapper.find(LoginForm)).toMatchSnapshot();
     });
   });
 
@@ -236,9 +260,9 @@ describe('LoginPage', () => {
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage=""
-          requiresSecureConnection={false}
         />
       );
 
@@ -261,9 +285,9 @@ describe('LoginPage', () => {
       const wrapper = shallow(
         <LoginPage
           http={httpMock}
+          notifications={coreStartMock.notifications}
           fatalErrors={coreStartMock.fatalErrors}
           loginAssistanceMessage=""
-          requiresSecureConnection={false}
         />
       );
 
diff --git a/x-pack/plugins/security/public/authentication/login/login_page.tsx b/x-pack/plugins/security/public/authentication/login/login_page.tsx
index d38dee74faedf..70f8f76ee0a9c 100644
--- a/x-pack/plugins/security/public/authentication/login/login_page.tsx
+++ b/x-pack/plugins/security/public/authentication/login/login_page.tsx
@@ -12,16 +12,15 @@ import { parse } from 'url';
 import { EuiFlexGroup, EuiFlexItem, EuiIcon, EuiSpacer, EuiText, EuiTitle } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { CoreStart, FatalErrorsStart, HttpStart } from 'src/core/public';
-import { LoginLayout } from '../../../common/licensing';
-import { BasicLoginForm, DisabledLoginForm } from './components';
-import { LoginState } from './login_state';
+import { CoreStart, FatalErrorsStart, HttpStart, NotificationsStart } from 'src/core/public';
+import { LoginState } from '../../../common/login_state';
+import { LoginForm, DisabledLoginForm } from './components';
 
 interface Props {
   http: HttpStart;
+  notifications: NotificationsStart;
   fatalErrors: FatalErrorsStart;
   loginAssistanceMessage: string;
-  requiresSecureConnection: boolean;
 }
 
 interface State {
@@ -44,7 +43,7 @@ const infoMessageMap = new Map([
 ]);
 
 export class LoginPage extends Component<Props, State> {
-  state = { loginState: null };
+  state = { loginState: null } as State;
 
   public async componentDidMount() {
     const loadingCount$ = new BehaviorSubject(1);
@@ -67,12 +66,10 @@ export class LoginPage extends Component<Props, State> {
     }
 
     const isSecureConnection = !!window.location.protocol.match(/^https/);
-    const { allowLogin, layout } = loginState;
+    const { allowLogin, layout, requiresSecureConnection } = loginState;
 
     const loginIsSupported =
-      this.props.requiresSecureConnection && !isSecureConnection
-        ? false
-        : allowLogin && layout === 'form';
+      requiresSecureConnection && !isSecureConnection ? false : allowLogin && layout === 'form';
 
     const contentHeaderClasses = classNames('loginWelcome__content', 'eui-textCenter', {
       ['loginWelcome__contentDisabledForm']: !loginIsSupported,
@@ -111,7 +108,7 @@ export class LoginPage extends Component<Props, State> {
         </header>
         <div className={contentBodyClasses}>
           <EuiFlexGroup gutterSize="l">
-            <EuiFlexItem>{this.getLoginForm({ isSecureConnection, layout })}</EuiFlexItem>
+            <EuiFlexItem>{this.getLoginForm({ ...loginState, isSecureConnection })}</EuiFlexItem>
           </EuiFlexGroup>
         </div>
       </div>
@@ -119,13 +116,34 @@ export class LoginPage extends Component<Props, State> {
   }
 
   private getLoginForm = ({
-    isSecureConnection,
     layout,
-  }: {
-    isSecureConnection: boolean;
-    layout: LoginLayout;
-  }) => {
-    if (this.props.requiresSecureConnection && !isSecureConnection) {
+    requiresSecureConnection,
+    isSecureConnection,
+    selector,
+    showLoginForm,
+  }: LoginState & { isSecureConnection: boolean }) => {
+    const isLoginExplicitlyDisabled =
+      !showLoginForm && (!selector.enabled || selector.providers.length === 0);
+    if (isLoginExplicitlyDisabled) {
+      return (
+        <DisabledLoginForm
+          title={
+            <FormattedMessage
+              id="xpack.security.loginPage.noLoginMethodsAvailableTitle"
+              defaultMessage="Login is disabled."
+            />
+          }
+          message={
+            <FormattedMessage
+              id="xpack.security.loginPage.noLoginMethodsAvailableMessage"
+              defaultMessage="Contact your system administrator."
+            />
+          }
+        />
+      );
+    }
+
+    if (requiresSecureConnection && !isSecureConnection) {
       return (
         <DisabledLoginForm
           title={
@@ -144,69 +162,73 @@ export class LoginPage extends Component<Props, State> {
       );
     }
 
-    switch (layout) {
-      case 'form':
-        return (
-          <BasicLoginForm
-            http={this.props.http}
-            infoMessage={infoMessageMap.get(
-              parse(window.location.href, true).query.msg?.toString()
-            )}
-            loginAssistanceMessage={this.props.loginAssistanceMessage}
-          />
-        );
-      case 'error-es-unavailable':
-        return (
-          <DisabledLoginForm
-            title={
-              <FormattedMessage
-                id="xpack.security.loginPage.esUnavailableTitle"
-                defaultMessage="Cannot connect to the Elasticsearch cluster"
-              />
-            }
-            message={
-              <FormattedMessage
-                id="xpack.security.loginPage.esUnavailableMessage"
-                defaultMessage="See the Kibana logs for details and try reloading the page."
-              />
-            }
-          />
-        );
-      case 'error-xpack-unavailable':
-        return (
-          <DisabledLoginForm
-            title={
-              <FormattedMessage
-                id="xpack.security.loginPage.xpackUnavailableTitle"
-                defaultMessage="Cannot connect to the Elasticsearch cluster currently configured for Kibana."
-              />
-            }
-            message={
-              <FormattedMessage
-                id="xpack.security.loginPage.xpackUnavailableMessage"
-                defaultMessage="To use the full set of free features in this distribution of Kibana, please update Elasticsearch to the default distribution."
-              />
-            }
-          />
-        );
-      default:
-        return (
-          <DisabledLoginForm
-            title={
-              <FormattedMessage
-                id="xpack.security.loginPage.unknownLayoutTitle"
-                defaultMessage="Unsupported login form layout."
-              />
-            }
-            message={
-              <FormattedMessage
-                id="xpack.security.loginPage.unknownLayoutMessage"
-                defaultMessage="Refer to the Kibana logs for more details and refresh to try again."
-              />
-            }
-          />
-        );
+    if (layout === 'error-es-unavailable') {
+      return (
+        <DisabledLoginForm
+          title={
+            <FormattedMessage
+              id="xpack.security.loginPage.esUnavailableTitle"
+              defaultMessage="Cannot connect to the Elasticsearch cluster"
+            />
+          }
+          message={
+            <FormattedMessage
+              id="xpack.security.loginPage.esUnavailableMessage"
+              defaultMessage="See the Kibana logs for details and try reloading the page."
+            />
+          }
+        />
+      );
+    }
+
+    if (layout === 'error-xpack-unavailable') {
+      return (
+        <DisabledLoginForm
+          title={
+            <FormattedMessage
+              id="xpack.security.loginPage.xpackUnavailableTitle"
+              defaultMessage="Cannot connect to the Elasticsearch cluster currently configured for Kibana."
+            />
+          }
+          message={
+            <FormattedMessage
+              id="xpack.security.loginPage.xpackUnavailableMessage"
+              defaultMessage="To use the full set of free features in this distribution of Kibana, please update Elasticsearch to the default distribution."
+            />
+          }
+        />
+      );
+    }
+
+    if (layout !== 'form') {
+      return (
+        <DisabledLoginForm
+          title={
+            <FormattedMessage
+              id="xpack.security.loginPage.unknownLayoutTitle"
+              defaultMessage="Unsupported login form layout."
+            />
+          }
+          message={
+            <FormattedMessage
+              id="xpack.security.loginPage.unknownLayoutMessage"
+              defaultMessage="See the Kibana logs for details and try reloading the page."
+            />
+          }
+        />
+      );
     }
+
+    return (
+      <LoginForm
+        http={this.props.http}
+        notifications={this.props.notifications}
+        showLoginForm={showLoginForm}
+        selector={selector}
+        infoMessage={infoMessageMap.get(parse(window.location.href, true).query.msg?.toString())}
+        loginAssistanceMessage={this.props.loginAssistanceMessage}
+      />
+    );
   };
 }
 
diff --git a/x-pack/plugins/security/public/authentication/overwritten_session/overwritten_session_app.ts b/x-pack/plugins/security/public/authentication/overwritten_session/overwritten_session_app.ts
index 1bbe388a635e2..8e0ee73dfb613 100644
--- a/x-pack/plugins/security/public/authentication/overwritten_session/overwritten_session_app.ts
+++ b/x-pack/plugins/security/public/authentication/overwritten_session/overwritten_session_app.ts
@@ -5,13 +5,13 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, AppMountParameters } from 'src/core/public';
+import { StartServicesAccessor, ApplicationSetup, AppMountParameters } from 'src/core/public';
 import { AuthenticationServiceSetup } from '../authentication_service';
 
 interface CreateDeps {
-  application: CoreSetup['application'];
+  application: ApplicationSetup;
   authc: AuthenticationServiceSetup;
-  getStartServices: CoreSetup['getStartServices'];
+  getStartServices: StartServicesAccessor;
 }
 
 export const overwrittenSessionApp = Object.freeze({
diff --git a/x-pack/plugins/security/public/management/api_keys/api_keys_management_app.tsx b/x-pack/plugins/security/public/management/api_keys/api_keys_management_app.tsx
index 35de732b84ce9..272fc9cfc2fe6 100644
--- a/x-pack/plugins/security/public/management/api_keys/api_keys_management_app.tsx
+++ b/x-pack/plugins/security/public/management/api_keys/api_keys_management_app.tsx
@@ -7,7 +7,7 @@
 import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { i18n } from '@kbn/i18n';
-import { CoreSetup } from 'src/core/public';
+import { StartServicesAccessor } from 'src/core/public';
 import { RegisterManagementAppArgs } from '../../../../../../src/plugins/management/public';
 import { PluginStartDependencies } from '../../plugin';
 import { APIKeysGridPage } from './api_keys_grid';
@@ -15,7 +15,7 @@ import { APIKeysAPIClient } from './api_keys_api_client';
 import { DocumentationLinksService } from './documentation_links';
 
 interface CreateParams {
-  getStartServices: CoreSetup<PluginStartDependencies>['getStartServices'];
+  getStartServices: StartServicesAccessor<PluginStartDependencies>;
 }
 
 export const apiKeysManagementApp = Object.freeze({
diff --git a/x-pack/plugins/security/public/management/management_service.ts b/x-pack/plugins/security/public/management/management_service.ts
index 5ad3681590fbf..7c4c470730ffe 100644
--- a/x-pack/plugins/security/public/management/management_service.ts
+++ b/x-pack/plugins/security/public/management/management_service.ts
@@ -6,7 +6,7 @@
 
 import { Subscription } from 'rxjs';
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, FatalErrorsSetup } from 'src/core/public';
+import { StartServicesAccessor, FatalErrorsSetup } from 'src/core/public';
 import {
   ManagementApp,
   ManagementSetup,
@@ -25,7 +25,7 @@ interface SetupParams {
   license: SecurityLicense;
   authc: AuthenticationServiceSetup;
   fatalErrors: FatalErrorsSetup;
-  getStartServices: CoreSetup<PluginStartDependencies>['getStartServices'];
+  getStartServices: StartServicesAccessor<PluginStartDependencies>;
 }
 
 interface StartParams {
diff --git a/x-pack/plugins/security/public/management/role_mappings/role_mappings_management_app.tsx b/x-pack/plugins/security/public/management/role_mappings/role_mappings_management_app.tsx
index 8e1ac8d7f6957..ea090520fdd46 100644
--- a/x-pack/plugins/security/public/management/role_mappings/role_mappings_management_app.tsx
+++ b/x-pack/plugins/security/public/management/role_mappings/role_mappings_management_app.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { HashRouter as Router, Route, Switch, useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
-import { CoreSetup } from 'src/core/public';
+import { StartServicesAccessor } from 'src/core/public';
 import { RegisterManagementAppArgs } from '../../../../../../src/plugins/management/public';
 import { PluginStartDependencies } from '../../plugin';
 import { RolesAPIClient } from '../roles';
@@ -18,7 +18,7 @@ import { RoleMappingsGridPage } from './role_mappings_grid';
 import { EditRoleMappingPage } from './edit_role_mapping';
 
 interface CreateParams {
-  getStartServices: CoreSetup<PluginStartDependencies>['getStartServices'];
+  getStartServices: StartServicesAccessor<PluginStartDependencies>;
 }
 
 export const roleMappingsManagementApp = Object.freeze({
diff --git a/x-pack/plugins/security/public/management/roles/__fixtures__/kibana_features.ts b/x-pack/plugins/security/public/management/roles/__fixtures__/kibana_features.ts
new file mode 100644
index 0000000000000..68d352363d363
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/__fixtures__/kibana_features.ts
@@ -0,0 +1,208 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Feature, FeatureConfig } from '../../../../../features/public';
+
+export const createFeature = (
+  config: Pick<FeatureConfig, 'id' | 'name' | 'subFeatures' | 'reserved' | 'privilegesTooltip'> & {
+    excludeFromBaseAll?: boolean;
+    excludeFromBaseRead?: boolean;
+  }
+) => {
+  const { excludeFromBaseAll, excludeFromBaseRead, ...rest } = config;
+  return new Feature({
+    icon: 'discoverApp',
+    navLinkId: 'kibana:discover',
+    app: [],
+    catalogue: [],
+    privileges: {
+      all: {
+        excludeFromBasePrivileges: excludeFromBaseAll,
+        savedObject: {
+          all: ['all-type'],
+          read: ['read-type'],
+        },
+        ui: ['read-ui', 'all-ui', `read-${config.id}`, `all-${config.id}`],
+      },
+      read: {
+        excludeFromBasePrivileges: excludeFromBaseRead,
+        savedObject: {
+          all: [],
+          read: ['read-type'],
+        },
+        ui: ['read-ui', `read-${config.id}`],
+      },
+    },
+    ...rest,
+  });
+};
+
+export const kibanaFeatures = [
+  createFeature({
+    id: 'no_sub_features',
+    name: 'Feature 1: No Sub Features',
+  }),
+  createFeature({
+    id: 'with_sub_features',
+    name: 'Mutually Exclusive Sub Features',
+    subFeatures: [
+      {
+        name: 'Cool Sub Feature',
+        privilegeGroups: [
+          {
+            groupType: 'mutually_exclusive',
+            privileges: [
+              {
+                id: 'cool_all',
+                name: 'All',
+                includeIn: 'all',
+                savedObject: {
+                  all: ['all-cool-type'],
+                  read: ['read-cool-type'],
+                },
+                ui: ['cool_read-ui', 'cool_all-ui'],
+              },
+              {
+                id: 'cool_read',
+                name: 'Read',
+                includeIn: 'read',
+                savedObject: {
+                  all: [],
+                  read: ['read-cool-type'],
+                },
+                ui: ['cool_read-ui'],
+              },
+            ],
+          },
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'cool_toggle_1',
+                name: 'Cool toggle 1',
+                includeIn: 'all',
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['cool_toggle_1-ui'],
+              },
+              {
+                id: 'cool_toggle_2',
+                name: 'Cool toggle 2',
+                includeIn: 'read',
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['cool_toggle_2-ui'],
+              },
+              {
+                id: 'cool_excluded_toggle',
+                name: 'Cool excluded toggle',
+                includeIn: 'none',
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['cool_excluded_toggle-ui'],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  }),
+  createFeature({
+    id: 'with_excluded_sub_features',
+    name: 'Excluded Sub Features',
+    subFeatures: [
+      {
+        name: 'Excluded Sub Feature',
+        privilegeGroups: [
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'cool_toggle_1',
+                name: 'Cool toggle 1',
+                includeIn: 'none',
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['cool_toggle_1-ui'],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  }),
+  createFeature({
+    id: 'excluded_from_base',
+    name: 'Excluded from base',
+    excludeFromBaseAll: true,
+    excludeFromBaseRead: true,
+    subFeatures: [
+      {
+        name: 'Cool Sub Feature',
+        privilegeGroups: [
+          {
+            groupType: 'mutually_exclusive',
+            privileges: [
+              {
+                id: 'cool_all',
+                name: 'All',
+                includeIn: 'all',
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['cool_read-ui', 'cool_all-ui'],
+              },
+              {
+                id: 'cool_read',
+                name: 'Read',
+                includeIn: 'read',
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['cool_read-ui'],
+              },
+            ],
+          },
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'cool_toggle_1',
+                name: 'Cool toggle 2',
+                includeIn: 'all',
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['cool_toggle_1-ui'],
+              },
+              {
+                id: 'cool_toggle_2',
+                name: 'Cool toggle 2',
+                includeIn: 'read',
+                savedObject: {
+                  all: [],
+                  read: [],
+                },
+                ui: ['cool_toggle_2-ui'],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  }),
+];
diff --git a/x-pack/plugins/security/public/management/roles/__fixtures__/kibana_privileges.ts b/x-pack/plugins/security/public/management/roles/__fixtures__/kibana_privileges.ts
new file mode 100644
index 0000000000000..98110a83103aa
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/__fixtures__/kibana_privileges.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { Actions } from '../../../../server/authorization';
+// eslint-disable-next-line @kbn/eslint/no-restricted-paths
+import { privilegesFactory } from '../../../../server/authorization/privileges';
+import { Feature } from '../../../../../features/public';
+import { KibanaPrivileges } from '../model';
+import { SecurityLicenseFeatures } from '../../..';
+
+export const createRawKibanaPrivileges = (
+  features: Feature[],
+  { allowSubFeaturePrivileges = true } = {}
+) => {
+  const featuresService = {
+    getFeatures: () => features,
+  };
+
+  const licensingService = {
+    getFeatures: () => ({ allowSubFeaturePrivileges } as SecurityLicenseFeatures),
+  };
+
+  return privilegesFactory(
+    new Actions('unit_test_version'),
+    featuresService,
+    licensingService
+  ).get();
+};
+
+export const createKibanaPrivileges = (
+  features: Feature[],
+  { allowSubFeaturePrivileges = true } = {}
+) => {
+  return new KibanaPrivileges(
+    createRawKibanaPrivileges(features, { allowSubFeaturePrivileges }),
+    features
+  );
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.test.tsx
index 23a3f327a2c5c..f1ee681331005 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.test.tsx
@@ -10,16 +10,10 @@ import { act } from '@testing-library/react';
 import { mountWithIntl, nextTick } from 'test_utils/enzyme_helpers';
 import { Capabilities } from 'src/core/public';
 import { Feature } from '../../../../../features/public';
-// These modules should be moved into a common directory
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { Actions } from '../../../../server/authorization/actions';
-// eslint-disable-next-line @kbn/eslint/no-restricted-paths
-import { privilegesFactory } from '../../../../server/authorization/privileges';
 import { Role } from '../../../../common/model';
 import { DocumentationLinksService } from '../documentation_links';
 import { EditRolePage } from './edit_role_page';
 import { SimplePrivilegeSection } from './privileges/kibana/simple_privilege_section';
-import { SpaceAwarePrivilegeSection } from './privileges/kibana/space_aware_privilege_section';
 
 import { TransformErrorSection } from './privileges/kibana/transform_error_section';
 import { coreMock } from '../../../../../../../src/core/public/mocks';
@@ -28,10 +22,12 @@ import { licenseMock } from '../../../../common/licensing/index.mock';
 import { userAPIClientMock } from '../../users/index.mock';
 import { rolesAPIClientMock, indicesAPIClientMock, privilegesAPIClientMock } from '../index.mock';
 import { Space } from '../../../../../spaces/public';
+import { SpaceAwarePrivilegeSection } from './privileges/kibana/space_aware_privilege_section';
+import { createRawKibanaPrivileges } from '../__fixtures__/kibana_privileges';
 
 const buildFeatures = () => {
   return [
-    {
+    new Feature({
       id: 'feature1',
       name: 'Feature 1',
       icon: 'addDataApp',
@@ -45,9 +41,17 @@ const buildFeatures = () => {
             read: [],
           },
         },
+        read: {
+          app: ['feature1App'],
+          ui: ['feature1-ui'],
+          savedObject: {
+            all: [],
+            read: [],
+          },
+        },
       },
-    },
-    {
+    }),
+    new Feature({
       id: 'feature2',
       name: 'Feature 2',
       icon: 'addDataApp',
@@ -61,17 +65,19 @@ const buildFeatures = () => {
             read: ['config'],
           },
         },
+        read: {
+          app: ['feature2App'],
+          ui: ['feature2-ui'],
+          savedObject: {
+            all: [],
+            read: ['config'],
+          },
+        },
       },
-    },
+    }),
   ] as Feature[];
 };
 
-const buildRawKibanaPrivileges = () => {
-  return privilegesFactory(new Actions('unit_test_version'), {
-    getFeatures: () => buildFeatures(),
-  }).get();
-};
-
 const buildBuiltinESPrivileges = () => {
   return {
     cluster: ['all', 'manage', 'monitor'],
@@ -144,7 +150,7 @@ function getProps({
   userAPIClient.getUsers.mockResolvedValue([]);
 
   const privilegesAPIClient = privilegesAPIClientMock.create();
-  privilegesAPIClient.getAll.mockResolvedValue(buildRawKibanaPrivileges());
+  privilegesAPIClient.getAll.mockResolvedValue(createRawKibanaPrivileges(buildFeatures()));
   privilegesAPIClient.getBuiltIn.mockResolvedValue(buildBuiltinESPrivileges());
 
   const license = licenseMock.create();
@@ -156,10 +162,6 @@ function getProps({
   const { fatalErrors } = coreMock.createSetup();
   const { http, docLinks, notifications } = coreMock.createStart();
   http.get.mockImplementation(async (path: any) => {
-    if (path === '/api/features') {
-      return buildFeatures();
-    }
-
     if (path === '/api/spaces/space') {
       return buildSpaces();
     }
@@ -175,6 +177,7 @@ function getProps({
     privilegesAPIClient,
     rolesAPIClient,
     userAPIClient,
+    getFeatures: () => Promise.resolve(buildFeatures()),
     notifications,
     docLinks: new DocumentationLinksService(docLinks),
     fatalErrors,
@@ -200,10 +203,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find('[data-test-subj="reservedRoleBadgeTooltip"]')).toHaveLength(1);
       expect(wrapper.find(SpaceAwarePrivilegeSection)).toHaveLength(1);
@@ -226,10 +226,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find('[data-test-subj="reservedRoleBadgeTooltip"]')).toHaveLength(0);
       expect(wrapper.find(SpaceAwarePrivilegeSection)).toHaveLength(1);
@@ -240,10 +237,7 @@ describe('<EditRolePage />', () => {
     it('can render when creating a new role', async () => {
       const wrapper = mountWithIntl(<EditRolePage {...getProps({ action: 'edit' })} />);
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find(SpaceAwarePrivilegeSection)).toHaveLength(1);
       expect(wrapper.find('[data-test-subj="userCannotManageSpacesCallout"]')).toHaveLength(0);
@@ -275,10 +269,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find(SpaceAwarePrivilegeSection)).toHaveLength(1);
       expect(wrapper.find('[data-test-subj="userCannotManageSpacesCallout"]')).toHaveLength(0);
@@ -301,10 +292,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find('[data-test-subj="reservedRoleBadgeTooltip"]')).toHaveLength(0);
 
@@ -333,10 +321,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find(TransformErrorSection)).toHaveLength(1);
       expectReadOnlyFormButtons(wrapper);
@@ -360,10 +345,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find('[data-test-subj="reservedRoleBadgeTooltip"]')).toHaveLength(1);
       expect(wrapper.find(SimplePrivilegeSection)).toHaveLength(1);
@@ -387,10 +369,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find('[data-test-subj="reservedRoleBadgeTooltip"]')).toHaveLength(0);
       expect(wrapper.find(SimplePrivilegeSection)).toHaveLength(1);
@@ -403,10 +382,7 @@ describe('<EditRolePage />', () => {
         <EditRolePage {...getProps({ action: 'edit', spacesEnabled: false })} />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find(SimplePrivilegeSection)).toHaveLength(1);
       expectSaveFormButtons(wrapper);
@@ -438,10 +414,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find(SimplePrivilegeSection)).toHaveLength(1);
       expectSaveFormButtons(wrapper);
@@ -464,10 +437,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find('[data-test-subj="reservedRoleBadgeTooltip"]')).toHaveLength(0);
 
@@ -497,10 +467,7 @@ describe('<EditRolePage />', () => {
         />
       );
 
-      await act(async () => {
-        await nextTick();
-        wrapper.update();
-      });
+      await waitForRender(wrapper);
 
       expect(wrapper.find(TransformErrorSection)).toHaveLength(1);
       expectReadOnlyFormButtons(wrapper);
@@ -522,10 +489,7 @@ describe('<EditRolePage />', () => {
 
     const wrapper = mountWithIntl(<EditRolePage {...{ ...getProps({ action: 'edit' }), http }} />);
 
-    await act(async () => {
-      await nextTick();
-      wrapper.update();
-    });
+    await waitForRender(wrapper);
 
     expect(wrapper.find(SpaceAwarePrivilegeSection)).toHaveLength(1);
     expect(wrapper.find('[data-test-subj="userCannotManageSpacesCallout"]')).toHaveLength(0);
@@ -540,13 +504,17 @@ describe('<EditRolePage />', () => {
       <EditRolePage {...{ ...getProps({ action: 'edit' }), indexPatterns }} />
     );
 
-    await act(async () => {
-      await nextTick();
-      wrapper.update();
-    });
+    await waitForRender(wrapper);
 
     expect(wrapper.find(SpaceAwarePrivilegeSection)).toHaveLength(1);
     expect(wrapper.find('[data-test-subj="userCannotManageSpacesCallout"]')).toHaveLength(0);
     expectSaveFormButtons(wrapper);
   });
 });
+
+async function waitForRender(wrapper: ReactWrapper<any>) {
+  await act(async () => {
+    await nextTick();
+    wrapper.update();
+  });
+}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx b/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx
index cd7766ef38748..f0d5abf89dd2e 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/edit_role_page.tsx
@@ -37,11 +37,11 @@ import {
   IHttpFetchError,
   NotificationsStart,
 } from 'src/core/public';
+import { FeaturesPluginStart } from '../../../../../features/public';
+import { Feature } from '../../../../../features/common';
 import { IndexPatternsContract } from '../../../../../../../src/plugins/data/public';
 import { Space } from '../../../../../spaces/public';
-import { Feature } from '../../../../../features/public';
 import {
-  KibanaPrivileges,
   RawKibanaPrivileges,
   Role,
   BuiltinESPrivileges,
@@ -64,6 +64,7 @@ import { DocumentationLinksService } from '../documentation_links';
 import { IndicesAPIClient } from '../indices_api_client';
 import { RolesAPIClient } from '../roles_api_client';
 import { PrivilegesAPIClient } from '../privileges_api_client';
+import { KibanaPrivileges } from '../model';
 
 interface Props {
   action: 'edit' | 'clone';
@@ -73,6 +74,7 @@ interface Props {
   indicesAPIClient: PublicMethodsOf<IndicesAPIClient>;
   rolesAPIClient: PublicMethodsOf<RolesAPIClient>;
   privilegesAPIClient: PublicMethodsOf<PrivilegesAPIClient>;
+  getFeatures: FeaturesPluginStart['getFeatures'];
   docLinks: DocumentationLinksService;
   http: HttpStart;
   license: SecurityLicense;
@@ -231,11 +233,13 @@ function useSpaces(http: HttpStart, fatalErrors: FatalErrorsSetup, spacesEnabled
   return spaces;
 }
 
-function useFeatures(http: HttpStart, fatalErrors: FatalErrorsSetup) {
+function useFeatures(
+  getFeatures: FeaturesPluginStart['getFeatures'],
+  fatalErrors: FatalErrorsSetup
+) {
   const [features, setFeatures] = useState<Feature[] | null>(null);
   useEffect(() => {
-    http
-      .get('/api/features')
+    getFeatures()
       .catch((err: IHttpFetchError) => {
         // Currently, the `/api/features` endpoint effectively requires the "Global All" kibana privilege (e.g., what
         // the `kibana_user` grants), because it returns information about all registered features (#35841). It's
@@ -246,14 +250,15 @@ function useFeatures(http: HttpStart, fatalErrors: FatalErrorsSetup) {
         // 404 here, and respond in a way that still allows the UI to render itself.
         const unauthorizedForFeatures = err.response?.status === 404;
         if (unauthorizedForFeatures) {
-          return [];
+          return [] as Feature[];
         }
 
         fatalErrors.add(err);
-        throw err;
       })
-      .then(setFeatures);
-  }, [http, fatalErrors]);
+      .then(retrievedFeatures => {
+        setFeatures(retrievedFeatures);
+      });
+  }, [fatalErrors, getFeatures]);
 
   return features;
 }
@@ -268,6 +273,7 @@ export const EditRolePage: FunctionComponent<Props> = ({
   rolesAPIClient,
   indicesAPIClient,
   privilegesAPIClient,
+  getFeatures,
   http,
   roleName,
   action,
@@ -287,7 +293,7 @@ export const EditRolePage: FunctionComponent<Props> = ({
   const indexPatternsTitles = useIndexPatternsTitles(indexPatterns, fatalErrors, notifications);
   const privileges = usePrivileges(privilegesAPIClient, fatalErrors);
   const spaces = useSpaces(http, fatalErrors, spacesEnabled);
-  const features = useFeatures(http, fatalErrors);
+  const features = useFeatures(getFeatures, fatalErrors);
   const [role, setRole] = useRole(
     rolesAPIClient,
     fatalErrors,
@@ -425,11 +431,11 @@ export const EditRolePage: FunctionComponent<Props> = ({
       <div>
         <EuiSpacer />
         <KibanaPrivilegesRegion
-          kibanaPrivileges={new KibanaPrivileges(kibanaPrivileges)}
+          kibanaPrivileges={new KibanaPrivileges(kibanaPrivileges, features)}
           spaces={spaces}
           spacesEnabled={spacesEnabled}
-          features={features}
           uiCapabilities={uiCapabilities}
+          canCustomizeSubFeaturePrivileges={license.getFeatures().allowSubFeaturePrivileges}
           editable={!isRoleReadOnly}
           role={role}
           onChange={onRoleChange}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privilege_utils.test.ts b/x-pack/plugins/security/public/management/roles/edit_role/privilege_utils.test.ts
index 88ac71cbd7634..9ecdc7062d405 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privilege_utils.test.ts
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privilege_utils.test.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { hasAssignedFeaturePrivileges, isGlobalPrivilegeDefinition } from './privilege_utils';
+import { isGlobalPrivilegeDefinition } from './privilege_utils';
 
 describe('isGlobalPrivilegeDefinition', () => {
   it('returns true if no spaces are defined', () => {
@@ -47,39 +47,3 @@ describe('isGlobalPrivilegeDefinition', () => {
     ).toEqual(false);
   });
 });
-
-describe('hasAssignedFeaturePrivileges', () => {
-  it('returns false if no feature privileges are defined', () => {
-    expect(
-      hasAssignedFeaturePrivileges({
-        spaces: [],
-        base: [],
-        feature: {},
-      })
-    ).toEqual(false);
-  });
-
-  it('returns false if feature privileges are defined but not assigned', () => {
-    expect(
-      hasAssignedFeaturePrivileges({
-        spaces: [],
-        base: [],
-        feature: {
-          foo: [],
-        },
-      })
-    ).toEqual(false);
-  });
-
-  it('returns true if feature privileges are defined and assigned', () => {
-    expect(
-      hasAssignedFeaturePrivileges({
-        spaces: [],
-        base: [],
-        feature: {
-          foo: ['all'],
-        },
-      })
-    ).toEqual(true);
-  });
-});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privilege_utils.ts b/x-pack/plugins/security/public/management/roles/edit_role/privilege_utils.ts
index 3fd8536951967..1fad9057665da 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privilege_utils.ts
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privilege_utils.ts
@@ -16,12 +16,3 @@ export function isGlobalPrivilegeDefinition(privilegeSpec: RoleKibanaPrivilege):
   }
   return privilegeSpec.spaces.includes('*');
 }
-
-/**
- * Determines if the passed privilege spec defines feature privileges.
- * @param privilegeSpec
- */
-export function hasAssignedFeaturePrivileges(privilegeSpec: RoleKibanaPrivilege): boolean {
-  const featureKeys = Object.keys(privilegeSpec.feature);
-  return featureKeys.length > 0 && featureKeys.some(key => privilegeSpec.feature[key].length > 0);
-}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/__snapshots__/kibana_privileges_region.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/__snapshots__/kibana_privileges_region.test.tsx.snap
index 617335dc9fb34..a911455f95b5d 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/__snapshots__/kibana_privileges_region.test.tsx.snap
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/__snapshots__/kibana_privileges_region.test.tsx.snap
@@ -5,33 +5,17 @@ exports[`<KibanaPrivileges> renders without crashing 1`] = `
   iconType="logoKibana"
   title="Kibana"
 >
-  <InjectIntl(SpaceAwarePrivilegeSectionUI)
+  <SpaceAwarePrivilegeSection
+    canCustomizeSubFeaturePrivileges={true}
     editable={true}
-    features={Array []}
     kibanaPrivileges={
       KibanaPrivileges {
-        "rawKibanaPrivileges": Object {
-          "features": Object {},
-          "global": Object {},
-          "reserved": Object {},
-          "space": Object {},
-        },
+        "feature": Map {},
+        "global": Map {},
+        "spaces": Map {},
       }
     }
     onChange={[MockFunction]}
-    privilegeCalculatorFactory={
-      KibanaPrivilegeCalculatorFactory {
-        "kibanaPrivileges": KibanaPrivileges {
-          "rawKibanaPrivileges": Object {
-            "features": Object {},
-            "global": Object {},
-            "reserved": Object {},
-            "space": Object {},
-          },
-        },
-        "rankedFeaturePrivileges": Object {},
-      }
-    }
     role={
       Object {
         "elasticsearch": Object {
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/__fixtures__/index.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/__fixtures__/index.ts
new file mode 100644
index 0000000000000..440ed78f944ba
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/__fixtures__/index.ts
@@ -0,0 +1,76 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ReactWrapper } from 'enzyme';
+
+import {
+  EuiTableRow,
+  EuiCheckbox,
+  EuiCheckboxProps,
+  EuiButtonGroup,
+  EuiButtonGroupProps,
+} from '@elastic/eui';
+
+import { findTestSubject } from 'test_utils/find_test_subject';
+import { SubFeatureForm } from '../sub_feature_form';
+
+export function getDisplayedFeaturePrivileges(wrapper: ReactWrapper<any>) {
+  const allExpanderButtons = findTestSubject(wrapper, 'expandFeaturePrivilegeRow');
+  allExpanderButtons.forEach(button => button.simulate('click'));
+
+  // each expanded row renders its own `EuiTableRow`, so there are 2 rows
+  // for each feature: one for the primary feature privilege, and one for the sub privilege form
+  const rows = wrapper.find(EuiTableRow);
+
+  return rows.reduce((acc, row) => {
+    const subFeaturePrivileges = [];
+    const subFeatureForm = row.find(SubFeatureForm);
+    if (subFeatureForm.length > 0) {
+      const { featureId } = subFeatureForm.props();
+      const independentPrivileges = (subFeatureForm.find(EuiCheckbox) as ReactWrapper<
+        EuiCheckboxProps
+      >).reduce((acc2, checkbox) => {
+        const { id: privilegeId, checked } = checkbox.props();
+        return checked ? [...acc2, privilegeId] : acc2;
+      }, [] as string[]);
+
+      const mutuallyExclusivePrivileges = (subFeatureForm.find(EuiButtonGroup) as ReactWrapper<
+        EuiButtonGroupProps
+      >).reduce((acc2, subPrivButtonGroup) => {
+        const { idSelected: selectedSubPrivilege } = subPrivButtonGroup.props();
+        return selectedSubPrivilege && selectedSubPrivilege !== 'none'
+          ? [...acc2, selectedSubPrivilege]
+          : acc2;
+      }, [] as string[]);
+
+      subFeaturePrivileges.push(...independentPrivileges, ...mutuallyExclusivePrivileges);
+
+      return {
+        ...acc,
+        [featureId]: {
+          ...acc[featureId],
+          subFeaturePrivileges,
+        },
+      };
+    } else {
+      const buttonGroup = row.find(EuiButtonGroup);
+      const { name, idSelected } = buttonGroup.props();
+      expect(name).toBeDefined();
+      expect(idSelected).toBeDefined();
+
+      const featureId = name!.substr(`featurePrivilege_`.length);
+      const primaryFeaturePrivilege = idSelected!.substr(`${featureId}_`.length);
+
+      return {
+        ...acc,
+        [featureId]: {
+          ...acc[featureId],
+          primaryFeaturePrivilege,
+        },
+      };
+    }
+  }, {} as Record<string, { primaryFeaturePrivilege: string; subFeaturePrivileges: string[] }>);
+}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/__snapshots__/feature_table.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/__snapshots__/feature_table.test.tsx.snap
deleted file mode 100644
index 799ff205e2540..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/__snapshots__/feature_table.test.tsx.snap
+++ /dev/null
@@ -1,39 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`FeatureTable can render without spaces 1`] = `
-<EuiInMemoryTable
-  columns={
-    Array [
-      Object {
-        "field": "feature",
-        "name": "Feature",
-        "render": [Function],
-      },
-      Object {
-        "field": "privilege",
-        "name": <span>
-          <FormattedMessage
-            defaultMessage="Privilege"
-            id="xpack.security.management.editRole.featureTable.enabledRoleFeaturesEnabledColumnTitle"
-            values={Object {}}
-          />
-          <ChangeAllPrivilegesControl
-            onChange={[Function]}
-            privileges={
-              Array [
-                "all",
-                "read",
-                "none",
-              ]
-            }
-          />
-        </span>,
-        "render": [Function],
-      },
-    ]
-  }
-  items={Array []}
-  responsive={false}
-  tableLayout="fixed"
-/>
-`;
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/change_all_privileges.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/change_all_privileges.tsx
index c480f33b57899..2083778e53998 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/change_all_privileges.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/change_all_privileges.tsx
@@ -7,9 +7,11 @@ import { EuiContextMenuItem, EuiContextMenuPanel, EuiLink, EuiPopover } from '@e
 import { FormattedMessage } from '@kbn/i18n/react';
 import _ from 'lodash';
 import React, { Component } from 'react';
+import { KibanaPrivilege } from '../../../../model';
+import { NO_PRIVILEGE_VALUE } from '../constants';
 interface Props {
   onChange: (privilege: string) => void;
-  privileges: string[];
+  privileges: KibanaPrivilege[];
   disabled?: boolean;
 }
 
@@ -24,7 +26,11 @@ export class ChangeAllPrivilegesControl extends Component<Props, State> {
 
   public render() {
     const button = (
-      <EuiLink onClick={this.onButtonClick} className={'secPrivilegeFeatureChangeAllLink'}>
+      <EuiLink
+        onClick={this.onButtonClick}
+        className={'secPrivilegeFeatureChangeAllLink'}
+        data-test-subj="changeAllPrivilegesButton"
+      >
         <FormattedMessage
           id="xpack.security.management.editRole.changeAllPrivilegesLink"
           defaultMessage="(change all)"
@@ -35,17 +41,31 @@ export class ChangeAllPrivilegesControl extends Component<Props, State> {
     const items = this.props.privileges.map(privilege => {
       return (
         <EuiContextMenuItem
-          key={privilege}
+          key={privilege.id}
+          data-test-subj={`changeAllPrivileges-${privilege.id}`}
           onClick={() => {
-            this.onSelectPrivilege(privilege);
+            this.onSelectPrivilege(privilege.id);
           }}
           disabled={this.props.disabled}
         >
-          {_.capitalize(privilege)}
+          {_.capitalize(privilege.id)}
         </EuiContextMenuItem>
       );
     });
 
+    items.push(
+      <EuiContextMenuItem
+        key={NO_PRIVILEGE_VALUE}
+        data-test-subj={`changeAllPrivileges-${NO_PRIVILEGE_VALUE}`}
+        onClick={() => {
+          this.onSelectPrivilege(NO_PRIVILEGE_VALUE);
+        }}
+        disabled={this.props.disabled}
+      >
+        {_.capitalize(NO_PRIVILEGE_VALUE)}
+      </EuiContextMenuItem>
+    );
+
     return (
       <EuiPopover
         id={'changeAllFeaturePrivilegesPopover'}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table.test.tsx
index dea42e16f99d4..d974b336fac78 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table.test.tsx
@@ -3,145 +3,765 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { EuiInMemoryTable } from '@elastic/eui';
 import React from 'react';
-import { mountWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
-import { FeaturesPrivileges, KibanaPrivileges, Role } from '../../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from '../kibana_privilege_calculator';
 import { FeatureTable } from './feature_table';
+import { Role } from '../../../../../../../common/model';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { Feature, SubFeatureConfig } from '../../../../../../../../features/public';
+import { kibanaFeatures, createFeature } from '../../../../__fixtures__/kibana_features';
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import { getDisplayedFeaturePrivileges } from './__fixtures__';
+import { findTestSubject } from 'test_utils/find_test_subject';
+import { FeatureTableExpandedRow } from './feature_table_expanded_row';
 
-const defaultPrivilegeDefinition = new KibanaPrivileges({
-  global: {
-    all: ['api:/*', 'ui:/*'],
-    read: ['ui:/feature1/foo', 'ui:/feature2/foo'],
-  },
-  space: {
-    all: ['api:/*', 'ui:/*'],
-    read: ['ui:/feature1/foo', 'ui:/feature2/foo'],
-  },
-  features: {
-    feature1: {
-      all: ['ui:/feature1/foo', 'ui:/feature1/bar'],
-      read: ['ui:/feature1/foo'],
-    },
-    feature2: {
-      all: ['ui:/feature2/foo', 'api:/feature2/bar'],
-      read: ['ui:/feature2/foo'],
-    },
-    feature3: {
-      all: ['ui:/feature3/foo'],
-    },
-    feature4: {
-      all: ['somethingObsecure:/foo'],
-    },
-  },
-  reserved: {},
-});
-
-interface BuildRoleOpts {
-  globalPrivilege?: {
-    base: string[];
-    feature: FeaturesPrivileges;
+const createRole = (kibana: Role['kibana'] = []): Role => {
+  return {
+    name: 'my_role',
+    elasticsearch: { cluster: [], run_as: [], indices: [] },
+    kibana,
   };
-  spacesPrivileges?: Array<{
-    spaces: string[];
-    base: string[];
-    feature: FeaturesPrivileges;
-  }>;
+};
+
+interface TestConfig {
+  features: Feature[];
+  role: Role;
+  privilegeIndex: number;
+  calculateDisplayedPrivileges: boolean;
+  canCustomizeSubFeaturePrivileges: boolean;
 }
-const buildRole = (options: BuildRoleOpts = {}) => {
-  const role: Role = {
-    name: 'unit test role',
-    elasticsearch: {
-      indices: [],
-      cluster: [],
-      run_as: [],
-    },
-    kibana: [],
+const setup = (config: TestConfig) => {
+  const kibanaPrivileges = createKibanaPrivileges(config.features, {
+    allowSubFeaturePrivileges: config.canCustomizeSubFeaturePrivileges,
+  });
+  const calculator = new PrivilegeFormCalculator(kibanaPrivileges, config.role);
+  const onChange = jest.fn();
+  const onChangeAll = jest.fn();
+  const wrapper = mountWithIntl(
+    <FeatureTable
+      role={config.role}
+      privilegeCalculator={calculator}
+      kibanaPrivileges={kibanaPrivileges}
+      onChange={onChange}
+      onChangeAll={onChangeAll}
+      canCustomizeSubFeaturePrivileges={config.canCustomizeSubFeaturePrivileges}
+      privilegeIndex={config.privilegeIndex}
+    />
+  );
+
+  const displayedPrivileges = config.calculateDisplayedPrivileges
+    ? getDisplayedFeaturePrivileges(wrapper)
+    : undefined;
+
+  return {
+    wrapper,
+    onChange,
+    onChangeAll,
+    displayedPrivileges,
   };
+};
+
+describe('FeatureTable', () => {
+  [true, false].forEach(canCustomizeSubFeaturePrivileges => {
+    describe(`with sub feature privileges ${
+      canCustomizeSubFeaturePrivileges ? 'allowed' : 'disallowed'
+    }`, () => {
+      it('renders with no granted privileges for an empty role', () => {
+        const role = createRole([
+          {
+            spaces: [],
+            base: [],
+            feature: {},
+          },
+        ]);
+
+        const { displayedPrivileges } = setup({
+          role,
+          features: kibanaFeatures,
+          privilegeIndex: 0,
+          calculateDisplayedPrivileges: true,
+          canCustomizeSubFeaturePrivileges,
+        });
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            primaryFeaturePrivilege: 'none',
+            ...(canCustomizeSubFeaturePrivileges ? { subFeaturePrivileges: [] } : {}),
+          },
+          no_sub_features: {
+            primaryFeaturePrivilege: 'none',
+          },
+          with_excluded_sub_features: {
+            primaryFeaturePrivilege: 'none',
+            ...(canCustomizeSubFeaturePrivileges ? { subFeaturePrivileges: [] } : {}),
+          },
+          with_sub_features: {
+            primaryFeaturePrivilege: 'none',
+            ...(canCustomizeSubFeaturePrivileges ? { subFeaturePrivileges: [] } : {}),
+          },
+        });
+      });
+
+      it('renders with all included privileges granted at the space when space base privilege is "all"', () => {
+        const role = createRole([
+          {
+            spaces: ['*'],
+            base: ['read'],
+            feature: {},
+          },
+          {
+            spaces: ['foo'],
+            base: ['all'],
+            feature: {},
+          },
+        ]);
+        const { displayedPrivileges } = setup({
+          role,
+          features: kibanaFeatures,
+          privilegeIndex: 1,
+          calculateDisplayedPrivileges: true,
+          canCustomizeSubFeaturePrivileges,
+        });
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            primaryFeaturePrivilege: 'none',
+            ...(canCustomizeSubFeaturePrivileges ? { subFeaturePrivileges: [] } : {}),
+          },
+          no_sub_features: {
+            primaryFeaturePrivilege: 'all',
+          },
+          with_excluded_sub_features: {
+            primaryFeaturePrivilege: 'all',
+            ...(canCustomizeSubFeaturePrivileges ? { subFeaturePrivileges: [] } : {}),
+          },
+          with_sub_features: {
+            primaryFeaturePrivilege: 'all',
+            ...(canCustomizeSubFeaturePrivileges
+              ? {
+                  subFeaturePrivileges: [
+                    'with_sub_features_cool_toggle_1',
+                    'with_sub_features_cool_toggle_2',
+                    'cool_all',
+                  ],
+                }
+              : {}),
+          },
+        });
+      });
+
+      it('renders the most permissive primary feature privilege when multiple are assigned', () => {
+        const role = createRole([
+          {
+            spaces: ['*'],
+            base: ['read'],
+            feature: {},
+          },
+          {
+            spaces: ['foo'],
+            base: [],
+            feature: {
+              with_sub_features: ['read', 'minimal_all', 'all', 'minimal_read'],
+            },
+          },
+        ]);
+        const { displayedPrivileges } = setup({
+          role,
+          features: kibanaFeatures,
+          privilegeIndex: 1,
+          calculateDisplayedPrivileges: true,
+          canCustomizeSubFeaturePrivileges,
+        });
 
-  if (options.globalPrivilege) {
-    role.kibana.push({
-      spaces: ['*'],
-      ...options.globalPrivilege,
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            primaryFeaturePrivilege: 'none',
+            ...(canCustomizeSubFeaturePrivileges ? { subFeaturePrivileges: [] } : {}),
+          },
+          no_sub_features: {
+            primaryFeaturePrivilege: 'none',
+          },
+          with_excluded_sub_features: {
+            primaryFeaturePrivilege: 'none',
+            ...(canCustomizeSubFeaturePrivileges ? { subFeaturePrivileges: [] } : {}),
+          },
+          with_sub_features: {
+            primaryFeaturePrivilege: 'all',
+            ...(canCustomizeSubFeaturePrivileges
+              ? {
+                  subFeaturePrivileges: [
+                    'with_sub_features_cool_toggle_1',
+                    'with_sub_features_cool_toggle_2',
+                    'cool_all',
+                  ],
+                }
+              : {}),
+          },
+        });
+      });
+
+      it('allows all feature privileges to be toggled via "change all"', () => {
+        const role = createRole([
+          {
+            spaces: ['foo'],
+            base: [],
+            feature: {},
+          },
+        ]);
+        const { wrapper, onChangeAll } = setup({
+          role,
+          features: kibanaFeatures,
+          privilegeIndex: 0,
+          calculateDisplayedPrivileges: false,
+          canCustomizeSubFeaturePrivileges,
+        });
+
+        findTestSubject(wrapper, 'changeAllPrivilegesButton').simulate('click');
+        findTestSubject(wrapper, 'changeAllPrivileges-read').simulate('click');
+
+        expect(onChangeAll).toHaveBeenCalledWith(['read']);
+      });
+
+      it('allows all feature privileges to be unassigned via "change all"', () => {
+        const role = createRole([
+          {
+            spaces: ['foo'],
+            base: [],
+            feature: {
+              with_sub_features: ['all'],
+              no_sub_features: ['read'],
+              with_excluded_sub_features: ['all', 'something else'],
+            },
+          },
+        ]);
+        const { wrapper, onChangeAll } = setup({
+          role,
+          features: kibanaFeatures,
+          privilegeIndex: 0,
+          calculateDisplayedPrivileges: false,
+          canCustomizeSubFeaturePrivileges,
+        });
+
+        findTestSubject(wrapper, 'changeAllPrivilegesButton').simulate('click');
+        findTestSubject(wrapper, 'changeAllPrivileges-none').simulate('click');
+
+        expect(onChangeAll).toHaveBeenCalledWith([]);
+      });
+    });
+  });
+
+  it('renders the most permissive sub-feature privilege when multiple are assigned in a mutually-exclusive group', () => {
+    const role = createRole([
+      {
+        spaces: ['*'],
+        base: ['read'],
+        feature: {},
+      },
+      {
+        spaces: ['foo'],
+        base: [],
+        feature: {
+          with_sub_features: ['minimal_read', 'cool_all', 'cool_read'],
+        },
+      },
+    ]);
+    const { displayedPrivileges } = setup({
+      role,
+      features: kibanaFeatures,
+      privilegeIndex: 1,
+      calculateDisplayedPrivileges: true,
+      canCustomizeSubFeaturePrivileges: true,
     });
-  }
 
-  if (options.spacesPrivileges) {
-    role.kibana.push(...options.spacesPrivileges);
-  }
+    expect(displayedPrivileges).toEqual({
+      excluded_from_base: {
+        primaryFeaturePrivilege: 'none',
+        subFeaturePrivileges: [],
+      },
+      no_sub_features: {
+        primaryFeaturePrivilege: 'none',
+      },
+      with_excluded_sub_features: {
+        primaryFeaturePrivilege: 'none',
+        subFeaturePrivileges: [],
+      },
+      with_sub_features: {
+        primaryFeaturePrivilege: 'read',
+        subFeaturePrivileges: ['cool_all'],
+      },
+    });
+  });
 
-  return role;
-};
+  it('renders a row expander only for features with sub-features', () => {
+    const role = createRole([
+      {
+        spaces: ['*'],
+        base: ['read'],
+        feature: {},
+      },
+      {
+        spaces: ['foo'],
+        base: [],
+        feature: {},
+      },
+    ]);
+    const { wrapper } = setup({
+      role,
+      features: kibanaFeatures,
+      privilegeIndex: 1,
+      calculateDisplayedPrivileges: false,
+      canCustomizeSubFeaturePrivileges: true,
+    });
 
-const buildFeatures = () => {
-  return [];
-};
+    kibanaFeatures.forEach(feature => {
+      const rowExpander = findTestSubject(wrapper, `expandFeaturePrivilegeRow-${feature.id}`);
+      if (!feature.subFeatures || feature.subFeatures.length === 0) {
+        expect(rowExpander).toHaveLength(0);
+      } else {
+        expect(rowExpander).toHaveLength(1);
+      }
+    });
+  });
 
-describe('FeatureTable', () => {
-  it('can render without spaces', () => {
-    const role = buildRole({
-      spacesPrivileges: [
+  it('renders the <FeatureTableExpandedRow> when the row is expanded', () => {
+    const role = createRole([
+      {
+        spaces: ['*'],
+        base: ['read'],
+        feature: {},
+      },
+      {
+        spaces: ['foo'],
+        base: [],
+        feature: {},
+      },
+    ]);
+    const { wrapper } = setup({
+      role,
+      features: kibanaFeatures,
+      privilegeIndex: 1,
+      calculateDisplayedPrivileges: false,
+      canCustomizeSubFeaturePrivileges: true,
+    });
+
+    expect(wrapper.find(FeatureTableExpandedRow)).toHaveLength(0);
+
+    findTestSubject(wrapper, 'expandFeaturePrivilegeRow')
+      .first()
+      .simulate('click');
+
+    expect(wrapper.find(FeatureTableExpandedRow)).toHaveLength(1);
+  });
+
+  it('renders with sub-feature privileges granted when primary feature privilege is "all"', () => {
+    const role = createRole([
+      {
+        spaces: ['*'],
+        base: ['read'],
+        feature: {
+          unit_test: ['all'],
+        },
+      },
+    ]);
+    const feature = createFeature({
+      id: 'unit_test',
+      name: 'Unit Test Feature',
+      subFeatures: [
         {
-          spaces: ['marketing', 'default'],
-          base: ['read'],
-          feature: {
-            feature1: ['all'],
-          },
+          name: 'Some Sub Feature',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-toggle-1',
+                  name: 'Sub Toggle 1',
+                  includeIn: 'all',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-toggle-1'],
+                },
+                {
+                  id: 'sub-toggle-2',
+                  name: 'Sub Toggle 2',
+                  includeIn: 'read',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-toggle-2'],
+                },
+              ],
+            },
+            {
+              groupType: 'mutually_exclusive',
+              privileges: [
+                {
+                  id: 'sub-option-1',
+                  name: 'Sub Option 1',
+                  includeIn: 'all',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-option-1'],
+                },
+                {
+                  id: 'sub-toggle-2',
+                  name: 'Sub Toggle 2',
+                  includeIn: 'read',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-option-2'],
+                },
+              ],
+            },
+          ],
+        },
+      ] as SubFeatureConfig[],
+    });
+
+    const { displayedPrivileges } = setup({
+      role,
+      features: [feature],
+      privilegeIndex: 0,
+      calculateDisplayedPrivileges: true,
+      canCustomizeSubFeaturePrivileges: true,
+    });
+    expect(displayedPrivileges).toEqual({
+      unit_test: {
+        primaryFeaturePrivilege: 'all',
+        subFeaturePrivileges: ['unit_test_sub-toggle-1', 'unit_test_sub-toggle-2', 'sub-option-1'],
+      },
+    });
+  });
+
+  it('renders with some sub-feature privileges granted when primary feature privilege is "read"', () => {
+    const role = createRole([
+      {
+        spaces: ['*'],
+        base: ['read'],
+        feature: {
+          unit_test: ['read'],
+        },
+      },
+    ]);
+    const feature = createFeature({
+      id: 'unit_test',
+      name: 'Unit Test Feature',
+      subFeatures: [
+        {
+          name: 'Some Sub Feature',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-toggle-1',
+                  name: 'Sub Toggle 1',
+                  includeIn: 'all',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-toggle-1'],
+                },
+                {
+                  id: 'sub-toggle-2',
+                  name: 'Sub Toggle 2',
+                  includeIn: 'read',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-toggle-2'],
+                },
+              ],
+            },
+            {
+              groupType: 'mutually_exclusive',
+              privileges: [
+                {
+                  id: 'sub-option-1',
+                  name: 'Sub Option 1',
+                  includeIn: 'all',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-option-1'],
+                },
+                {
+                  id: 'sub-toggle-2',
+                  name: 'Sub Toggle 2',
+                  includeIn: 'read',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-option-2'],
+                },
+              ],
+            },
+          ],
+        },
+      ] as SubFeatureConfig[],
+    });
+
+    const { displayedPrivileges } = setup({
+      role,
+      features: [feature],
+      privilegeIndex: 0,
+      calculateDisplayedPrivileges: true,
+      canCustomizeSubFeaturePrivileges: true,
+    });
+    expect(displayedPrivileges).toEqual({
+      unit_test: {
+        primaryFeaturePrivilege: 'read',
+        subFeaturePrivileges: ['unit_test_sub-toggle-2', 'sub-toggle-2'],
+      },
+    });
+  });
+
+  it('renders with excluded sub-feature privileges not granted when primary feature privilege is "all"', () => {
+    const role = createRole([
+      {
+        spaces: ['*'],
+        base: ['read'],
+        feature: {
+          unit_test: ['all'],
+        },
+      },
+    ]);
+    const feature = createFeature({
+      id: 'unit_test',
+      name: 'Unit Test Feature',
+      subFeatures: [
+        {
+          name: 'Some Sub Feature',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-toggle-1',
+                  name: 'Sub Toggle 1',
+                  includeIn: 'none',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-toggle-1'],
+                },
+                {
+                  id: 'sub-toggle-2',
+                  name: 'Sub Toggle 2',
+                  includeIn: 'none',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-toggle-2'],
+                },
+              ],
+            },
+            {
+              groupType: 'mutually_exclusive',
+              privileges: [
+                {
+                  id: 'sub-option-1',
+                  name: 'Sub Option 1',
+                  includeIn: 'all',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-option-1'],
+                },
+                {
+                  id: 'sub-toggle-2',
+                  name: 'Sub Toggle 2',
+                  includeIn: 'read',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-option-2'],
+                },
+              ],
+            },
+          ],
+        },
+      ] as SubFeatureConfig[],
+    });
+
+    const { displayedPrivileges } = setup({
+      role,
+      features: [feature],
+      privilegeIndex: 0,
+      calculateDisplayedPrivileges: true,
+      canCustomizeSubFeaturePrivileges: true,
+    });
+    expect(displayedPrivileges).toEqual({
+      unit_test: {
+        primaryFeaturePrivilege: 'all',
+        subFeaturePrivileges: ['unit_test_sub-toggle-2', 'sub-option-1'],
+      },
+    });
+  });
+
+  it('renders with excluded sub-feature privileges granted when explicitly assigned', () => {
+    const role = createRole([
+      {
+        spaces: ['*'],
+        base: ['read'],
+        feature: {
+          unit_test: ['all', 'sub-toggle-1'],
+        },
+      },
+    ]);
+    const feature = createFeature({
+      id: 'unit_test',
+      name: 'Unit Test Feature',
+      subFeatures: [
+        {
+          name: 'Some Sub Feature',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-toggle-1',
+                  name: 'Sub Toggle 1',
+                  includeIn: 'none',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-toggle-1'],
+                },
+                {
+                  id: 'sub-toggle-2',
+                  name: 'Sub Toggle 2',
+                  includeIn: 'none',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-toggle-2'],
+                },
+              ],
+            },
+            {
+              groupType: 'mutually_exclusive',
+              privileges: [
+                {
+                  id: 'sub-option-1',
+                  name: 'Sub Option 1',
+                  includeIn: 'all',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-option-1'],
+                },
+                {
+                  id: 'sub-toggle-2',
+                  name: 'Sub Toggle 2',
+                  includeIn: 'read',
+                  savedObject: { all: [], read: [] },
+                  ui: ['sub-option-2'],
+                },
+              ],
+            },
+          ],
+        },
+      ] as SubFeatureConfig[],
+    });
+
+    const { displayedPrivileges } = setup({
+      role,
+      features: [feature],
+      privilegeIndex: 0,
+      calculateDisplayedPrivileges: true,
+      canCustomizeSubFeaturePrivileges: true,
+    });
+    expect(displayedPrivileges).toEqual({
+      unit_test: {
+        primaryFeaturePrivilege: 'all',
+        subFeaturePrivileges: ['unit_test_sub-toggle-1', 'unit_test_sub-toggle-2', 'sub-option-1'],
+      },
+    });
+  });
+
+  it('renders with all included sub-feature privileges granted at the space when primary feature privileges are granted', () => {
+    const role = createRole([
+      {
+        spaces: ['*'],
+        base: ['read'],
+        feature: {},
+      },
+      {
+        spaces: ['foo'],
+        base: [],
+        feature: {
+          with_sub_features: ['all'],
         },
-      ],
-    });
-
-    const calculator = new KibanaPrivilegeCalculatorFactory(defaultPrivilegeDefinition).getInstance(
-      role
-    );
-
-    const wrapper = shallowWithIntl(
-      <FeatureTable
-        role={role}
-        kibanaPrivileges={defaultPrivilegeDefinition}
-        calculatedPrivileges={calculator.calculateEffectivePrivileges()[0]}
-        allowedPrivileges={calculator.calculateAllowedPrivileges()[0]}
-        rankedFeaturePrivileges={{
-          feature1: ['all', 'read'],
-          feature2: ['all', 'read'],
-          feature3: ['all'],
-          feature4: ['all'],
-        }}
-        features={buildFeatures()}
-        onChange={jest.fn()}
-        onChangeAll={jest.fn()}
-        spacesIndex={0}
-      />
-    );
-
-    expect(wrapper).toMatchSnapshot();
+      },
+    ]);
+    const { displayedPrivileges } = setup({
+      role,
+      features: kibanaFeatures,
+      privilegeIndex: 1,
+      calculateDisplayedPrivileges: true,
+      canCustomizeSubFeaturePrivileges: true,
+    });
+    expect(displayedPrivileges).toEqual({
+      excluded_from_base: {
+        primaryFeaturePrivilege: 'none',
+        subFeaturePrivileges: [],
+      },
+      no_sub_features: {
+        primaryFeaturePrivilege: 'none',
+      },
+      with_excluded_sub_features: {
+        primaryFeaturePrivilege: 'none',
+        subFeaturePrivileges: [],
+      },
+      with_sub_features: {
+        primaryFeaturePrivilege: 'all',
+        subFeaturePrivileges: [
+          'with_sub_features_cool_toggle_1',
+          'with_sub_features_cool_toggle_2',
+          'cool_all',
+        ],
+      },
+    });
   });
 
-  it('can render for a specific spaces entry', () => {
-    const role = buildRole();
-    const calculator = new KibanaPrivilegeCalculatorFactory(defaultPrivilegeDefinition).getInstance(
-      role
-    );
-    const wrapper = mountWithIntl(
-      <FeatureTable
-        role={role}
-        kibanaPrivileges={defaultPrivilegeDefinition}
-        calculatedPrivileges={calculator.calculateEffectivePrivileges()[0]}
-        allowedPrivileges={calculator.calculateAllowedPrivileges()[0]}
-        rankedFeaturePrivileges={{
-          feature1: ['all', 'read'],
-          feature2: ['all', 'read'],
-          feature3: ['all'],
-          feature4: ['all'],
-        }}
-        features={buildFeatures()}
-        onChange={jest.fn()}
-        onChangeAll={jest.fn()}
-        spacesIndex={-1}
-      />
-    );
-
-    expect(wrapper.find(EuiInMemoryTable)).toHaveLength(1);
+  it('renders with no privileges granted when minimal feature privileges are assigned, and sub-feature privileges are disallowed', () => {
+    const role = createRole([
+      {
+        spaces: ['foo'],
+        base: [],
+        feature: {
+          with_sub_features: ['minimal_all'],
+        },
+      },
+    ]);
+    const { displayedPrivileges } = setup({
+      role,
+      features: kibanaFeatures,
+      privilegeIndex: 0,
+      calculateDisplayedPrivileges: true,
+      canCustomizeSubFeaturePrivileges: false,
+    });
+
+    expect(displayedPrivileges).toEqual({
+      excluded_from_base: {
+        primaryFeaturePrivilege: 'none',
+      },
+      no_sub_features: {
+        primaryFeaturePrivilege: 'none',
+      },
+      with_excluded_sub_features: {
+        primaryFeaturePrivilege: 'none',
+      },
+      with_sub_features: {
+        primaryFeaturePrivilege: 'none',
+      },
+    });
+  });
+
+  it('renders with no privileges granted when sub feature privileges are assigned, and sub-feature privileges are disallowed', () => {
+    const role = createRole([
+      {
+        spaces: ['foo'],
+        base: [],
+        feature: {
+          with_sub_features: ['minimal_read', 'cool_all'],
+        },
+      },
+    ]);
+    const { displayedPrivileges } = setup({
+      role,
+      features: kibanaFeatures,
+      privilegeIndex: 0,
+      calculateDisplayedPrivileges: true,
+      canCustomizeSubFeaturePrivileges: false,
+    });
+
+    expect(displayedPrivileges).toEqual({
+      excluded_from_base: {
+        primaryFeaturePrivilege: 'none',
+      },
+      no_sub_features: {
+        primaryFeaturePrivilege: 'none',
+      },
+      with_excluded_sub_features: {
+        primaryFeaturePrivilege: 'none',
+      },
+      with_sub_features: {
+        primaryFeaturePrivilege: 'none',
+      },
+    });
   });
 });
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table.tsx
index 8283efe23260a..4610da95e9649 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table.tsx
@@ -4,103 +4,112 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import _ from 'lodash';
-import React, { Component } from 'react';
 import {
   EuiButtonGroup,
-  EuiIcon,
   EuiIconTip,
   EuiInMemoryTable,
   EuiText,
-  IconType,
+  EuiButtonIcon,
+  EuiFlexGroup,
+  EuiFlexItem,
 } from '@elastic/eui';
-import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { Feature } from '../../../../../../../../features/public';
-import { FeaturesPrivileges, KibanaPrivileges, Role } from '../../../../../../../common/model';
-import {
-  AllowedPrivilege,
-  CalculatedPrivilege,
-  PrivilegeExplanation,
-} from '../kibana_privilege_calculator';
-import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
-import { NO_PRIVILEGE_VALUE } from '../constants';
-import { PrivilegeDisplay } from '../space_aware_privilege_section/privilege_display';
+import { i18n } from '@kbn/i18n';
+import _ from 'lodash';
+import React, { Component } from 'react';
+import { Role } from '../../../../../../../common/model';
 import { ChangeAllPrivilegesControl } from './change_all_privileges';
+import { FeatureTableExpandedRow } from './feature_table_expanded_row';
+import { NO_PRIVILEGE_VALUE } from '../constants';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import { FeatureTableCell } from '../feature_table_cell';
+import { KibanaPrivileges, SecuredFeature, KibanaPrivilege } from '../../../../model';
 
 interface Props {
   role: Role;
-  features: Feature[];
-  calculatedPrivileges: CalculatedPrivilege;
-  allowedPrivileges: AllowedPrivilege;
-  rankedFeaturePrivileges: FeaturesPrivileges;
+  privilegeCalculator: PrivilegeFormCalculator;
   kibanaPrivileges: KibanaPrivileges;
-  spacesIndex: number;
+  privilegeIndex: number;
   onChange: (featureId: string, privileges: string[]) => void;
   onChangeAll: (privileges: string[]) => void;
+  canCustomizeSubFeaturePrivileges: boolean;
   disabled?: boolean;
 }
 
-interface TableFeature extends Feature {
-  hasAnyPrivilegeAssigned: boolean;
+interface State {
+  expandedFeatures: string[];
 }
 
 interface TableRow {
-  feature: TableFeature;
+  featureId: string;
+  feature: SecuredFeature;
+  inherited: KibanaPrivilege[];
+  effective: KibanaPrivilege[];
   role: Role;
 }
 
-export class FeatureTable extends Component<Props, {}> {
+export class FeatureTable extends Component<Props, State> {
   public static defaultProps = {
-    spacesIndex: -1,
+    privilegeIndex: -1,
     showLocks: true,
   };
 
+  constructor(props: Props) {
+    super(props);
+    this.state = {
+      expandedFeatures: [],
+    };
+  }
+
   public render() {
-    const { role, features, calculatedPrivileges, rankedFeaturePrivileges } = this.props;
+    const { role, kibanaPrivileges } = this.props;
+
+    const featurePrivileges = kibanaPrivileges.getSecuredFeatures();
 
-    const items: TableRow[] = features
+    const items: TableRow[] = featurePrivileges
       .sort((feature1, feature2) => {
-        if (
-          Object.keys(feature1.privileges).length === 0 &&
-          Object.keys(feature2.privileges).length > 0
-        ) {
+        if (feature1.reserved && !feature2.reserved) {
           return 1;
         }
 
-        if (
-          Object.keys(feature2.privileges).length === 0 &&
-          Object.keys(feature1.privileges).length > 0
-        ) {
+        if (feature2.reserved && !feature1.reserved) {
           return -1;
         }
 
         return 0;
       })
       .map(feature => {
-        const calculatedFeaturePrivileges = calculatedPrivileges.feature[feature.id];
-        const hasAnyPrivilegeAssigned = Boolean(
-          calculatedFeaturePrivileges &&
-            calculatedFeaturePrivileges.actualPrivilege !== NO_PRIVILEGE_VALUE
-        );
         return {
-          feature: {
-            ...feature,
-            hasAnyPrivilegeAssigned,
-          },
+          featureId: feature.id,
+          feature,
+          inherited: [],
+          effective: [],
           role,
         };
       });
 
-    // TODO: This simply grabs the available privileges from the first feature we encounter.
-    // As of now, features can have 'all' and 'read' as available privileges. Once that assumption breaks,
-    // this will need updating. This is a simplifying measure to enable the new UI.
-    const availablePrivileges = Object.values(rankedFeaturePrivileges)[0];
-
     return (
       <EuiInMemoryTable
         responsive={false}
-        columns={this.getColumns(availablePrivileges)}
+        columns={this.getColumns()}
+        itemId={'featureId'}
+        itemIdToExpandedRowMap={this.state.expandedFeatures.reduce((acc, featureId) => {
+          return {
+            ...acc,
+            [featureId]: (
+              <FeatureTableExpandedRow
+                feature={featurePrivileges.find(f => f.id === featureId)!}
+                privilegeIndex={this.props.privilegeIndex}
+                onChange={this.props.onChange}
+                privilegeCalculator={this.props.privilegeCalculator}
+                selectedFeaturePrivileges={
+                  this.props.role.kibana[this.props.privilegeIndex].feature[featureId] ?? []
+                }
+                disabled={this.props.disabled}
+              />
+            ),
+          };
+        }, {})}
         items={items}
       />
     );
@@ -115,171 +124,157 @@ export class FeatureTable extends Component<Props, {}> {
     }
   };
 
-  private getColumns = (availablePrivileges: string[]) => [
-    {
-      field: 'feature',
-      name: i18n.translate(
-        'xpack.security.management.editRole.featureTable.enabledRoleFeaturesFeatureColumnTitle',
-        { defaultMessage: 'Feature' }
-      ),
-      render: (feature: TableFeature) => {
-        let tooltipElement = null;
-        if (feature.privilegesTooltip) {
-          const tooltipContent = (
-            <EuiText>
-              <p>{feature.privilegesTooltip}</p>
-            </EuiText>
-          );
-          tooltipElement = (
-            <EuiIconTip
-              iconProps={{
-                className: 'eui-alignTop',
-              }}
-              type={'iInCircle'}
-              color={'subdued'}
-              content={tooltipContent}
+  private getColumns = () => {
+    const basePrivileges = this.props.kibanaPrivileges.getBasePrivileges(
+      this.props.role.kibana[this.props.privilegeIndex]
+    );
+
+    const columns = [];
+
+    if (this.props.canCustomizeSubFeaturePrivileges) {
+      columns.push({
+        width: '30px',
+        isExpander: true,
+        field: 'featureId',
+        name: '',
+        render: (featureId: string, record: TableRow) => {
+          const { feature } = record;
+          const hasSubFeaturePrivileges = feature.getSubFeaturePrivileges().length > 0;
+          if (!hasSubFeaturePrivileges) {
+            return null;
+          }
+          return (
+            <EuiButtonIcon
+              onClick={() => this.toggleExpandedFeature(featureId)}
+              data-test-subj={`expandFeaturePrivilegeRow expandFeaturePrivilegeRow-${featureId}`}
+              aria-label={this.state.expandedFeatures.includes(featureId) ? 'Collapse' : 'Expand'}
+              iconType={this.state.expandedFeatures.includes(featureId) ? 'arrowUp' : 'arrowDown'}
             />
           );
-        }
+        },
+      });
+    }
 
-        return (
-          <span>
-            <EuiIcon size="m" type={feature.icon as IconType} className="secPrivilegeFeatureIcon" />
-            {feature.name} {tooltipElement}
-          </span>
-        );
+    columns.push(
+      {
+        field: 'feature',
+        width: '200px',
+        name: i18n.translate(
+          'xpack.security.management.editRole.featureTable.enabledRoleFeaturesFeatureColumnTitle',
+          {
+            defaultMessage: 'Feature',
+          }
+        ),
+        render: (feature: SecuredFeature) => {
+          return <FeatureTableCell feature={feature} />;
+        },
       },
-    },
-    {
-      field: 'privilege',
-      name: (
-        <span>
-          <FormattedMessage
-            id="xpack.security.management.editRole.featureTable.enabledRoleFeaturesEnabledColumnTitle"
-            defaultMessage="Privilege"
-          />
-          {!this.props.disabled && (
-            <ChangeAllPrivilegesControl
-              privileges={[...availablePrivileges, NO_PRIVILEGE_VALUE]}
-              onChange={this.onChangeAllFeaturePrivileges}
-            />
-          )}
-        </span>
-      ),
-      render: (roleEntry: Role, record: TableRow) => {
-        const { id: featureId, name: featureName, reserved, privileges } = record.feature;
-
-        if (reserved && Object.keys(privileges).length === 0) {
-          return <EuiText size={'s'}>{reserved.description}</EuiText>;
-        }
-
-        const featurePrivileges = this.props.kibanaPrivileges
-          .getFeaturePrivileges()
-          .getPrivileges(featureId);
-
-        if (featurePrivileges.length === 0) {
-          return null;
-        }
-
-        const enabledFeaturePrivileges = this.getEnabledFeaturePrivileges(
-          featurePrivileges,
-          featureId
-        );
-
-        const privilegeExplanation = this.getPrivilegeExplanation(featureId);
-
-        const allowsNone = this.allowsNoneForPrivilegeAssignment(featureId);
-
-        const actualPrivilegeValue = privilegeExplanation.actualPrivilege;
-
-        const canChangePrivilege =
-          !this.props.disabled && (allowsNone || enabledFeaturePrivileges.length > 1);
-
-        if (!canChangePrivilege) {
-          const assignedBasePrivilege =
-            this.props.role.kibana[this.props.spacesIndex].base.length > 0;
-
-          const excludedFromBasePrivilegsTooltip = (
+      {
+        field: 'privilege',
+        width: '200px',
+        name: (
+          <span>
             <FormattedMessage
-              id="xpack.security.management.editRole.featureTable.excludedFromBasePrivilegsTooltip"
-              defaultMessage='Use "Custom" privileges to grant access. {featureName} isn&apos;t part of the base privileges.'
-              values={{ featureName }}
+              id="xpack.security.management.editRole.featureTable.enabledRoleFeaturesEnabledColumnTitle"
+              defaultMessage="Privilege"
             />
+            {!this.props.disabled && (
+              <ChangeAllPrivilegesControl
+                privileges={basePrivileges}
+                onChange={this.onChangeAllFeaturePrivileges}
+              />
+            )}
+          </span>
+        ),
+        mobileOptions: {
+          // Table isn't responsive, so skip rendering this for mobile. <ChangeAllPrivilegesControl /> isn't free...
+          header: false,
+        },
+        render: (roleEntry: Role, record: TableRow) => {
+          const { feature } = record;
+
+          if (feature.reserved) {
+            return <EuiText size={'s'}>{feature.reserved.description}</EuiText>;
+          }
+
+          const primaryFeaturePrivileges = feature.getPrimaryFeaturePrivileges();
+
+          if (primaryFeaturePrivileges.length === 0) {
+            return null;
+          }
+
+          const selectedPrivilegeId = this.props.privilegeCalculator.getDisplayedPrimaryFeaturePrivilegeId(
+            feature.id,
+            this.props.privilegeIndex
           );
 
+          const options = primaryFeaturePrivileges.map(privilege => {
+            return {
+              id: `${feature.id}_${privilege.id}`,
+              label: privilege.name,
+              isDisabled: this.props.disabled,
+            };
+          });
+
+          options.push({
+            id: `${feature.id}_${NO_PRIVILEGE_VALUE}`,
+            label: 'None',
+            isDisabled: this.props.disabled,
+          });
+
+          let warningIcon = <EuiIconTip type="empty" content={null} />;
+          if (
+            this.props.privilegeCalculator.hasCustomizedSubFeaturePrivileges(
+              feature.id,
+              this.props.privilegeIndex
+            )
+          ) {
+            warningIcon = (
+              <EuiIconTip
+                type="iInCircle"
+                content={
+                  <FormattedMessage
+                    id="xpack.security.management.editRole.featureTable.privilegeCustomizationTooltip"
+                    defaultMessage="Feature has customized sub-feature privileges. Expand this row for more information."
+                  />
+                }
+              />
+            );
+          }
+
           return (
-            <PrivilegeDisplay
-              privilege={actualPrivilegeValue}
-              explanation={privilegeExplanation}
-              tooltipContent={
-                assignedBasePrivilege && actualPrivilegeValue === NO_PRIVILEGE_VALUE
-                  ? excludedFromBasePrivilegsTooltip
-                  : undefined
-              }
-            />
+            <EuiFlexGroup alignItems="center" gutterSize="xs">
+              <EuiFlexItem grow={false}>{warningIcon}</EuiFlexItem>
+              <EuiFlexItem>
+                <EuiButtonGroup
+                  name={`featurePrivilege_${feature.id}`}
+                  data-test-subj={`primaryFeaturePrivilegeControl`}
+                  buttonSize="compressed"
+                  color={'primary'}
+                  isFullWidth={true}
+                  options={options}
+                  idSelected={`${feature.id}_${selectedPrivilegeId ?? NO_PRIVILEGE_VALUE}`}
+                  onChange={this.onChange(feature.id)}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
           );
-        }
-
-        const options = availablePrivileges.map(priv => {
-          return {
-            id: `${featureId}_${priv}`,
-            label: _.capitalize(priv),
-            isDisabled: !enabledFeaturePrivileges.includes(priv),
-          };
-        });
-
-        options.push({
-          id: `${featureId}_${NO_PRIVILEGE_VALUE}`,
-          label: 'None',
-          isDisabled: !allowsNone,
-        });
-
-        return (
-          <EuiButtonGroup
-            name={`featurePrivilege_${featureId}`}
-            options={options}
-            idSelected={`${featureId}_${actualPrivilegeValue || NO_PRIVILEGE_VALUE}`}
-            onChange={this.onChange(featureId)}
-          />
-        );
-      },
-    },
-  ];
-
-  private getEnabledFeaturePrivileges = (featurePrivileges: string[], featureId: string) => {
-    const { allowedPrivileges } = this.props;
-
-    if (this.isConfiguringGlobalPrivileges()) {
-      // Global feature privileges are not limited by effective privileges.
-      return featurePrivileges;
-    }
-
-    const allowedFeaturePrivileges = allowedPrivileges.feature[featureId];
-    if (allowedFeaturePrivileges == null) {
-      throw new Error('Unable to get enabled feature privileges for a feature without privileges');
-    }
-
-    return allowedFeaturePrivileges.privileges;
-  };
-
-  private getPrivilegeExplanation = (featureId: string): PrivilegeExplanation => {
-    const { calculatedPrivileges } = this.props;
-    const calculatedFeaturePrivileges = calculatedPrivileges.feature[featureId];
-    if (calculatedFeaturePrivileges == null) {
-      throw new Error('Unable to get privilege explanation for a feature without privileges');
-    }
-
-    return calculatedFeaturePrivileges;
+        },
+      }
+    );
+    return columns;
   };
 
-  private allowsNoneForPrivilegeAssignment = (featureId: string): boolean => {
-    const { allowedPrivileges } = this.props;
-    const allowedFeaturePrivileges = allowedPrivileges.feature[featureId];
-    if (allowedFeaturePrivileges == null) {
-      throw new Error('Unable to determine if none is allowed for a feature without privileges');
+  private toggleExpandedFeature = (featureId: string) => {
+    if (this.state.expandedFeatures.includes(featureId)) {
+      this.setState({
+        expandedFeatures: this.state.expandedFeatures.filter(ef => ef !== featureId),
+      });
+    } else {
+      this.setState({
+        expandedFeatures: [...this.state.expandedFeatures, featureId],
+      });
     }
-
-    return allowedFeaturePrivileges.canUnassign;
   };
 
   private onChangeAllFeaturePrivileges = (privilege: string) => {
@@ -289,7 +284,4 @@ export class FeatureTable extends Component<Props, {}> {
       this.props.onChangeAll([privilege]);
     }
   };
-
-  private isConfiguringGlobalPrivileges = () =>
-    isGlobalPrivilegeDefinition(this.props.role.kibana[this.props.spacesIndex]);
 }
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table_expanded_row.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table_expanded_row.test.tsx
new file mode 100644
index 0000000000000..8897d89a39926
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table_expanded_row.test.tsx
@@ -0,0 +1,199 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { Role } from '../../../../../../../common/model';
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { kibanaFeatures } from '../../../../__fixtures__/kibana_features';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { FeatureTableExpandedRow } from './feature_table_expanded_row';
+import { findTestSubject } from 'test_utils/find_test_subject';
+import { act } from '@testing-library/react';
+
+const createRole = (kibana: Role['kibana'] = []): Role => {
+  return {
+    name: 'my_role',
+    elasticsearch: { cluster: [], run_as: [], indices: [] },
+    kibana,
+  };
+};
+
+describe('FeatureTableExpandedRow', () => {
+  it('indicates sub-feature privileges are being customized if a minimal feature privilege is set', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['minimal_read'],
+        },
+        spaces: ['foo'],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const feature = kibanaPrivileges.getSecuredFeature('with_sub_features');
+
+    const wrapper = mountWithIntl(
+      <FeatureTableExpandedRow
+        feature={feature}
+        privilegeIndex={0}
+        privilegeCalculator={calculator}
+        selectedFeaturePrivileges={['minimal_read']}
+        onChange={jest.fn()}
+      />
+    );
+
+    expect(
+      wrapper.find('EuiSwitch[data-test-subj="customizeSubFeaturePrivileges"]').props()
+    ).toMatchObject({
+      disabled: false,
+      checked: true,
+    });
+  });
+
+  it('indicates sub-feature privileges are not being customized if a primary feature privilege is set', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['read'],
+        },
+        spaces: ['foo'],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const feature = kibanaPrivileges.getSecuredFeature('with_sub_features');
+
+    const wrapper = mountWithIntl(
+      <FeatureTableExpandedRow
+        feature={feature}
+        privilegeIndex={0}
+        privilegeCalculator={calculator}
+        selectedFeaturePrivileges={['read']}
+        onChange={jest.fn()}
+      />
+    );
+
+    expect(
+      wrapper.find('EuiSwitch[data-test-subj="customizeSubFeaturePrivileges"]').props()
+    ).toMatchObject({
+      disabled: false,
+      checked: false,
+    });
+  });
+
+  it('does not allow customizing if a primary privilege is not set', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {},
+        spaces: ['foo'],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const feature = kibanaPrivileges.getSecuredFeature('with_sub_features');
+
+    const wrapper = mountWithIntl(
+      <FeatureTableExpandedRow
+        feature={feature}
+        privilegeIndex={0}
+        privilegeCalculator={calculator}
+        selectedFeaturePrivileges={['read']}
+        onChange={jest.fn()}
+      />
+    );
+
+    expect(
+      wrapper.find('EuiSwitch[data-test-subj="customizeSubFeaturePrivileges"]').props()
+    ).toMatchObject({
+      disabled: true,
+      checked: false,
+    });
+  });
+
+  it('switches to the minimal privilege when customizing privileges, including corresponding sub-feature privileges', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['read'],
+        },
+        spaces: ['foo'],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const feature = kibanaPrivileges.getSecuredFeature('with_sub_features');
+
+    const onChange = jest.fn();
+
+    const wrapper = mountWithIntl(
+      <FeatureTableExpandedRow
+        feature={feature}
+        privilegeIndex={0}
+        privilegeCalculator={calculator}
+        selectedFeaturePrivileges={['read']}
+        onChange={onChange}
+      />
+    );
+
+    act(() => {
+      findTestSubject(wrapper, 'customizeSubFeaturePrivileges').simulate('click');
+    });
+
+    expect(onChange).toHaveBeenCalledWith('with_sub_features', [
+      'minimal_read',
+      'cool_read',
+      'cool_toggle_2',
+    ]);
+  });
+
+  it('switches to the primary privilege when not customizing privileges, removing any other privileges', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['minimal_read', 'cool_read', 'cool_toggle_2'],
+        },
+        spaces: ['foo'],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const feature = kibanaPrivileges.getSecuredFeature('with_sub_features');
+
+    const onChange = jest.fn();
+
+    const wrapper = mountWithIntl(
+      <FeatureTableExpandedRow
+        feature={feature}
+        privilegeIndex={0}
+        privilegeCalculator={calculator}
+        selectedFeaturePrivileges={['minimal_read', 'cool_read', 'cool_toggle_2']}
+        onChange={onChange}
+      />
+    );
+
+    act(() => {
+      findTestSubject(wrapper, 'customizeSubFeaturePrivileges').simulate('click');
+    });
+
+    expect(onChange).toHaveBeenCalledWith('with_sub_features', ['read']);
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table_expanded_row.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table_expanded_row.tsx
new file mode 100644
index 0000000000000..fb302c2269485
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/feature_table_expanded_row.tsx
@@ -0,0 +1,95 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, useEffect } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiFlexItem, EuiFlexGroup, EuiSwitch, EuiSwitchEvent } from '@elastic/eui';
+import { SubFeatureForm } from './sub_feature_form';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import { SecuredFeature } from '../../../../model';
+
+interface Props {
+  feature: SecuredFeature;
+  privilegeCalculator: PrivilegeFormCalculator;
+  privilegeIndex: number;
+  selectedFeaturePrivileges: string[];
+  disabled?: boolean;
+  onChange: (featureId: string, featurePrivileges: string[]) => void;
+}
+
+export const FeatureTableExpandedRow = ({
+  feature,
+  onChange,
+  privilegeIndex,
+  privilegeCalculator,
+  selectedFeaturePrivileges,
+  disabled,
+}: Props) => {
+  const [isCustomizing, setIsCustomizing] = useState(() => {
+    return feature
+      .getMinimalFeaturePrivileges()
+      .some(p => selectedFeaturePrivileges.includes(p.id));
+  });
+
+  useEffect(() => {
+    const hasMinimalFeaturePrivilegeSelected = feature
+      .getMinimalFeaturePrivileges()
+      .some(p => selectedFeaturePrivileges.includes(p.id));
+
+    if (!hasMinimalFeaturePrivilegeSelected && isCustomizing) {
+      setIsCustomizing(false);
+    }
+  }, [feature, isCustomizing, selectedFeaturePrivileges]);
+
+  const onCustomizeSubFeatureChange = (e: EuiSwitchEvent) => {
+    onChange(
+      feature.id,
+      privilegeCalculator.updateSelectedFeaturePrivilegesForCustomization(
+        feature.id,
+        privilegeIndex,
+        e.target.checked
+      )
+    );
+    setIsCustomizing(e.target.checked);
+  };
+
+  return (
+    <EuiFlexGroup direction="column">
+      <EuiFlexItem>
+        <EuiSwitch
+          label={
+            <FormattedMessage
+              id="xpack.security.management.editRole.featureTable.customizeSubFeaturePrivilegesSwitchLabel"
+              defaultMessage="Customize sub-feature privileges"
+            />
+          }
+          checked={isCustomizing}
+          onChange={onCustomizeSubFeatureChange}
+          data-test-subj="customizeSubFeaturePrivileges"
+          disabled={
+            disabled ||
+            !privilegeCalculator.canCustomizeSubFeaturePrivileges(feature.id, privilegeIndex)
+          }
+        />
+      </EuiFlexItem>
+      {feature.getSubFeatures().map(subFeature => {
+        return (
+          <EuiFlexItem key={subFeature.name}>
+            <SubFeatureForm
+              privilegeCalculator={privilegeCalculator}
+              privilegeIndex={privilegeIndex}
+              featureId={feature.id}
+              subFeature={subFeature}
+              onChange={updatedPrivileges => onChange(feature.id, updatedPrivileges)}
+              selectedFeaturePrivileges={selectedFeaturePrivileges}
+              disabled={disabled || !isCustomizing}
+            />
+          </EuiFlexItem>
+        );
+      })}
+    </EuiFlexGroup>
+  );
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/sub_feature_form.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/sub_feature_form.test.tsx
new file mode 100644
index 0000000000000..ba7eff601f4c1
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/sub_feature_form.test.tsx
@@ -0,0 +1,237 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { kibanaFeatures } from '../../../../__fixtures__/kibana_features';
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { SecuredSubFeature } from '../../../../model';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import { Role } from '../../../../../../../common/model';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { SubFeatureForm } from './sub_feature_form';
+import { EuiCheckbox, EuiButtonGroup } from '@elastic/eui';
+import { act } from '@testing-library/react';
+
+// Note: these tests are not concerned with the proper display of privileges,
+// as that is verified by the feature_table and privilege_space_form tests.
+
+const createRole = (kibana: Role['kibana'] = []): Role => {
+  return {
+    name: 'my_role',
+    elasticsearch: { cluster: [], run_as: [], indices: [] },
+    kibana,
+  };
+};
+
+const featureId = 'with_sub_features';
+const subFeature = kibanaFeatures.find(kf => kf.id === featureId)!.subFeatures[0];
+const securedSubFeature = new SecuredSubFeature(subFeature.toRaw());
+
+describe('SubFeatureForm', () => {
+  it('renders disabled elements when requested', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {},
+        spaces: [],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const wrapper = mountWithIntl(
+      <SubFeatureForm
+        featureId={featureId}
+        subFeature={securedSubFeature}
+        selectedFeaturePrivileges={[]}
+        privilegeCalculator={calculator}
+        privilegeIndex={0}
+        onChange={jest.fn()}
+        disabled={true}
+      />
+    );
+
+    const checkboxes = wrapper.find(EuiCheckbox);
+    const buttonGroups = wrapper.find(EuiButtonGroup);
+
+    expect(checkboxes.everyWhere(checkbox => checkbox.props().disabled === true)).toBe(true);
+    expect(buttonGroups.everyWhere(checkbox => checkbox.props().isDisabled === true)).toBe(true);
+  });
+
+  it('fires onChange when an independent privilege is selected', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {},
+        spaces: [],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const onChange = jest.fn();
+
+    const wrapper = mountWithIntl(
+      <SubFeatureForm
+        featureId={featureId}
+        subFeature={securedSubFeature}
+        selectedFeaturePrivileges={[]}
+        privilegeCalculator={calculator}
+        privilegeIndex={0}
+        onChange={onChange}
+        disabled={false}
+      />
+    );
+
+    const checkbox = wrapper.find('EuiCheckbox[id="with_sub_features_cool_toggle_1"] input');
+
+    act(() => {
+      checkbox.simulate('change', { target: { checked: true } });
+    });
+
+    expect(onChange).toHaveBeenCalledWith(['cool_toggle_1']);
+  });
+
+  it('fires onChange when an independent privilege is deselected', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['cool_toggle_1', 'cool_toggle_2'],
+        },
+        spaces: [],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const onChange = jest.fn();
+
+    const wrapper = mountWithIntl(
+      <SubFeatureForm
+        featureId={featureId}
+        subFeature={securedSubFeature}
+        selectedFeaturePrivileges={['cool_toggle_1', 'cool_toggle_2']}
+        privilegeCalculator={calculator}
+        privilegeIndex={0}
+        onChange={onChange}
+        disabled={false}
+      />
+    );
+
+    const checkbox = wrapper.find('EuiCheckbox[id="with_sub_features_cool_toggle_1"] input');
+
+    act(() => {
+      checkbox.simulate('change', { target: { checked: false } });
+    });
+
+    expect(onChange).toHaveBeenCalledWith(['cool_toggle_2']);
+  });
+
+  it('fires onChange when a mutually exclusive privilege is selected', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {},
+        spaces: [],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const onChange = jest.fn();
+
+    const wrapper = mountWithIntl(
+      <SubFeatureForm
+        featureId={featureId}
+        subFeature={securedSubFeature}
+        selectedFeaturePrivileges={[]}
+        privilegeCalculator={calculator}
+        privilegeIndex={0}
+        onChange={onChange}
+        disabled={false}
+      />
+    );
+
+    const button = wrapper.find(EuiButtonGroup);
+
+    act(() => {
+      button.props().onChange('cool_all');
+    });
+
+    expect(onChange).toHaveBeenCalledWith(['cool_all']);
+  });
+
+  it('fires onChange when switching between mutually exclusive options', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {},
+        spaces: [],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const onChange = jest.fn();
+
+    const wrapper = mountWithIntl(
+      <SubFeatureForm
+        featureId={featureId}
+        subFeature={securedSubFeature}
+        selectedFeaturePrivileges={['cool_all', 'cool_toggle_1']}
+        privilegeCalculator={calculator}
+        privilegeIndex={0}
+        onChange={onChange}
+        disabled={false}
+      />
+    );
+
+    const button = wrapper.find(EuiButtonGroup);
+
+    act(() => {
+      button.props().onChange('cool_read');
+    });
+
+    expect(onChange).toHaveBeenCalledWith(['cool_toggle_1', 'cool_read']);
+  });
+
+  it('fires onChange when a mutually exclusive privilege is deselected', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['cool_all'],
+        },
+        spaces: [],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+    const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+    const onChange = jest.fn();
+
+    const wrapper = mountWithIntl(
+      <SubFeatureForm
+        featureId={featureId}
+        subFeature={securedSubFeature}
+        selectedFeaturePrivileges={['cool_all']}
+        privilegeCalculator={calculator}
+        privilegeIndex={0}
+        onChange={onChange}
+        disabled={false}
+      />
+    );
+
+    const button = wrapper.find(EuiButtonGroup);
+
+    act(() => {
+      button.props().onChange('none');
+    });
+
+    expect(onChange).toHaveBeenCalledWith([]);
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/sub_feature_form.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/sub_feature_form.tsx
new file mode 100644
index 0000000000000..d4b6721ddad05
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/sub_feature_form.tsx
@@ -0,0 +1,134 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiText, EuiCheckbox, EuiButtonGroup } from '@elastic/eui';
+
+import { NO_PRIVILEGE_VALUE } from '../constants';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import {
+  SecuredSubFeature,
+  SubFeaturePrivilegeGroup,
+  SubFeaturePrivilege,
+} from '../../../../model';
+
+interface Props {
+  featureId: string;
+  subFeature: SecuredSubFeature;
+  selectedFeaturePrivileges: string[];
+  privilegeCalculator: PrivilegeFormCalculator;
+  privilegeIndex: number;
+  onChange: (selectedPrivileges: string[]) => void;
+  disabled?: boolean;
+}
+
+export const SubFeatureForm = (props: Props) => {
+  return (
+    <EuiFlexGroup>
+      <EuiFlexItem>
+        <EuiText size="s">{props.subFeature.name}</EuiText>
+      </EuiFlexItem>
+      <EuiFlexItem>{props.subFeature.getPrivilegeGroups().map(renderPrivilegeGroup)}</EuiFlexItem>
+    </EuiFlexGroup>
+  );
+
+  function renderPrivilegeGroup(privilegeGroup: SubFeaturePrivilegeGroup, index: number) {
+    switch (privilegeGroup.groupType) {
+      case 'independent':
+        return renderIndependentPrivilegeGroup(privilegeGroup, index);
+      case 'mutually_exclusive':
+        return renderMutuallyExclusivePrivilegeGroup(privilegeGroup, index);
+      default:
+        throw new Error(`Unsupported privilege group type: ${privilegeGroup.groupType}`);
+    }
+  }
+
+  function renderIndependentPrivilegeGroup(
+    privilegeGroup: SubFeaturePrivilegeGroup,
+    index: number
+  ) {
+    return (
+      <div key={index}>
+        {privilegeGroup.privileges.map((privilege: SubFeaturePrivilege) => {
+          const isGranted = props.privilegeCalculator.isIndependentSubFeaturePrivilegeGranted(
+            props.featureId,
+            privilege.id,
+            props.privilegeIndex
+          );
+          return (
+            <EuiCheckbox
+              key={privilege.id}
+              id={`${props.featureId}_${privilege.id}`}
+              label={privilege.name}
+              data-test-subj="independentSubFeaturePrivilegeControl"
+              onChange={e => {
+                const { checked } = e.target;
+                if (checked) {
+                  props.onChange([...props.selectedFeaturePrivileges, privilege.id]);
+                } else {
+                  props.onChange(props.selectedFeaturePrivileges.filter(sp => sp !== privilege.id));
+                }
+              }}
+              checked={isGranted}
+              disabled={props.disabled}
+              compressed={true}
+            />
+          );
+        })}
+      </div>
+    );
+  }
+
+  function renderMutuallyExclusivePrivilegeGroup(
+    privilegeGroup: SubFeaturePrivilegeGroup,
+    index: number
+  ) {
+    const firstSelectedPrivilege = props.privilegeCalculator.getSelectedMutuallyExclusiveSubFeaturePrivilege(
+      props.featureId,
+      privilegeGroup,
+      props.privilegeIndex
+    );
+
+    const options = [
+      ...privilegeGroup.privileges.map((privilege, privilegeIndex) => {
+        return {
+          id: privilege.id,
+          label: privilege.name,
+          isDisabled: props.disabled,
+        };
+      }),
+    ];
+
+    options.push({
+      id: NO_PRIVILEGE_VALUE,
+      label: 'None',
+      isDisabled: props.disabled,
+    });
+
+    return (
+      <EuiButtonGroup
+        key={index}
+        buttonSize="compressed"
+        data-test-subj="mutexSubFeaturePrivilegeControl"
+        options={options}
+        idSelected={firstSelectedPrivilege?.id ?? NO_PRIVILEGE_VALUE}
+        isDisabled={props.disabled}
+        onChange={selectedPrivilegeId => {
+          // Deselect all privileges which belong to this mutually-exclusive group
+          const privilegesWithoutGroupEntries = props.selectedFeaturePrivileges.filter(
+            sp => !privilegeGroup.privileges.some(privilege => privilege.id === sp)
+          );
+          // fire on-change with the newly selected privilege
+          if (selectedPrivilegeId === NO_PRIVILEGE_VALUE) {
+            props.onChange(privilegesWithoutGroupEntries);
+          } else {
+            props.onChange([...privilegesWithoutGroupEntries, selectedPrivilegeId]);
+          }
+        }}
+      />
+    );
+  }
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table_cell/feature_table_cell.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table_cell/feature_table_cell.test.tsx
new file mode 100644
index 0000000000000..316818e4deed3
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table_cell/feature_table_cell.test.tsx
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { createFeature } from '../../../../__fixtures__/kibana_features';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { FeatureTableCell } from '.';
+import { SecuredFeature } from '../../../../model';
+import { EuiIcon, EuiIconTip } from '@elastic/eui';
+
+describe('FeatureTableCell', () => {
+  it('renders an icon and feature name', () => {
+    const feature = createFeature({
+      id: 'test-feature',
+      name: 'Test Feature',
+    });
+
+    const wrapper = mountWithIntl(
+      <FeatureTableCell feature={new SecuredFeature(feature.toRaw())} />
+    );
+
+    expect(wrapper.text()).toMatchInlineSnapshot(`"Test Feature "`);
+    expect(wrapper.find(EuiIcon).props()).toMatchObject({
+      type: feature.icon,
+    });
+    expect(wrapper.find(EuiIconTip)).toHaveLength(0);
+  });
+
+  it('renders an icon and feature name with tooltip when configured', () => {
+    const feature = createFeature({
+      id: 'test-feature',
+      name: 'Test Feature',
+      privilegesTooltip: 'This is my awesome tooltip content',
+    });
+
+    const wrapper = mountWithIntl(
+      <FeatureTableCell feature={new SecuredFeature(feature.toRaw())} />
+    );
+
+    expect(wrapper.text()).toMatchInlineSnapshot(`"Test Feature "`);
+    expect(
+      wrapper
+        .find(EuiIcon)
+        .first()
+        .props()
+    ).toMatchObject({
+      type: feature.icon,
+    });
+    expect(wrapper.find(EuiIconTip).props().content).toMatchInlineSnapshot(`
+      <EuiText>
+        <p>
+          This is my awesome tooltip content
+        </p>
+      </EuiText>
+    `);
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table_cell/feature_table_cell.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table_cell/feature_table_cell.tsx
new file mode 100644
index 0000000000000..9e4a3a8a99b56
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table_cell/feature_table_cell.tsx
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { EuiText, EuiIconTip, EuiIcon, IconType } from '@elastic/eui';
+import { SecuredFeature } from '../../../../model';
+
+interface Props {
+  feature: SecuredFeature;
+}
+
+export const FeatureTableCell = ({ feature }: Props) => {
+  let tooltipElement = null;
+  if (feature.getPrivilegesTooltip()) {
+    const tooltipContent = (
+      <EuiText>
+        <p>{feature.getPrivilegesTooltip()}</p>
+      </EuiText>
+    );
+    tooltipElement = (
+      <EuiIconTip
+        iconProps={{
+          className: 'eui-alignTop',
+        }}
+        type={'iInCircle'}
+        color={'subdued'}
+        content={tooltipContent}
+      />
+    );
+  }
+
+  return (
+    <span>
+      <EuiIcon size="m" type={feature.icon as IconType} className="secPrivilegeFeatureIcon" />
+      {feature.name} {tooltipElement}
+    </span>
+  );
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table_cell/index.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table_cell/index.ts
new file mode 100644
index 0000000000000..8f084fcc37c50
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table_cell/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { FeatureTableCell } from './feature_table_cell';
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/build_role.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/build_role.ts
deleted file mode 100644
index 70e48dcdc37f8..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/build_role.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { FeaturesPrivileges, Role } from '../../../../../../../../common/model';
-
-export interface BuildRoleOpts {
-  spacesPrivileges?: Array<{
-    spaces: string[];
-    base: string[];
-    feature: FeaturesPrivileges;
-  }>;
-}
-
-export const buildRole = (options: BuildRoleOpts = {}) => {
-  const role: Role = {
-    name: 'unit test role',
-    elasticsearch: {
-      indices: [],
-      cluster: [],
-      run_as: [],
-    },
-    kibana: [],
-  };
-
-  if (options.spacesPrivileges) {
-    role.kibana.push(...options.spacesPrivileges);
-  } else {
-    role.kibana.push({
-      spaces: [],
-      base: [],
-      feature: {},
-    });
-  }
-
-  return role;
-};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/common_allowed_privileges.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/common_allowed_privileges.ts
deleted file mode 100644
index ddab7eff6835e..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/common_allowed_privileges.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export const unrestrictedBasePrivileges = {
-  base: {
-    privileges: ['all', 'read'],
-    canUnassign: true,
-  },
-};
-export const unrestrictedFeaturePrivileges = {
-  feature: {
-    feature1: {
-      privileges: ['all', 'read'],
-      canUnassign: true,
-    },
-    feature2: {
-      privileges: ['all', 'read'],
-      canUnassign: true,
-    },
-    feature3: {
-      privileges: ['all'],
-      canUnassign: true,
-    },
-    feature4: {
-      privileges: ['all', 'read'],
-      canUnassign: true,
-    },
-  },
-};
-
-export const fullyRestrictedBasePrivileges = {
-  base: {
-    privileges: ['all'],
-    canUnassign: false,
-  },
-};
-
-export const fullyRestrictedFeaturePrivileges = {
-  feature: {
-    feature1: {
-      privileges: ['all'],
-      canUnassign: false,
-    },
-    feature2: {
-      privileges: ['all'],
-      canUnassign: false,
-    },
-    feature3: {
-      privileges: ['all'],
-      canUnassign: false,
-    },
-    feature4: {
-      privileges: ['all', 'read'],
-      canUnassign: false,
-    },
-  },
-};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/default_privilege_definition.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/default_privilege_definition.ts
deleted file mode 100644
index 0c794b68f95da..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/default_privilege_definition.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { KibanaPrivileges } from '../../../../../../../../common/model';
-
-export const defaultPrivilegeDefinition = new KibanaPrivileges({
-  global: {
-    all: ['api:/*', 'ui:/*'],
-    read: ['ui:/feature1/foo', 'ui:/feature2/foo', 'ui:/feature3/foo/*', 'ui:/feature4/foo'],
-  },
-  space: {
-    all: [
-      'api:/feature1/*',
-      'ui:/feature1/*',
-      'api:/feature2/*',
-      'ui:/feature2/*',
-      'ui:/feature3/foo',
-      'ui:/feature3/foo/*',
-      'ui:/feature4/foo',
-    ],
-    read: ['ui:/feature1/foo', 'ui:/feature2/foo', 'ui:/feature3/foo/bar', 'ui:/feature4/foo'],
-  },
-  features: {
-    feature1: {
-      all: ['ui:/feature1/foo', 'ui:/feature1/bar'],
-      read: ['ui:/feature1/foo'],
-    },
-    feature2: {
-      all: ['ui:/feature2/foo', 'api:/feature2/bar'],
-      read: ['ui:/feature2/foo'],
-    },
-    feature3: {
-      all: ['ui:/feature3/foo', 'ui:/feature3/foo/*'],
-    },
-    feature4: {
-      all: ['somethingObscure:/feature4/foo', 'ui:/feature4/foo'],
-      read: ['ui:/feature4/foo'],
-    },
-  },
-  reserved: {},
-});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/index.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/index.ts
deleted file mode 100644
index 253dcaed9f19e..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/__fixtures__/index.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-export { defaultPrivilegeDefinition } from './default_privilege_definition';
-export { buildRole, BuildRoleOpts } from './build_role';
-export * from './common_allowed_privileges';
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_allowed_privileges_calculator.test.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_allowed_privileges_calculator.test.ts
deleted file mode 100644
index 2a1c42838a83d..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_allowed_privileges_calculator.test.ts
+++ /dev/null
@@ -1,313 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import { KibanaPrivileges, Role } from '../../../../../../../common/model';
-import {
-  buildRole,
-  defaultPrivilegeDefinition,
-  fullyRestrictedBasePrivileges,
-  fullyRestrictedFeaturePrivileges,
-  unrestrictedBasePrivileges,
-  unrestrictedFeaturePrivileges,
-} from './__fixtures__';
-import { KibanaAllowedPrivilegesCalculator } from './kibana_allowed_privileges_calculator';
-import { KibanaPrivilegeCalculatorFactory } from './kibana_privileges_calculator_factory';
-
-const buildAllowedPrivilegesCalculator = (
-  role: Role,
-  kibanaPrivilege: KibanaPrivileges = defaultPrivilegeDefinition
-) => {
-  return new KibanaAllowedPrivilegesCalculator(kibanaPrivilege, role);
-};
-
-const buildEffectivePrivilegesCalculator = (
-  role: Role,
-  kibanaPrivileges: KibanaPrivileges = defaultPrivilegeDefinition
-) => {
-  const factory = new KibanaPrivilegeCalculatorFactory(kibanaPrivileges);
-  return factory.getInstance(role);
-};
-
-describe('AllowedPrivileges', () => {
-  it('allows all privileges when none are currently assigned', () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: [],
-          feature: {},
-        },
-        {
-          spaces: ['foo'],
-          base: [],
-          feature: {},
-        },
-      ],
-    });
-    const effectivePrivileges = buildEffectivePrivilegesCalculator(role);
-    const allowedPrivilegesCalculator = buildAllowedPrivilegesCalculator(role);
-
-    const result = allowedPrivilegesCalculator.calculateAllowedPrivileges(
-      effectivePrivileges.calculateEffectivePrivileges(true)
-    );
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...unrestrictedFeaturePrivileges,
-      },
-      {
-        ...unrestrictedBasePrivileges,
-        ...unrestrictedFeaturePrivileges,
-      },
-    ]);
-  });
-
-  it('allows all global base privileges, but just "all" for everything else when global is set to "all"', () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: ['all'],
-          feature: {},
-        },
-        {
-          spaces: ['foo'],
-          base: [],
-          feature: {},
-        },
-      ],
-    });
-    const effectivePrivileges = buildEffectivePrivilegesCalculator(role);
-    const allowedPrivilegesCalculator = buildAllowedPrivilegesCalculator(role);
-
-    const result = allowedPrivilegesCalculator.calculateAllowedPrivileges(
-      effectivePrivileges.calculateEffectivePrivileges(true)
-    );
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...fullyRestrictedFeaturePrivileges,
-      },
-      {
-        ...fullyRestrictedBasePrivileges,
-        ...fullyRestrictedFeaturePrivileges,
-      },
-    ]);
-  });
-
-  it(`allows feature privileges to be set to "all" or "read" when global base is "read"`, () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: ['read'],
-          feature: {},
-        },
-        {
-          spaces: ['foo'],
-          base: [],
-          feature: {},
-        },
-      ],
-    });
-    const effectivePrivileges = buildEffectivePrivilegesCalculator(role);
-    const allowedPrivilegesCalculator = buildAllowedPrivilegesCalculator(role);
-
-    const result = allowedPrivilegesCalculator.calculateAllowedPrivileges(
-      effectivePrivileges.calculateEffectivePrivileges(true)
-    );
-
-    const expectedFeaturePrivileges = {
-      feature: {
-        feature1: {
-          privileges: ['all', 'read'],
-          canUnassign: false,
-        },
-        feature2: {
-          privileges: ['all', 'read'],
-          canUnassign: false,
-        },
-        feature3: {
-          privileges: ['all'],
-          canUnassign: true, // feature 3 has no "read" privilege governed by global "all"
-        },
-        feature4: {
-          privileges: ['all', 'read'],
-          canUnassign: false,
-        },
-      },
-    };
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...expectedFeaturePrivileges,
-      },
-      {
-        base: {
-          privileges: ['all', 'read'],
-          canUnassign: false,
-        },
-        ...expectedFeaturePrivileges,
-      },
-    ]);
-  });
-
-  it(`allows feature privileges to be set to "all" or "read" when space base is "read"`, () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: [],
-          feature: {},
-        },
-        {
-          spaces: ['foo'],
-          base: ['read'],
-          feature: {},
-        },
-      ],
-    });
-    const effectivePrivileges = buildEffectivePrivilegesCalculator(role);
-    const allowedPrivilegesCalculator = buildAllowedPrivilegesCalculator(role);
-
-    const result = allowedPrivilegesCalculator.calculateAllowedPrivileges(
-      effectivePrivileges.calculateEffectivePrivileges(true)
-    );
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...unrestrictedFeaturePrivileges,
-      },
-      {
-        base: {
-          privileges: ['all', 'read'],
-          canUnassign: true,
-        },
-        feature: {
-          feature1: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-          feature2: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-          feature3: {
-            privileges: ['all'],
-            canUnassign: true, // feature 3 has no "read" privilege governed by space "all"
-          },
-          feature4: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-        },
-      },
-    ]);
-  });
-
-  it(`allows space base privilege to be set to "all" or "read" when space base is already "all"`, () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['foo'],
-          base: ['all'],
-          feature: {},
-        },
-      ],
-    });
-    const effectivePrivileges = buildEffectivePrivilegesCalculator(role);
-    const allowedPrivilegesCalculator = buildAllowedPrivilegesCalculator(role);
-
-    const result = allowedPrivilegesCalculator.calculateAllowedPrivileges(
-      effectivePrivileges.calculateEffectivePrivileges(true)
-    );
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        feature: {
-          feature1: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-          feature2: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-          feature3: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-          feature4: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-        },
-      },
-    ]);
-  });
-
-  it(`restricts space feature privileges when global feature privileges are set`, () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: [],
-          feature: {
-            feature1: ['all'],
-            feature2: ['read'],
-            feature4: ['all'],
-          },
-        },
-        {
-          spaces: ['foo'],
-          base: [],
-          feature: {},
-        },
-      ],
-    });
-    const effectivePrivileges = buildEffectivePrivilegesCalculator(role);
-    const allowedPrivilegesCalculator = buildAllowedPrivilegesCalculator(role);
-
-    const result = allowedPrivilegesCalculator.calculateAllowedPrivileges(
-      effectivePrivileges.calculateEffectivePrivileges(true)
-    );
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...unrestrictedFeaturePrivileges,
-      },
-      {
-        base: {
-          privileges: ['all', 'read'],
-          canUnassign: true,
-        },
-        feature: {
-          feature1: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-          feature2: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-          feature3: {
-            privileges: ['all'],
-            canUnassign: true, // feature 3 has no "read" privilege governed by space "all"
-          },
-          feature4: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-        },
-      },
-    ]);
-  });
-});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_allowed_privileges_calculator.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_allowed_privileges_calculator.ts
deleted file mode 100644
index cea25649c43ff..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_allowed_privileges_calculator.ts
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { KibanaPrivileges, Role, RoleKibanaPrivilege } from '../../../../../../../common/model';
-import {
-  areActionsFullyCovered,
-  compareActions,
-} from '../../../../../../../common/privilege_calculator_utils';
-import { NO_PRIVILEGE_VALUE } from '../constants';
-import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
-import {
-  AllowedPrivilege,
-  CalculatedPrivilege,
-  PRIVILEGE_SOURCE,
-} from './kibana_privilege_calculator_types';
-
-export class KibanaAllowedPrivilegesCalculator {
-  // reference to the global privilege definition
-  private globalPrivilege: RoleKibanaPrivilege;
-
-  // list of privilege actions that comprise the global base privilege
-  private readonly assignedGlobalBaseActions: string[];
-
-  constructor(private readonly kibanaPrivileges: KibanaPrivileges, private readonly role: Role) {
-    this.globalPrivilege = this.locateGlobalPrivilege(role);
-    this.assignedGlobalBaseActions = this.globalPrivilege.base[0]
-      ? kibanaPrivileges.getGlobalPrivileges().getActions(this.globalPrivilege.base[0])
-      : [];
-  }
-
-  public calculateAllowedPrivileges(
-    effectivePrivileges: CalculatedPrivilege[]
-  ): AllowedPrivilege[] {
-    const { kibana = [] } = this.role;
-    return kibana.map((privilegeSpec, index) =>
-      this.calculateAllowedPrivilege(privilegeSpec, effectivePrivileges[index])
-    );
-  }
-
-  private calculateAllowedPrivilege(
-    privilegeSpec: RoleKibanaPrivilege,
-    effectivePrivileges: CalculatedPrivilege
-  ): AllowedPrivilege {
-    const result: AllowedPrivilege = {
-      base: {
-        privileges: [],
-        canUnassign: true,
-      },
-      feature: {},
-    };
-
-    if (isGlobalPrivilegeDefinition(privilegeSpec)) {
-      // nothing can impede global privileges
-      result.base.canUnassign = true;
-      result.base.privileges = this.kibanaPrivileges.getGlobalPrivileges().getAllPrivileges();
-    } else {
-      // space base privileges are restricted based on the assigned global privileges
-      const spacePrivileges = this.kibanaPrivileges.getSpacesPrivileges().getAllPrivileges();
-      result.base.canUnassign = this.assignedGlobalBaseActions.length === 0;
-      result.base.privileges = spacePrivileges.filter(privilege => {
-        // always allowed to assign the calculated effective privilege
-        if (privilege === effectivePrivileges.base.actualPrivilege) {
-          return true;
-        }
-
-        const privilegeActions = this.getBaseActions(PRIVILEGE_SOURCE.SPACE_BASE, privilege);
-        return !areActionsFullyCovered(this.assignedGlobalBaseActions, privilegeActions);
-      });
-    }
-
-    const allFeaturePrivileges = this.kibanaPrivileges.getFeaturePrivileges().getAllPrivileges();
-    result.feature = Object.entries(allFeaturePrivileges).reduce(
-      (acc, [featureId, featurePrivileges]) => {
-        return {
-          ...acc,
-          [featureId]: this.getAllowedFeaturePrivileges(
-            effectivePrivileges,
-            featureId,
-            featurePrivileges
-          ),
-        };
-      },
-      {}
-    );
-
-    return result;
-  }
-
-  private getAllowedFeaturePrivileges(
-    effectivePrivileges: CalculatedPrivilege,
-    featureId: string,
-    candidateFeaturePrivileges: string[]
-  ): { privileges: string[]; canUnassign: boolean } {
-    const effectiveFeaturePrivilegeExplanation = effectivePrivileges.feature[featureId];
-    if (effectiveFeaturePrivilegeExplanation == null) {
-      throw new Error('To calculate allowed feature privileges, we need the effective privileges');
-    }
-
-    const effectiveFeatureActions = this.getFeatureActions(
-      featureId,
-      effectiveFeaturePrivilegeExplanation.actualPrivilege
-    );
-
-    const privileges = [];
-    if (effectiveFeaturePrivilegeExplanation.actualPrivilege !== NO_PRIVILEGE_VALUE) {
-      // Always allowed to assign the calculated effective privilege
-      privileges.push(effectiveFeaturePrivilegeExplanation.actualPrivilege);
-    }
-
-    privileges.push(
-      ...candidateFeaturePrivileges.filter(privilegeId => {
-        const candidateActions = this.getFeatureActions(featureId, privilegeId);
-        return compareActions(effectiveFeatureActions, candidateActions) > 0;
-      })
-    );
-
-    const result = {
-      privileges: privileges.sort(),
-      canUnassign: effectiveFeaturePrivilegeExplanation.actualPrivilege === NO_PRIVILEGE_VALUE,
-    };
-
-    return result;
-  }
-
-  private getBaseActions(source: PRIVILEGE_SOURCE, privilegeId: string) {
-    switch (source) {
-      case PRIVILEGE_SOURCE.GLOBAL_BASE:
-        return this.assignedGlobalBaseActions;
-      case PRIVILEGE_SOURCE.SPACE_BASE:
-        return this.kibanaPrivileges.getSpacesPrivileges().getActions(privilegeId);
-      default:
-        throw new Error(
-          `Cannot get base actions for unsupported privilege source ${PRIVILEGE_SOURCE[source]}`
-        );
-    }
-  }
-
-  private getFeatureActions(featureId: string, privilegeId: string): string[] {
-    return this.kibanaPrivileges.getFeaturePrivileges().getActions(featureId, privilegeId);
-  }
-
-  private locateGlobalPrivilege(role: Role) {
-    const spacePrivileges = role.kibana;
-    return (
-      spacePrivileges.find(privileges => isGlobalPrivilegeDefinition(privileges)) || {
-        spaces: [] as string[],
-        base: [] as string[],
-        feature: {},
-      }
-    );
-  }
-}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_base_privilege_calculator.test.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_base_privilege_calculator.test.ts
deleted file mode 100644
index 8d30061b92c6f..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_base_privilege_calculator.test.ts
+++ /dev/null
@@ -1,321 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { KibanaPrivileges, Role, RoleKibanaPrivilege } from '../../../../../../../common/model';
-import { NO_PRIVILEGE_VALUE } from '../constants';
-import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
-import { buildRole, defaultPrivilegeDefinition } from './__fixtures__';
-import { KibanaBasePrivilegeCalculator } from './kibana_base_privilege_calculator';
-import { PRIVILEGE_SOURCE, PrivilegeExplanation } from './kibana_privilege_calculator_types';
-
-const buildEffectiveBasePrivilegeCalculator = (
-  role: Role,
-  kibanaPrivileges: KibanaPrivileges = defaultPrivilegeDefinition
-) => {
-  const globalPrivilegeSpec =
-    role.kibana.find(k => isGlobalPrivilegeDefinition(k)) ||
-    ({
-      spaces: ['*'],
-      base: [],
-      feature: {},
-    } as RoleKibanaPrivilege);
-
-  const globalActions = globalPrivilegeSpec.base[0]
-    ? kibanaPrivileges.getGlobalPrivileges().getActions(globalPrivilegeSpec.base[0])
-    : [];
-
-  return new KibanaBasePrivilegeCalculator(kibanaPrivileges, globalPrivilegeSpec, globalActions);
-};
-
-describe('getMostPermissiveBasePrivilege', () => {
-  describe('without ignoring assigned', () => {
-    it('returns "none" when no privileges are granted', () => {
-      const role = buildRole();
-      const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-      const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-        role.kibana[0],
-        false
-      );
-
-      expect(result).toEqual({
-        actualPrivilege: NO_PRIVILEGE_VALUE,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: true,
-      } as PrivilegeExplanation);
-    });
-
-    defaultPrivilegeDefinition
-      .getGlobalPrivileges()
-      .getAllPrivileges()
-      .forEach(globalBasePrivilege => {
-        it(`returns "${globalBasePrivilege}" when assigned directly at the global privilege`, () => {
-          const role = buildRole({
-            spacesPrivileges: [
-              {
-                spaces: ['*'],
-                base: [globalBasePrivilege],
-                feature: {},
-              },
-            ],
-          });
-          const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-          const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-            role.kibana[0],
-            false
-          );
-
-          expect(result).toEqual({
-            actualPrivilege: globalBasePrivilege,
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: true,
-          } as PrivilegeExplanation);
-        });
-      });
-
-    defaultPrivilegeDefinition
-      .getSpacesPrivileges()
-      .getAllPrivileges()
-      .forEach(spaceBasePrivilege => {
-        it(`returns "${spaceBasePrivilege}" when assigned directly at the space base privilege`, () => {
-          const role = buildRole({
-            spacesPrivileges: [
-              {
-                spaces: ['foo'],
-                base: [spaceBasePrivilege],
-                feature: {},
-              },
-            ],
-          });
-          const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-          const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-            role.kibana[0],
-            false
-          );
-
-          expect(result).toEqual({
-            actualPrivilege: spaceBasePrivilege,
-            actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-            isDirectlyAssigned: true,
-          } as PrivilegeExplanation);
-        });
-      });
-
-    it('returns the global privilege when no space base is defined', () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['all'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: [],
-            feature: {},
-          },
-        ],
-      });
-      const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-      const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-        role.kibana[1],
-        false
-      );
-
-      expect(result).toEqual({
-        actualPrivilege: 'all',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-      } as PrivilegeExplanation);
-    });
-
-    it('returns the global privilege when it supercedes the space privilege', () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['all'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: ['read'],
-            feature: {},
-          },
-        ],
-      });
-      const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-      const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-        role.kibana[1],
-        false
-      );
-
-      expect(result).toEqual({
-        actualPrivilege: 'all',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-        supersededPrivilege: 'read',
-        supersededPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-      } as PrivilegeExplanation);
-    });
-  });
-
-  describe('ignoring assigned', () => {
-    it('returns "none" when no privileges are granted', () => {
-      const role = buildRole();
-      const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-      const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-        role.kibana[0],
-        true
-      );
-
-      expect(result).toEqual({
-        actualPrivilege: NO_PRIVILEGE_VALUE,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: true,
-      } as PrivilegeExplanation);
-    });
-
-    defaultPrivilegeDefinition
-      .getGlobalPrivileges()
-      .getAllPrivileges()
-      .forEach(globalBasePrivilege => {
-        it(`returns "none" when "${globalBasePrivilege}" assigned directly at the global privilege`, () => {
-          const role = buildRole({
-            spacesPrivileges: [
-              {
-                spaces: ['*'],
-                base: [globalBasePrivilege],
-                feature: {},
-              },
-            ],
-          });
-          const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-          const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-            role.kibana[0],
-            true
-          );
-
-          expect(result).toEqual({
-            actualPrivilege: NO_PRIVILEGE_VALUE,
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: true,
-          } as PrivilegeExplanation);
-        });
-      });
-
-    defaultPrivilegeDefinition
-      .getSpacesPrivileges()
-      .getAllPrivileges()
-      .forEach(spaceBasePrivilege => {
-        it(`returns "none" when "${spaceBasePrivilege}" when assigned directly at the space base privilege`, () => {
-          const role = buildRole({
-            spacesPrivileges: [
-              {
-                spaces: ['foo'],
-                base: [spaceBasePrivilege],
-                feature: {},
-              },
-            ],
-          });
-          const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-          const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-            role.kibana[0],
-            true
-          );
-
-          expect(result).toEqual({
-            actualPrivilege: NO_PRIVILEGE_VALUE,
-            actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-            isDirectlyAssigned: true,
-          } as PrivilegeExplanation);
-        });
-      });
-
-    it('returns the global privilege when no space base is defined', () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['all'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: [],
-            feature: {},
-          },
-        ],
-      });
-      const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-      const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-        role.kibana[1],
-        true
-      );
-
-      expect(result).toEqual({
-        actualPrivilege: 'all',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-      } as PrivilegeExplanation);
-    });
-
-    it('returns the global privilege when it supercedes the space privilege, without indicating override', () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['all'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: ['read'],
-            feature: {},
-          },
-        ],
-      });
-      const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-      const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-        role.kibana[1],
-        true
-      );
-
-      expect(result).toEqual({
-        actualPrivilege: 'all',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-      } as PrivilegeExplanation);
-    });
-
-    it('returns the global privilege even though it would ordinarly be overriden by space base privilege', () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['read'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: ['all'],
-            feature: {},
-          },
-        ],
-      });
-      const effectiveBasePrivilegesCalculator = buildEffectiveBasePrivilegeCalculator(role);
-      const result: PrivilegeExplanation = effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-        role.kibana[1],
-        true
-      );
-
-      expect(result).toEqual({
-        actualPrivilege: 'read',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-      } as PrivilegeExplanation);
-    });
-  });
-});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_base_privilege_calculator.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_base_privilege_calculator.ts
deleted file mode 100644
index 9fefea637e168..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_base_privilege_calculator.ts
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { KibanaPrivileges, RoleKibanaPrivilege } from '../../../../../../../common/model';
-import { compareActions } from '../../../../../../../common/privilege_calculator_utils';
-import { NO_PRIVILEGE_VALUE } from '../constants';
-import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
-import { PRIVILEGE_SOURCE, PrivilegeExplanation } from './kibana_privilege_calculator_types';
-
-export class KibanaBasePrivilegeCalculator {
-  constructor(
-    private readonly kibanaPrivileges: KibanaPrivileges,
-    private readonly globalPrivilege: RoleKibanaPrivilege,
-    private readonly assignedGlobalBaseActions: string[]
-  ) {}
-
-  public getMostPermissiveBasePrivilege(
-    privilegeSpec: RoleKibanaPrivilege,
-    ignoreAssigned: boolean
-  ): PrivilegeExplanation {
-    const assignedPrivilege = privilegeSpec.base[0] || NO_PRIVILEGE_VALUE;
-
-    // If this is the global privilege definition, then there is nothing to supercede it.
-    if (isGlobalPrivilegeDefinition(privilegeSpec)) {
-      if (assignedPrivilege === NO_PRIVILEGE_VALUE || ignoreAssigned) {
-        return {
-          actualPrivilege: NO_PRIVILEGE_VALUE,
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: true,
-        };
-      }
-      return {
-        actualPrivilege: assignedPrivilege,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: true,
-      };
-    }
-
-    // Otherwise, check to see if the global privilege supercedes this one.
-    const baseActions = [
-      ...this.kibanaPrivileges.getSpacesPrivileges().getActions(assignedPrivilege),
-    ];
-
-    const globalSupercedes =
-      this.hasAssignedGlobalBasePrivilege() &&
-      (compareActions(this.assignedGlobalBaseActions, baseActions) < 0 || ignoreAssigned);
-
-    if (globalSupercedes) {
-      const wasDirectlyAssigned = !ignoreAssigned && baseActions.length > 0;
-
-      return {
-        actualPrivilege: this.globalPrivilege.base[0],
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-        ...this.buildSupercededFields(
-          wasDirectlyAssigned,
-          assignedPrivilege,
-          PRIVILEGE_SOURCE.SPACE_BASE
-        ),
-      };
-    }
-
-    if (!ignoreAssigned) {
-      return {
-        actualPrivilege: assignedPrivilege,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-        isDirectlyAssigned: true,
-      };
-    }
-
-    return {
-      actualPrivilege: NO_PRIVILEGE_VALUE,
-      actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-      isDirectlyAssigned: true,
-    };
-  }
-
-  private hasAssignedGlobalBasePrivilege() {
-    return this.assignedGlobalBaseActions.length > 0;
-  }
-
-  private buildSupercededFields(
-    isSuperceding: boolean,
-    supersededPrivilege?: string,
-    supersededPrivilegeSource?: PRIVILEGE_SOURCE
-  ) {
-    if (!isSuperceding) {
-      return {};
-    }
-    return {
-      supersededPrivilege,
-      supersededPrivilegeSource,
-    };
-  }
-}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_feature_privilege_calculator.test.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_feature_privilege_calculator.test.ts
deleted file mode 100644
index 887fffa1b0cbc..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_feature_privilege_calculator.test.ts
+++ /dev/null
@@ -1,959 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { KibanaPrivileges, Role, RoleKibanaPrivilege } from '../../../../../../../common/model';
-import { NO_PRIVILEGE_VALUE } from '../constants';
-import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
-import { buildRole, BuildRoleOpts, defaultPrivilegeDefinition } from './__fixtures__';
-import { KibanaBasePrivilegeCalculator } from './kibana_base_privilege_calculator';
-import { KibanaFeaturePrivilegeCalculator } from './kibana_feature_privilege_calculator';
-import { PRIVILEGE_SOURCE } from './kibana_privilege_calculator_types';
-
-const buildEffectiveBasePrivilegeCalculator = (
-  role: Role,
-  kibanaPrivileges: KibanaPrivileges = defaultPrivilegeDefinition
-) => {
-  const globalPrivilegeSpec =
-    role.kibana.find(k => isGlobalPrivilegeDefinition(k)) ||
-    ({
-      spaces: ['*'],
-      base: [],
-      feature: {},
-    } as RoleKibanaPrivilege);
-
-  const globalActions = globalPrivilegeSpec.base[0]
-    ? kibanaPrivileges.getGlobalPrivileges().getActions(globalPrivilegeSpec.base[0])
-    : [];
-
-  return new KibanaBasePrivilegeCalculator(kibanaPrivileges, globalPrivilegeSpec, globalActions);
-};
-
-const buildEffectiveFeaturePrivilegeCalculator = (
-  role: Role,
-  kibanaPrivileges: KibanaPrivileges = defaultPrivilegeDefinition
-) => {
-  const globalPrivilegeSpec =
-    role.kibana.find(k => isGlobalPrivilegeDefinition(k)) ||
-    ({
-      spaces: ['*'],
-      base: [],
-      feature: {},
-    } as RoleKibanaPrivilege);
-
-  const globalActions = globalPrivilegeSpec.base[0]
-    ? kibanaPrivileges.getGlobalPrivileges().getActions(globalPrivilegeSpec.base[0])
-    : [];
-
-  const rankedFeaturePrivileges = kibanaPrivileges.getFeaturePrivileges().getAllPrivileges();
-
-  return new KibanaFeaturePrivilegeCalculator(
-    kibanaPrivileges,
-    globalPrivilegeSpec,
-    globalActions,
-    rankedFeaturePrivileges
-  );
-};
-
-interface TestOpts {
-  only?: boolean;
-  role?: BuildRoleOpts;
-  privilegeIndex?: number;
-  ignoreAssigned?: boolean;
-  result: Record<string, any>;
-  feature?: string;
-}
-
-function runTest(
-  description: string,
-  {
-    role: roleOpts = {},
-    result = {},
-    privilegeIndex = 0,
-    ignoreAssigned = false,
-    only = false,
-    feature = 'feature1',
-  }: TestOpts
-) {
-  const fn = only ? it.only : it;
-  fn(description, () => {
-    const role = buildRole(roleOpts);
-    const basePrivilegeCalculator = buildEffectiveBasePrivilegeCalculator(role);
-    const featurePrivilegeCalculator = buildEffectiveFeaturePrivilegeCalculator(role);
-
-    const baseExplanation = basePrivilegeCalculator.getMostPermissiveBasePrivilege(
-      role.kibana[privilegeIndex],
-      // If calculations wish to ignoreAssigned, then we still need to know what the real effective base privilege is
-      // without ignoring assigned, in order to calculate the correct feature privileges.
-      false
-    );
-
-    const actualResult = featurePrivilegeCalculator.getMostPermissiveFeaturePrivilege(
-      role.kibana[privilegeIndex],
-      baseExplanation,
-      feature,
-      ignoreAssigned
-    );
-
-    expect(actualResult).toEqual(result);
-  });
-}
-
-describe('getMostPermissiveFeaturePrivilege', () => {
-  describe('for global feature privileges, without ignoring assigned', () => {
-    runTest('returns "none" when no privileges are granted', {
-      result: {
-        actualPrivilege: NO_PRIVILEGE_VALUE,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-        isDirectlyAssigned: true,
-      },
-    });
-
-    runTest('returns "read" when assigned directly to the feature', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: [],
-            feature: {
-              feature1: ['read'],
-            },
-          },
-        ],
-      },
-      result: {
-        actualPrivilege: 'read',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-        isDirectlyAssigned: true,
-      },
-    });
-
-    runTest('returns "read" when assigned as the global base privilege', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['read'],
-            feature: {},
-          },
-        ],
-      },
-      result: {
-        actualPrivilege: 'read',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-      },
-    });
-
-    runTest(
-      'returns "all" when assigned as the global base privilege, which overrides assigned feature privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {
-                feature1: ['read'],
-              },
-            },
-          ],
-        },
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-          supersededPrivilege: 'read',
-          supersededPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the feature privilege, which does not override assigned global base privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['read'],
-              feature: {
-                feature1: ['all'],
-              },
-            },
-          ],
-        },
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-          isDirectlyAssigned: true,
-        },
-      }
-    );
-  });
-
-  describe('for global feature privileges, ignoring assigned', () => {
-    runTest('returns "none" when no privileges are granted', {
-      ignoreAssigned: true,
-      result: {
-        actualPrivilege: NO_PRIVILEGE_VALUE,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-        isDirectlyAssigned: true,
-      },
-    });
-
-    runTest('returns "none" when "read" is assigned directly to the feature', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: [],
-            feature: {
-              feature1: ['read'],
-            },
-          },
-        ],
-      },
-      ignoreAssigned: true,
-      result: {
-        actualPrivilege: NO_PRIVILEGE_VALUE,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-        isDirectlyAssigned: true,
-      },
-    });
-
-    runTest('returns "read" when assigned as the global base privilege', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['read'],
-            feature: {},
-          },
-        ],
-      },
-      ignoreAssigned: true,
-      result: {
-        actualPrivilege: 'read',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-      },
-    });
-
-    runTest(
-      'returns "all" when assigned as the global base privilege, which overrides assigned feature privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {
-                feature1: ['read'],
-              },
-            },
-          ],
-        },
-        ignoreAssigned: true,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest(
-      'returns "read" when "all" assigned as the feature privilege, which does not override assigned global base privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['read'],
-              feature: {
-                feature1: ['all'],
-              },
-            },
-          ],
-        },
-        ignoreAssigned: true,
-        result: {
-          actualPrivilege: 'read',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-  });
-
-  describe('for space feature privileges, without ignoring assigned', () => {
-    runTest('returns "none" when no privileges are granted', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['marketing'],
-            base: [],
-            feature: {},
-          },
-        ],
-      },
-      result: {
-        actualPrivilege: NO_PRIVILEGE_VALUE,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-        isDirectlyAssigned: true,
-      },
-    });
-
-    runTest('returns "read" when assigned directly to the feature', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['marketing'],
-            base: [],
-            feature: {
-              feature1: ['read'],
-            },
-          },
-        ],
-      },
-      result: {
-        actualPrivilege: 'read',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-        isDirectlyAssigned: true,
-        directlyAssignedFeaturePrivilegeMorePermissiveThanBase: true,
-      },
-    });
-
-    runTest('returns "read" when assigned as the global base privilege', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['read'],
-            feature: {},
-          },
-          {
-            spaces: ['marketing'],
-            base: [],
-            feature: {},
-          },
-        ],
-      },
-      privilegeIndex: 1,
-      result: {
-        actualPrivilege: 'read',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-      },
-    });
-
-    runTest(
-      'returns "all" when assigned as the global base privilege, which overrides assigned global feature privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {
-                feature1: ['read'],
-              },
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {},
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the global base privilege, which overrides assigned space feature privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {},
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {
-                feature1: ['read'],
-              },
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-          supersededPrivilege: 'read',
-          supersededPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the global feature privilege, which does not override assigned global base privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['read'],
-              feature: {
-                feature1: ['all'],
-              },
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {},
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the space feature privilege, which does not override assigned global base privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['read'],
-              feature: {},
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {
-                feature1: ['all'],
-              },
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-          isDirectlyAssigned: true,
-          directlyAssignedFeaturePrivilegeMorePermissiveThanBase: true,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the space base privilege, which does not override assigned global base privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['read'],
-              feature: {},
-            },
-            {
-              spaces: ['marketing'],
-              base: ['all'],
-              feature: {},
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the global base privilege, which overrides assigned space feature privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {},
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {
-                feature1: ['read'],
-              },
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-          supersededPrivilege: 'read',
-          supersededPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-        },
-      }
-    );
-
-    runTest('returns "all" when assigned everywhere, without indicating override', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['all'],
-            feature: {
-              feature1: ['all'],
-            },
-          },
-          {
-            spaces: ['marketing'],
-            base: ['all'],
-            feature: {
-              feature1: ['all'],
-            },
-          },
-        ],
-      },
-      privilegeIndex: 1,
-      result: {
-        actualPrivilege: 'all',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-        isDirectlyAssigned: true,
-        directlyAssignedFeaturePrivilegeMorePermissiveThanBase: false,
-      },
-    });
-
-    runTest('returns "all" when assigned at global feature, overriding space feature', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: [],
-            feature: {
-              feature1: ['all'],
-            },
-          },
-          {
-            spaces: ['marketing'],
-            base: [],
-            feature: {
-              feature1: ['read'],
-            },
-          },
-        ],
-      },
-      privilegeIndex: 1,
-      result: {
-        actualPrivilege: 'all',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-        isDirectlyAssigned: false,
-        supersededPrivilege: 'read',
-        supersededPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-      },
-    });
-
-    describe('feature with "all" excluded from base privileges', () => {
-      runTest('returns "read" when "all" assigned as the global base privilege', {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {},
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {},
-            },
-          ],
-        },
-        feature: 'feature4',
-        privilegeIndex: 1,
-        result: {
-          actualPrivilege: 'read',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        },
-      });
-
-      runTest(
-        'returns "read" when "all" assigned as the global base privilege, which does not override assigned space feature privilege',
-        {
-          role: {
-            spacesPrivileges: [
-              {
-                spaces: ['*'],
-                base: ['all'],
-                feature: {},
-              },
-              {
-                spaces: ['marketing'],
-                base: [],
-                feature: {
-                  feature4: ['read'],
-                },
-              },
-            ],
-          },
-          feature: 'feature4',
-          privilegeIndex: 1,
-          result: {
-            actualPrivilege: 'read',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-            isDirectlyAssigned: true,
-            directlyAssignedFeaturePrivilegeMorePermissiveThanBase: false,
-          },
-        }
-      );
-
-      runTest(
-        'returns "all" when assigned as the feature privilege, which is more permissive than the base privilege',
-        {
-          role: {
-            spacesPrivileges: [
-              {
-                spaces: ['*'],
-                base: ['all'],
-                feature: {},
-              },
-              {
-                spaces: ['marketing'],
-                base: [],
-                feature: {
-                  feature4: ['all'],
-                },
-              },
-            ],
-          },
-          feature: 'feature4',
-          privilegeIndex: 1,
-          result: {
-            actualPrivilege: 'all',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-            isDirectlyAssigned: true,
-            directlyAssignedFeaturePrivilegeMorePermissiveThanBase: true,
-          },
-        }
-      );
-    });
-  });
-
-  describe('for space feature privileges, ignoring assigned', () => {
-    runTest('returns "none" when no privileges are granted', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['marketing'],
-            base: [],
-            feature: {},
-          },
-        ],
-      },
-      ignoreAssigned: true,
-      result: {
-        actualPrivilege: NO_PRIVILEGE_VALUE,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-        isDirectlyAssigned: true,
-      },
-    });
-
-    runTest('returns "none" when "read" assigned directly to the feature', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['marketing'],
-            base: [],
-            feature: {
-              feature1: ['read'],
-            },
-          },
-        ],
-      },
-      ignoreAssigned: true,
-      result: {
-        actualPrivilege: NO_PRIVILEGE_VALUE,
-        actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-        isDirectlyAssigned: true,
-      },
-    });
-
-    runTest('returns "read" when assigned as the global base privilege', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['read'],
-            feature: {},
-          },
-          {
-            spaces: ['marketing'],
-            base: [],
-            feature: {},
-          },
-        ],
-      },
-      privilegeIndex: 1,
-      ignoreAssigned: true,
-      result: {
-        actualPrivilege: 'read',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-        isDirectlyAssigned: false,
-      },
-    });
-
-    runTest(
-      'returns "all" when assigned as the global base privilege, which overrides assigned global feature privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {
-                feature1: ['read'],
-              },
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {},
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        ignoreAssigned: true,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the global base privilege, which normally overrides assigned space feature privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {},
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {
-                feature1: ['read'],
-              },
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        ignoreAssigned: true,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the global feature privilege, which does not override assigned global base privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['read'],
-              feature: {
-                feature1: ['all'],
-              },
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {},
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        ignoreAssigned: true,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest(
-      'returns "read" when "all" assigned as the space feature privilege, which normally overrides assigned global base privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['read'],
-              feature: {},
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {
-                feature1: ['all'],
-              },
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        ignoreAssigned: true,
-        result: {
-          actualPrivilege: 'read',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the space base privilege, which does not override assigned global base privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['read'],
-              feature: {},
-            },
-            {
-              spaces: ['marketing'],
-              base: ['all'],
-              feature: {},
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        ignoreAssigned: true,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest(
-      'returns "all" when assigned as the global base privilege, which normally overrides assigned space feature privilege',
-      {
-        role: {
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {},
-            },
-            {
-              spaces: ['marketing'],
-              base: [],
-              feature: {
-                feature1: ['read'],
-              },
-            },
-          ],
-        },
-        privilegeIndex: 1,
-        ignoreAssigned: true,
-        result: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        },
-      }
-    );
-
-    runTest('returns "all" when assigned everywhere, without indicating override', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['all'],
-            feature: {
-              feature1: ['all'],
-            },
-          },
-          {
-            spaces: ['marketing'],
-            base: ['all'],
-            feature: {
-              feature1: ['all'],
-            },
-          },
-        ],
-      },
-      privilegeIndex: 1,
-      ignoreAssigned: true,
-      result: {
-        actualPrivilege: 'all',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-        isDirectlyAssigned: false,
-      },
-    });
-
-    runTest('returns "all" when assigned at global feature, normally overriding space feature', {
-      role: {
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: [],
-            feature: {
-              feature1: ['all'],
-            },
-          },
-          {
-            spaces: ['marketing'],
-            base: [],
-            feature: {
-              feature1: ['read'],
-            },
-          },
-        ],
-      },
-      privilegeIndex: 1,
-      ignoreAssigned: true,
-      result: {
-        actualPrivilege: 'all',
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-        isDirectlyAssigned: false,
-      },
-    });
-  });
-});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_feature_privilege_calculator.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_feature_privilege_calculator.ts
deleted file mode 100644
index 1ca87871aa892..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_feature_privilege_calculator.ts
+++ /dev/null
@@ -1,209 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  FeaturesPrivileges,
-  KibanaPrivileges,
-  RoleKibanaPrivilege,
-} from '../../../../../../../common/model';
-import { areActionsFullyCovered } from '../../../../../../../common/privilege_calculator_utils';
-import { NO_PRIVILEGE_VALUE } from '../constants';
-import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
-import {
-  PRIVILEGE_SOURCE,
-  PrivilegeExplanation,
-  PrivilegeScenario,
-} from './kibana_privilege_calculator_types';
-
-export class KibanaFeaturePrivilegeCalculator {
-  constructor(
-    private readonly kibanaPrivileges: KibanaPrivileges,
-    private readonly globalPrivilege: RoleKibanaPrivilege,
-    private readonly assignedGlobalBaseActions: string[],
-    private readonly rankedFeaturePrivileges: FeaturesPrivileges
-  ) {}
-
-  public getMostPermissiveFeaturePrivilege(
-    privilegeSpec: RoleKibanaPrivilege,
-    basePrivilegeExplanation: PrivilegeExplanation,
-    featureId: string,
-    ignoreAssigned: boolean
-  ): PrivilegeExplanation {
-    const scenarios = this.buildFeaturePrivilegeScenarios(
-      privilegeSpec,
-      basePrivilegeExplanation,
-      featureId,
-      ignoreAssigned
-    );
-
-    const featurePrivileges = this.rankedFeaturePrivileges[featureId] || [];
-
-    // inspect feature privileges in ranked order (most permissive -> least permissive)
-    for (const featurePrivilege of featurePrivileges) {
-      const actions = this.kibanaPrivileges
-        .getFeaturePrivileges()
-        .getActions(featureId, featurePrivilege);
-
-      // check if any of the scenarios satisfy the privilege - first one wins.
-      for (const scenario of scenarios) {
-        if (areActionsFullyCovered(scenario.actions, actions)) {
-          return {
-            actualPrivilege: featurePrivilege,
-            actualPrivilegeSource: scenario.actualPrivilegeSource,
-            isDirectlyAssigned: scenario.isDirectlyAssigned,
-            directlyAssignedFeaturePrivilegeMorePermissiveThanBase:
-              scenario.directlyAssignedFeaturePrivilegeMorePermissiveThanBase,
-            ...this.buildSupercededFields(
-              !scenario.isDirectlyAssigned,
-              scenario.supersededPrivilege,
-              scenario.supersededPrivilegeSource
-            ),
-          };
-        }
-      }
-    }
-
-    const isGlobal = isGlobalPrivilegeDefinition(privilegeSpec);
-    return {
-      actualPrivilege: NO_PRIVILEGE_VALUE,
-      actualPrivilegeSource: isGlobal
-        ? PRIVILEGE_SOURCE.GLOBAL_FEATURE
-        : PRIVILEGE_SOURCE.SPACE_FEATURE,
-      isDirectlyAssigned: true,
-    };
-  }
-
-  private buildFeaturePrivilegeScenarios(
-    privilegeSpec: RoleKibanaPrivilege,
-    basePrivilegeExplanation: PrivilegeExplanation,
-    featureId: string,
-    ignoreAssigned: boolean
-  ): PrivilegeScenario[] {
-    const scenarios: PrivilegeScenario[] = [];
-
-    const isGlobalPrivilege = isGlobalPrivilegeDefinition(privilegeSpec);
-
-    const assignedGlobalFeaturePrivilege = this.getAssignedFeaturePrivilege(
-      this.globalPrivilege,
-      featureId
-    );
-
-    const assignedFeaturePrivilege = this.getAssignedFeaturePrivilege(privilegeSpec, featureId);
-    const hasAssignedFeaturePrivilege =
-      !ignoreAssigned && assignedFeaturePrivilege !== NO_PRIVILEGE_VALUE;
-
-    scenarios.push({
-      actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-      isDirectlyAssigned: false,
-      actions: [...this.assignedGlobalBaseActions],
-      ...this.buildSupercededFields(
-        hasAssignedFeaturePrivilege,
-        assignedFeaturePrivilege,
-        isGlobalPrivilege ? PRIVILEGE_SOURCE.GLOBAL_FEATURE : PRIVILEGE_SOURCE.SPACE_FEATURE
-      ),
-    });
-
-    if (!isGlobalPrivilege || !ignoreAssigned) {
-      scenarios.push({
-        actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-        actions: this.getFeatureActions(featureId, assignedGlobalFeaturePrivilege),
-        isDirectlyAssigned: isGlobalPrivilege && hasAssignedFeaturePrivilege,
-        ...this.buildSupercededFields(
-          hasAssignedFeaturePrivilege && !isGlobalPrivilege,
-          assignedFeaturePrivilege,
-          PRIVILEGE_SOURCE.SPACE_FEATURE
-        ),
-      });
-    }
-
-    if (isGlobalPrivilege) {
-      return this.rankScenarios(scenarios);
-    }
-
-    // Otherwise, this is a space feature privilege
-
-    const includeSpaceBaseScenario =
-      basePrivilegeExplanation.actualPrivilegeSource === PRIVILEGE_SOURCE.SPACE_BASE ||
-      basePrivilegeExplanation.supersededPrivilegeSource === PRIVILEGE_SOURCE.SPACE_BASE;
-
-    const spaceBasePrivilege =
-      basePrivilegeExplanation.supersededPrivilege || basePrivilegeExplanation.actualPrivilege;
-
-    if (includeSpaceBaseScenario) {
-      scenarios.push({
-        actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-        isDirectlyAssigned: false,
-        actions: this.getBaseActions(PRIVILEGE_SOURCE.SPACE_BASE, spaceBasePrivilege),
-        ...this.buildSupercededFields(
-          hasAssignedFeaturePrivilege,
-          assignedFeaturePrivilege,
-          PRIVILEGE_SOURCE.SPACE_FEATURE
-        ),
-      });
-    }
-
-    if (!ignoreAssigned) {
-      const actions = this.getFeatureActions(
-        featureId,
-        this.getAssignedFeaturePrivilege(privilegeSpec, featureId)
-      );
-      const directlyAssignedFeaturePrivilegeMorePermissiveThanBase = !areActionsFullyCovered(
-        this.assignedGlobalBaseActions,
-        actions
-      );
-      scenarios.push({
-        actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-        isDirectlyAssigned: true,
-        directlyAssignedFeaturePrivilegeMorePermissiveThanBase,
-        actions,
-      });
-    }
-
-    return this.rankScenarios(scenarios);
-  }
-
-  private rankScenarios(scenarios: PrivilegeScenario[]): PrivilegeScenario[] {
-    return scenarios.sort(
-      (scenario1, scenario2) => scenario1.actualPrivilegeSource - scenario2.actualPrivilegeSource
-    );
-  }
-
-  private getBaseActions(source: PRIVILEGE_SOURCE, privilegeId: string) {
-    switch (source) {
-      case PRIVILEGE_SOURCE.GLOBAL_BASE:
-        return this.assignedGlobalBaseActions;
-      case PRIVILEGE_SOURCE.SPACE_BASE:
-        return this.kibanaPrivileges.getSpacesPrivileges().getActions(privilegeId);
-      default:
-        throw new Error(
-          `Cannot get base actions for unsupported privilege source ${PRIVILEGE_SOURCE[source]}`
-        );
-    }
-  }
-
-  private getFeatureActions(featureId: string, privilegeId: string) {
-    return this.kibanaPrivileges.getFeaturePrivileges().getActions(featureId, privilegeId);
-  }
-
-  private getAssignedFeaturePrivilege(privilegeSpec: RoleKibanaPrivilege, featureId: string) {
-    const featureEntry = privilegeSpec.feature[featureId] || [];
-    return featureEntry[0] || NO_PRIVILEGE_VALUE;
-  }
-
-  private buildSupercededFields(
-    isSuperceding: boolean,
-    supersededPrivilege?: string,
-    supersededPrivilegeSource?: PRIVILEGE_SOURCE
-  ) {
-    if (!isSuperceding) {
-      return {};
-    }
-    return {
-      supersededPrivilege,
-      supersededPrivilegeSource,
-    };
-  }
-}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privilege_calculator.test.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privilege_calculator.test.ts
deleted file mode 100644
index 4c44c077f0336..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privilege_calculator.test.ts
+++ /dev/null
@@ -1,940 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { KibanaPrivileges, Role } from '../../../../../../../common/model';
-import { NO_PRIVILEGE_VALUE } from '../constants';
-import {
-  buildRole,
-  defaultPrivilegeDefinition,
-  fullyRestrictedBasePrivileges,
-  fullyRestrictedFeaturePrivileges,
-  unrestrictedBasePrivileges,
-  unrestrictedFeaturePrivileges,
-} from './__fixtures__';
-import {
-  AllowedPrivilege,
-  PRIVILEGE_SOURCE,
-  PrivilegeExplanation,
-} from './kibana_privilege_calculator_types';
-import { KibanaPrivilegeCalculatorFactory } from './kibana_privileges_calculator_factory';
-
-const buildEffectivePrivileges = (
-  role: Role,
-  kibanaPrivileges: KibanaPrivileges = defaultPrivilegeDefinition
-) => {
-  const factory = new KibanaPrivilegeCalculatorFactory(kibanaPrivileges);
-  return factory.getInstance(role);
-};
-
-interface BuildExpectedFeaturePrivilegesOption {
-  features: string[];
-  privilegeExplanation: PrivilegeExplanation;
-}
-
-const buildExpectedFeaturePrivileges = (options: BuildExpectedFeaturePrivilegesOption[]) => {
-  return {
-    feature: options.reduce((acc1, option) => {
-      return {
-        ...acc1,
-        ...option.features.reduce((acc2, featureId) => {
-          return {
-            ...acc2,
-            [featureId]: option.privilegeExplanation,
-          };
-        }, {}),
-      };
-    }, {}),
-  };
-};
-
-describe('calculateEffectivePrivileges', () => {
-  it(`returns an empty array for an empty role`, () => {
-    const role = buildRole();
-    role.kibana = [];
-
-    const effectivePrivileges = buildEffectivePrivileges(role);
-    const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-    expect(calculatedPrivileges).toHaveLength(0);
-  });
-
-  it(`calculates "none" for all privileges when nothing is assigned`, () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['foo', 'bar'],
-          base: [],
-          feature: {},
-        },
-      ],
-    });
-    const effectivePrivileges = buildEffectivePrivileges(role);
-    const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-    expect(calculatedPrivileges).toEqual([
-      {
-        base: {
-          actualPrivilege: NO_PRIVILEGE_VALUE,
-          actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-          isDirectlyAssigned: true,
-        },
-        ...buildExpectedFeaturePrivileges([
-          {
-            features: ['feature1', 'feature2', 'feature3', 'feature4'],
-            privilegeExplanation: {
-              actualPrivilege: NO_PRIVILEGE_VALUE,
-              actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-              isDirectlyAssigned: true,
-            },
-          },
-        ]),
-      },
-    ]);
-  });
-
-  describe(`with global base privilege of "all"`, () => {
-    it(`calculates global feature privilege of all for features 1-3 and read for feature 4`, () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['all'],
-            feature: {},
-          },
-        ],
-      });
-      const effectivePrivileges = buildEffectivePrivileges(role);
-      const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-
-      expect(calculatedPrivileges).toEqual([
-        {
-          base: {
-            actualPrivilege: 'all',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: true,
-          },
-          ...buildExpectedFeaturePrivileges([
-            {
-              features: ['feature1', 'feature2', 'feature3'],
-              privilegeExplanation: {
-                actualPrivilege: 'all',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-            {
-              features: ['feature4'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-          ]),
-        },
-      ]);
-    });
-
-    it(`calculates space base and feature privilege of all for features 1-3 and read for feature 4`, () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['all'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: [],
-            feature: {},
-          },
-        ],
-      });
-      const effectivePrivileges = buildEffectivePrivileges(role);
-      const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-
-      const calculatedSpacePrivileges = calculatedPrivileges[1];
-
-      expect(calculatedSpacePrivileges).toEqual({
-        base: {
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        },
-        ...buildExpectedFeaturePrivileges([
-          {
-            features: ['feature1', 'feature2', 'feature3'],
-            privilegeExplanation: {
-              actualPrivilege: 'all',
-              actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-              isDirectlyAssigned: false,
-            },
-          },
-          {
-            features: ['feature4'],
-            privilegeExplanation: {
-              actualPrivilege: 'read',
-              actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-              isDirectlyAssigned: false,
-            },
-          },
-        ]),
-      });
-    });
-
-    describe(`and with feature privileges assigned`, () => {
-      it('returns the base privileges when they are more permissive', () => {
-        const role = buildRole({
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {
-                feature1: ['read'],
-                feature2: ['read'],
-                feature3: ['read'],
-                feature4: ['read'],
-              },
-            },
-            {
-              spaces: ['foo'],
-              base: [],
-              feature: {
-                feature1: ['read'],
-                feature2: ['read'],
-                feature3: ['read'],
-                feature4: ['read'],
-              },
-            },
-          ],
-        });
-        const effectivePrivileges = buildEffectivePrivileges(role);
-        const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-
-        expect(calculatedPrivileges).toEqual([
-          {
-            base: {
-              actualPrivilege: 'all',
-              actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-              isDirectlyAssigned: true,
-            },
-            ...buildExpectedFeaturePrivileges([
-              {
-                features: ['feature1', 'feature2', 'feature3'],
-                privilegeExplanation: {
-                  actualPrivilege: 'all',
-                  actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                  isDirectlyAssigned: false,
-                  supersededPrivilege: 'read',
-                  supersededPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-                },
-              },
-              {
-                features: ['feature4'],
-                privilegeExplanation: {
-                  actualPrivilege: 'read',
-                  actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-                  isDirectlyAssigned: true,
-                },
-              },
-            ]),
-          },
-          {
-            base: {
-              actualPrivilege: 'all',
-              actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-              isDirectlyAssigned: false,
-            },
-            ...buildExpectedFeaturePrivileges([
-              {
-                features: ['feature1', 'feature2', 'feature3'],
-                privilegeExplanation: {
-                  actualPrivilege: 'all',
-                  actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                  isDirectlyAssigned: false,
-                  supersededPrivilege: 'read',
-                  supersededPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-                },
-              },
-              {
-                features: ['feature4'],
-                privilegeExplanation: {
-                  actualPrivilege: 'read',
-                  actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-                  isDirectlyAssigned: true,
-                  directlyAssignedFeaturePrivilegeMorePermissiveThanBase: false,
-                },
-              },
-            ]),
-          },
-        ]);
-      });
-    });
-  });
-
-  describe(`with global base privilege of "read"`, () => {
-    it(`it calculates space base and feature privileges when none are provided`, () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['read'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: [],
-            feature: {},
-          },
-        ],
-      });
-      const effectivePrivileges = buildEffectivePrivileges(role);
-      const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-
-      expect(calculatedPrivileges).toEqual([
-        {
-          base: {
-            actualPrivilege: 'read',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: true,
-          },
-          ...buildExpectedFeaturePrivileges([
-            {
-              features: ['feature1', 'feature2'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-            {
-              features: ['feature3'],
-              privilegeExplanation: {
-                actualPrivilege: NO_PRIVILEGE_VALUE,
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-                isDirectlyAssigned: true,
-              },
-            },
-            {
-              features: ['feature4'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-          ]),
-        },
-        {
-          base: {
-            actualPrivilege: 'read',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: false,
-          },
-          ...buildExpectedFeaturePrivileges([
-            {
-              features: ['feature1', 'feature2'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-            {
-              features: ['feature3'],
-              privilegeExplanation: {
-                actualPrivilege: NO_PRIVILEGE_VALUE,
-                actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-                isDirectlyAssigned: true,
-              },
-            },
-            {
-              features: ['feature4'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-          ]),
-        },
-      ]);
-    });
-
-    describe('and with feature privileges assigned', () => {
-      it('returns the feature privileges when they are more permissive', () => {
-        const role = buildRole({
-          spacesPrivileges: [
-            {
-              spaces: ['*'],
-              base: ['read'],
-              feature: {
-                feature1: ['all'],
-                feature2: ['all'],
-                feature3: ['all'],
-                feature4: ['all'],
-              },
-            },
-            {
-              spaces: ['foo'],
-              base: [],
-              feature: {
-                feature1: ['all'],
-                feature2: ['all'],
-                feature3: ['all'],
-                feature4: ['all'],
-              },
-            },
-          ],
-        });
-        const effectivePrivileges = buildEffectivePrivileges(role);
-        const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-
-        expect(calculatedPrivileges).toEqual([
-          {
-            base: {
-              actualPrivilege: 'read',
-              actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-              isDirectlyAssigned: true,
-            },
-            ...buildExpectedFeaturePrivileges([
-              {
-                features: ['feature1', 'feature2', 'feature3', 'feature4'],
-                privilegeExplanation: {
-                  actualPrivilege: 'all',
-                  actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-                  isDirectlyAssigned: true,
-                },
-              },
-            ]),
-          },
-          {
-            base: {
-              actualPrivilege: 'read',
-              actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-              isDirectlyAssigned: false,
-            },
-            ...buildExpectedFeaturePrivileges([
-              {
-                features: ['feature1', 'feature2', 'feature3', 'feature4'],
-                privilegeExplanation: {
-                  actualPrivilege: 'all',
-                  actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-                  isDirectlyAssigned: true,
-                  directlyAssignedFeaturePrivilegeMorePermissiveThanBase: true,
-                },
-              },
-            ]),
-          },
-        ]);
-      });
-    });
-  });
-
-  describe('with both global and space base privileges assigned', () => {
-    it(`does not override space base of "all" when global base is "read"`, () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['read'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: ['all'],
-            feature: {},
-          },
-        ],
-      });
-      const effectivePrivileges = buildEffectivePrivileges(role);
-      const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-
-      expect(calculatedPrivileges).toEqual([
-        {
-          base: {
-            actualPrivilege: 'read',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: true,
-          },
-          ...buildExpectedFeaturePrivileges([
-            {
-              features: ['feature1', 'feature2'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-            {
-              features: ['feature3'],
-              privilegeExplanation: {
-                actualPrivilege: NO_PRIVILEGE_VALUE,
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-                isDirectlyAssigned: true,
-              },
-            },
-            {
-              features: ['feature4'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-          ]),
-        },
-        {
-          base: {
-            actualPrivilege: 'all',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-            isDirectlyAssigned: true,
-          },
-          ...buildExpectedFeaturePrivileges([
-            {
-              features: ['feature1', 'feature2', 'feature3'],
-              privilegeExplanation: {
-                actualPrivilege: 'all',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-            {
-              features: ['feature4'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-          ]),
-        },
-      ]);
-    });
-
-    it(`calculates "all" for space base and space features when superceded by global "all"`, () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['all'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: ['read'],
-            feature: {},
-          },
-        ],
-      });
-      const effectivePrivileges = buildEffectivePrivileges(role);
-      const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-
-      expect(calculatedPrivileges).toEqual([
-        {
-          base: {
-            actualPrivilege: 'all',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: true,
-          },
-          ...buildExpectedFeaturePrivileges([
-            {
-              features: ['feature1', 'feature2', 'feature3'],
-              privilegeExplanation: {
-                actualPrivilege: 'all',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-            {
-              features: ['feature4'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-          ]),
-        },
-        {
-          base: {
-            actualPrivilege: 'all',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: false,
-            supersededPrivilege: 'read',
-            supersededPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-          },
-          ...buildExpectedFeaturePrivileges([
-            {
-              features: ['feature1', 'feature2', 'feature3'],
-              privilegeExplanation: {
-                actualPrivilege: 'all',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-            {
-              features: ['feature4'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-          ]),
-        },
-      ]);
-    });
-
-    it(`does not override feature privileges when they are more permissive`, () => {
-      const role = buildRole({
-        spacesPrivileges: [
-          {
-            spaces: ['*'],
-            base: ['read'],
-            feature: {},
-          },
-          {
-            spaces: ['foo'],
-            base: ['read'],
-            feature: {
-              feature1: ['all'],
-              feature2: ['all'],
-              feature3: ['all'],
-              feature4: ['all'],
-            },
-          },
-        ],
-      });
-      const effectivePrivileges = buildEffectivePrivileges(role);
-      const calculatedPrivileges = effectivePrivileges.calculateEffectivePrivileges();
-
-      expect(calculatedPrivileges).toEqual([
-        {
-          base: {
-            actualPrivilege: 'read',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: true,
-          },
-          ...buildExpectedFeaturePrivileges([
-            {
-              features: ['feature1', 'feature2'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-            {
-              features: ['feature3'],
-              privilegeExplanation: {
-                actualPrivilege: NO_PRIVILEGE_VALUE,
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_FEATURE,
-                isDirectlyAssigned: true,
-              },
-            },
-            {
-              features: ['feature4'],
-              privilegeExplanation: {
-                actualPrivilege: 'read',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-                isDirectlyAssigned: false,
-              },
-            },
-          ]),
-        },
-        {
-          base: {
-            actualPrivilege: 'read',
-            actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-            isDirectlyAssigned: false,
-            supersededPrivilege: 'read',
-            supersededPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-          },
-          ...buildExpectedFeaturePrivileges([
-            {
-              features: ['feature1', 'feature2', 'feature3', 'feature4'],
-              privilegeExplanation: {
-                actualPrivilege: 'all',
-                actualPrivilegeSource: PRIVILEGE_SOURCE.SPACE_FEATURE,
-                isDirectlyAssigned: true,
-                directlyAssignedFeaturePrivilegeMorePermissiveThanBase: true,
-              },
-            },
-          ]),
-        },
-      ]);
-    });
-  });
-});
-
-describe('calculateAllowedPrivileges', () => {
-  it('allows all privileges when none are currently assigned', () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: [],
-          feature: {},
-        },
-        {
-          spaces: ['foo'],
-          base: [],
-          feature: {},
-        },
-      ],
-    });
-
-    const privilegeCalculator = buildEffectivePrivileges(role);
-
-    const result: AllowedPrivilege[] = privilegeCalculator.calculateAllowedPrivileges();
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...unrestrictedFeaturePrivileges,
-      },
-      {
-        ...unrestrictedBasePrivileges,
-        ...unrestrictedFeaturePrivileges,
-      },
-    ]);
-  });
-
-  it('allows all global base privileges, but just "all" for everything else when global is set to "all"', () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: ['all'],
-          feature: {},
-        },
-        {
-          spaces: ['foo'],
-          base: [],
-          feature: {},
-        },
-      ],
-    });
-
-    const privilegeCalculator = buildEffectivePrivileges(role);
-
-    const result: AllowedPrivilege[] = privilegeCalculator.calculateAllowedPrivileges();
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...fullyRestrictedFeaturePrivileges,
-      },
-      {
-        ...fullyRestrictedBasePrivileges,
-        ...fullyRestrictedFeaturePrivileges,
-      },
-    ]);
-  });
-
-  it(`allows feature privileges to be set to "all" or "read" when global base is "read"`, () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: ['read'],
-          feature: {},
-        },
-        {
-          spaces: ['foo'],
-          base: [],
-          feature: {},
-        },
-      ],
-    });
-
-    const privilegeCalculator = buildEffectivePrivileges(role);
-
-    const result: AllowedPrivilege[] = privilegeCalculator.calculateAllowedPrivileges();
-
-    const expectedFeaturePrivileges = {
-      feature: {
-        feature1: {
-          privileges: ['all', 'read'],
-          canUnassign: false,
-        },
-        feature2: {
-          privileges: ['all', 'read'],
-          canUnassign: false,
-        },
-        feature3: {
-          privileges: ['all'],
-          canUnassign: true, // feature 3 has no "read" privilege governed by global "all"
-        },
-        feature4: {
-          privileges: ['all', 'read'],
-          canUnassign: false,
-        },
-      },
-    };
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...expectedFeaturePrivileges,
-      },
-      {
-        base: {
-          privileges: ['all', 'read'],
-          canUnassign: false,
-        },
-        ...expectedFeaturePrivileges,
-      },
-    ]);
-  });
-
-  it(`allows feature privileges to be set to "all" or "read" when space base is "read"`, () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: [],
-          feature: {},
-        },
-        {
-          spaces: ['foo'],
-          base: ['read'],
-          feature: {},
-        },
-      ],
-    });
-
-    const privilegeCalculator = buildEffectivePrivileges(role);
-
-    const result: AllowedPrivilege[] = privilegeCalculator.calculateAllowedPrivileges();
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...unrestrictedFeaturePrivileges,
-      },
-      {
-        base: {
-          privileges: ['all', 'read'],
-          canUnassign: true,
-        },
-        feature: {
-          feature1: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-          feature2: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-          feature3: {
-            privileges: ['all'],
-            canUnassign: true, // feature 3 has no "read" privilege governed by space "all"
-          },
-          feature4: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-        },
-      },
-    ]);
-  });
-
-  it(`allows space base privilege to be set to "all" or "read" when space base is already "all"`, () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['foo'],
-          base: ['all'],
-          feature: {},
-        },
-      ],
-    });
-
-    const privilegeCalculator = buildEffectivePrivileges(role);
-
-    const result: AllowedPrivilege[] = privilegeCalculator.calculateAllowedPrivileges();
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        feature: {
-          feature1: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-          feature2: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-          feature3: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-          feature4: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-        },
-      },
-    ]);
-  });
-
-  it(`restricts space feature privileges when global feature privileges are set`, () => {
-    const role = buildRole({
-      spacesPrivileges: [
-        {
-          spaces: ['*'],
-          base: [],
-          feature: {
-            feature1: ['all'],
-            feature2: ['read'],
-            feature4: ['all'],
-          },
-        },
-        {
-          spaces: ['foo'],
-          base: [],
-          feature: {},
-        },
-      ],
-    });
-
-    const privilegeCalculator = buildEffectivePrivileges(role);
-
-    const result: AllowedPrivilege[] = privilegeCalculator.calculateAllowedPrivileges();
-
-    expect(result).toEqual([
-      {
-        ...unrestrictedBasePrivileges,
-        ...unrestrictedFeaturePrivileges,
-      },
-      {
-        base: {
-          privileges: ['all', 'read'],
-          canUnassign: true,
-        },
-        feature: {
-          feature1: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-          feature2: {
-            privileges: ['all', 'read'],
-            canUnassign: false,
-          },
-          feature3: {
-            privileges: ['all'],
-            canUnassign: true, // feature 3 has no "read" privilege governed by space "all"
-          },
-          feature4: {
-            privileges: ['all'],
-            canUnassign: false,
-          },
-        },
-      },
-    ]);
-  });
-});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privilege_calculator.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privilege_calculator.ts
deleted file mode 100644
index c3bf12b6aef5f..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privilege_calculator.ts
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  FeaturesPrivileges,
-  KibanaPrivileges,
-  Role,
-  RoleKibanaPrivilege,
-} from '../../../../../../../common/model';
-import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
-import { KibanaAllowedPrivilegesCalculator } from './kibana_allowed_privileges_calculator';
-import { KibanaBasePrivilegeCalculator } from './kibana_base_privilege_calculator';
-import { KibanaFeaturePrivilegeCalculator } from './kibana_feature_privilege_calculator';
-import { AllowedPrivilege, CalculatedPrivilege } from './kibana_privilege_calculator_types';
-
-export class KibanaPrivilegeCalculator {
-  private allowedPrivilegesCalculator: KibanaAllowedPrivilegesCalculator;
-
-  private effectiveBasePrivilegesCalculator: KibanaBasePrivilegeCalculator;
-
-  private effectiveFeaturePrivilegesCalculator: KibanaFeaturePrivilegeCalculator;
-
-  constructor(
-    private readonly kibanaPrivileges: KibanaPrivileges,
-    private readonly role: Role,
-    public readonly rankedFeaturePrivileges: FeaturesPrivileges
-  ) {
-    const globalPrivilege = this.locateGlobalPrivilege(role);
-
-    const assignedGlobalBaseActions: string[] = globalPrivilege.base[0]
-      ? kibanaPrivileges.getGlobalPrivileges().getActions(globalPrivilege.base[0])
-      : [];
-
-    this.allowedPrivilegesCalculator = new KibanaAllowedPrivilegesCalculator(
-      kibanaPrivileges,
-      role
-    );
-
-    this.effectiveBasePrivilegesCalculator = new KibanaBasePrivilegeCalculator(
-      kibanaPrivileges,
-      globalPrivilege,
-      assignedGlobalBaseActions
-    );
-
-    this.effectiveFeaturePrivilegesCalculator = new KibanaFeaturePrivilegeCalculator(
-      kibanaPrivileges,
-      globalPrivilege,
-      assignedGlobalBaseActions,
-      rankedFeaturePrivileges
-    );
-  }
-
-  public calculateEffectivePrivileges(ignoreAssigned: boolean = false): CalculatedPrivilege[] {
-    const { kibana = [] } = this.role;
-    return kibana.map(privilegeSpec =>
-      this.calculateEffectivePrivilege(privilegeSpec, ignoreAssigned)
-    );
-  }
-
-  public calculateAllowedPrivileges(): AllowedPrivilege[] {
-    const effectivePrivs = this.calculateEffectivePrivileges(true);
-    return this.allowedPrivilegesCalculator.calculateAllowedPrivileges(effectivePrivs);
-  }
-
-  private calculateEffectivePrivilege(
-    privilegeSpec: RoleKibanaPrivilege,
-    ignoreAssigned: boolean
-  ): CalculatedPrivilege {
-    const result: CalculatedPrivilege = {
-      base: this.effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(
-        privilegeSpec,
-        ignoreAssigned
-      ),
-      feature: {},
-      reserved: privilegeSpec._reserved,
-    };
-
-    // If calculations wish to ignoreAssigned, then we still need to know what the real effective base privilege is
-    // without ignoring assigned, in order to calculate the correct feature privileges.
-    const effectiveBase = ignoreAssigned
-      ? this.effectiveBasePrivilegesCalculator.getMostPermissiveBasePrivilege(privilegeSpec, false)
-      : result.base;
-
-    const allFeaturePrivileges = this.kibanaPrivileges.getFeaturePrivileges().getAllPrivileges();
-    result.feature = Object.keys(allFeaturePrivileges).reduce((acc, featureId) => {
-      return {
-        ...acc,
-        [featureId]: this.effectiveFeaturePrivilegesCalculator.getMostPermissiveFeaturePrivilege(
-          privilegeSpec,
-          effectiveBase,
-          featureId,
-          ignoreAssigned
-        ),
-      };
-    }, {});
-
-    return result;
-  }
-
-  private locateGlobalPrivilege(role: Role) {
-    const spacePrivileges = role.kibana;
-    return (
-      spacePrivileges.find(privileges => isGlobalPrivilegeDefinition(privileges)) || {
-        spaces: [] as string[],
-        base: [] as string[],
-        feature: {},
-      }
-    );
-  }
-}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privilege_calculator_types.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privilege_calculator_types.ts
deleted file mode 100644
index aeaf12d02210a..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privilege_calculator_types.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-/**
- * Describes the source of a privilege.
- */
-export enum PRIVILEGE_SOURCE {
-  /** Privilege is assigned directly to the entity */
-  SPACE_FEATURE = 10,
-
-  /** Privilege is derived from space base privilege */
-  SPACE_BASE = 20,
-
-  /** Privilege is derived from global feature privilege */
-  GLOBAL_FEATURE = 30,
-
-  /** Privilege is derived from global base privilege */
-  GLOBAL_BASE = 40,
-}
-
-export interface PrivilegeExplanation {
-  actualPrivilege: string;
-  actualPrivilegeSource: PRIVILEGE_SOURCE;
-  isDirectlyAssigned: boolean;
-  supersededPrivilege?: string;
-  supersededPrivilegeSource?: PRIVILEGE_SOURCE;
-  directlyAssignedFeaturePrivilegeMorePermissiveThanBase?: boolean;
-}
-
-export interface CalculatedPrivilege {
-  base: PrivilegeExplanation;
-  feature: {
-    [featureId: string]: PrivilegeExplanation | undefined;
-  };
-  reserved: undefined | string[];
-}
-
-export interface PrivilegeScenario {
-  actualPrivilegeSource: PRIVILEGE_SOURCE;
-  isDirectlyAssigned: boolean;
-  supersededPrivilege?: string;
-  supersededPrivilegeSource?: PRIVILEGE_SOURCE;
-  actions: string[];
-  directlyAssignedFeaturePrivilegeMorePermissiveThanBase?: boolean;
-}
-
-export interface AllowedPrivilege {
-  base: {
-    privileges: string[];
-    canUnassign: boolean;
-  };
-  feature: {
-    [featureId: string]:
-      | {
-          privileges: string[];
-          canUnassign: boolean;
-        }
-      | undefined;
-  };
-}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privileges_calculator_factory.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privileges_calculator_factory.ts
deleted file mode 100644
index febdb64b93d61..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/kibana_privileges_calculator_factory.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import {
-  FeaturesPrivileges,
-  KibanaPrivileges,
-  Role,
-  copyRole,
-} from '../../../../../../../common/model';
-import { compareActions } from '../../../../../../../common/privilege_calculator_utils';
-import { KibanaPrivilegeCalculator } from './kibana_privilege_calculator';
-
-export class KibanaPrivilegeCalculatorFactory {
-  /** All feature privileges, sorted from most permissive => least permissive. */
-  public readonly rankedFeaturePrivileges: FeaturesPrivileges;
-
-  constructor(private readonly kibanaPrivileges: KibanaPrivileges) {
-    this.rankedFeaturePrivileges = {};
-    const featurePrivilegeSet = kibanaPrivileges.getFeaturePrivileges().getAllPrivileges();
-
-    Object.entries(featurePrivilegeSet).forEach(([featureId, privileges]) => {
-      this.rankedFeaturePrivileges[featureId] = privileges.sort((privilege1, privilege2) => {
-        const privilege1Actions = kibanaPrivileges
-          .getFeaturePrivileges()
-          .getActions(featureId, privilege1);
-        const privilege2Actions = kibanaPrivileges
-          .getFeaturePrivileges()
-          .getActions(featureId, privilege2);
-        return compareActions(privilege1Actions, privilege2Actions);
-      });
-    });
-  }
-
-  /**
-   * Creates an KibanaPrivilegeCalculator instance for the specified role.
-   * @param role
-   */
-  public getInstance(role: Role) {
-    const roleCopy = copyRole(role);
-
-    this.sortPrivileges(roleCopy);
-    return new KibanaPrivilegeCalculator(
-      this.kibanaPrivileges,
-      roleCopy,
-      this.rankedFeaturePrivileges
-    );
-  }
-
-  private sortPrivileges(role: Role) {
-    role.kibana.forEach(privilege => {
-      privilege.base.sort((privilege1, privilege2) => {
-        const privilege1Actions = this.kibanaPrivileges
-          .getSpacesPrivileges()
-          .getActions(privilege1);
-
-        const privilege2Actions = this.kibanaPrivileges
-          .getSpacesPrivileges()
-          .getActions(privilege2);
-
-        return compareActions(privilege1Actions, privilege2Actions);
-      });
-
-      Object.entries(privilege.feature).forEach(([featureId, featurePrivs]) => {
-        featurePrivs.sort((privilege1, privilege2) => {
-          const privilege1Actions = this.kibanaPrivileges
-            .getFeaturePrivileges()
-            .getActions(featureId, privilege1);
-
-          const privilege2Actions = this.kibanaPrivileges
-            .getFeaturePrivileges()
-            .getActions(featureId, privilege2);
-
-          return compareActions(privilege1Actions, privilege2Actions);
-        });
-      });
-    });
-  }
-}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privileges_region.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privileges_region.test.tsx
index 6487179b1d6e5..8fea0e02f3c8d 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privileges_region.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privileges_region.test.tsx
@@ -6,12 +6,13 @@
 
 import { shallow } from 'enzyme';
 import React from 'react';
-import { KibanaPrivileges, Role } from '../../../../../../common/model';
+import { Role } from '../../../../../../common/model';
 import { RoleValidator } from '../../validate_role';
 import { KibanaPrivilegesRegion } from './kibana_privileges_region';
 import { SimplePrivilegeSection } from './simple_privilege_section';
-import { SpaceAwarePrivilegeSection } from './space_aware_privilege_section';
 import { TransformErrorSection } from './transform_error_section';
+import { SpaceAwarePrivilegeSection } from './space_aware_privilege_section';
+import { KibanaPrivileges } from '../../../model';
 
 const buildProps = (customProps = {}) => {
   return {
@@ -39,12 +40,15 @@ const buildProps = (customProps = {}) => {
       },
     ],
     features: [],
-    kibanaPrivileges: new KibanaPrivileges({
-      global: {},
-      space: {},
-      features: {},
-      reserved: {},
-    }),
+    kibanaPrivileges: new KibanaPrivileges(
+      {
+        global: {},
+        space: {},
+        features: {},
+        reserved: {},
+      },
+      []
+    ),
     intl: null as any,
     uiCapabilities: {
       navLinks: {},
@@ -57,6 +61,7 @@ const buildProps = (customProps = {}) => {
     editable: true,
     onChange: jest.fn(),
     validator: new RoleValidator(),
+    canCustomizeSubFeaturePrivileges: true,
     ...customProps,
   };
 };
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privileges_region.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privileges_region.tsx
index a4e287632c764..284bcb29f9b6e 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privileges_region.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privileges_region.tsx
@@ -7,21 +7,20 @@
 import React, { Component } from 'react';
 import { Capabilities } from 'src/core/public';
 import { Space } from '../../../../../../../spaces/public';
-import { Feature } from '../../../../../../../features/public';
-import { KibanaPrivileges, Role } from '../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from './kibana_privilege_calculator';
+import { Role } from '../../../../../../common/model';
 import { RoleValidator } from '../../validate_role';
 import { CollapsiblePanel } from '../../collapsible_panel';
 import { SimplePrivilegeSection } from './simple_privilege_section';
 import { SpaceAwarePrivilegeSection } from './space_aware_privilege_section';
 import { TransformErrorSection } from './transform_error_section';
+import { KibanaPrivileges } from '../../../model';
 
 interface Props {
   role: Role;
   spacesEnabled: boolean;
+  canCustomizeSubFeaturePrivileges: boolean;
   spaces?: Space[];
   uiCapabilities: Capabilities;
-  features: Feature[];
   editable: boolean;
   kibanaPrivileges: KibanaPrivileges;
   onChange: (role: Role) => void;
@@ -42,31 +41,28 @@ export class KibanaPrivilegesRegion extends Component<Props, {}> {
       kibanaPrivileges,
       role,
       spacesEnabled,
+      canCustomizeSubFeaturePrivileges,
       spaces = [],
       uiCapabilities,
       onChange,
       editable,
       validator,
-      features,
     } = this.props;
 
     if (role._transform_error && role._transform_error.includes('kibana')) {
       return <TransformErrorSection />;
     }
 
-    const privilegeCalculatorFactory = new KibanaPrivilegeCalculatorFactory(kibanaPrivileges);
-
     if (spacesEnabled) {
       return (
         <SpaceAwarePrivilegeSection
           kibanaPrivileges={kibanaPrivileges}
           role={role}
-          privilegeCalculatorFactory={privilegeCalculatorFactory}
           spaces={spaces}
           uiCapabilities={uiCapabilities}
-          features={features}
           onChange={onChange}
           editable={editable}
+          canCustomizeSubFeaturePrivileges={canCustomizeSubFeaturePrivileges}
           validator={validator}
         />
       );
@@ -74,11 +70,10 @@ export class KibanaPrivilegesRegion extends Component<Props, {}> {
       return (
         <SimplePrivilegeSection
           kibanaPrivileges={kibanaPrivileges}
-          features={features}
           role={role}
-          privilegeCalculatorFactory={privilegeCalculatorFactory}
           onChange={onChange}
           editable={editable}
+          canCustomizeSubFeaturePrivileges={canCustomizeSubFeaturePrivileges}
         />
       );
     }
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_form_calculator/index.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_form_calculator/index.ts
new file mode 100644
index 0000000000000..121d615c1fc35
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_form_calculator/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { PrivilegeFormCalculator } from './privilege_form_calculator';
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_form_calculator/privilege_form_calculator.test.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_form_calculator/privilege_form_calculator.test.ts
new file mode 100644
index 0000000000000..edf2af918fd04
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_form_calculator/privilege_form_calculator.test.ts
@@ -0,0 +1,833 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { kibanaFeatures } from '../../../../__fixtures__/kibana_features';
+import { Role } from '../../../../../../../common/model';
+import { PrivilegeFormCalculator } from './privilege_form_calculator';
+
+const createRole = (kibana: Role['kibana'] = []): Role => {
+  return {
+    name: 'unit test role',
+    elasticsearch: { cluster: [], indices: [], run_as: [] },
+    kibana,
+  };
+};
+
+describe('PrivilegeFormCalculator', () => {
+  describe('#getBasePrivilege', () => {
+    it(`returns undefined when no base privilege is assigned`, () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getBasePrivilege(0)).toBeUndefined();
+    });
+
+    it(`ignores unknown base privileges`, () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['unknown'],
+          feature: {},
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getBasePrivilege(0)).toBeUndefined();
+    });
+
+    it(`returns the assigned base privilege`, () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['read'],
+          feature: {},
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getBasePrivilege(0)).toMatchObject({
+        id: 'read',
+      });
+    });
+
+    it(`returns the most permissive base privilege when multiple are assigned`, () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['read', 'all'],
+          feature: {},
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getBasePrivilege(0)).toMatchObject({
+        id: 'all',
+      });
+    });
+  });
+
+  describe('#getDisplayedPrimaryFeaturePrivilegeId', () => {
+    it('returns undefined when no privileges are assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.getDisplayedPrimaryFeaturePrivilegeId('with_sub_features', 0)
+      ).toBeUndefined();
+    });
+
+    it('returns the effective privilege id when a base privilege is assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['all'],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getDisplayedPrimaryFeaturePrivilegeId('with_sub_features', 0)).toEqual(
+        'all'
+      );
+    });
+
+    it('returns the most permissive assigned primary feature privilege id', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['read', 'all', 'minimal_read'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getDisplayedPrimaryFeaturePrivilegeId('with_sub_features', 0)).toEqual(
+        'all'
+      );
+    });
+
+    it('returns the primary version of the minimal privilege id when assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['minimal_read'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getDisplayedPrimaryFeaturePrivilegeId('with_sub_features', 0)).toEqual(
+        'read'
+      );
+    });
+  });
+
+  describe('#hasCustomizedSubFeaturePrivileges', () => {
+    it('returns false when no privileges are assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.hasCustomizedSubFeaturePrivileges('with_sub_features', 0)).toEqual(false);
+    });
+
+    it('returns false when there are no sub-feature privileges assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.hasCustomizedSubFeaturePrivileges('with_sub_features', 0)).toEqual(false);
+    });
+
+    it('returns false when the assigned sub-features are also granted by other assigned privileges', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all', 'cool_all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.hasCustomizedSubFeaturePrivileges('with_sub_features', 0)).toEqual(false);
+    });
+
+    it('returns true when the assigned sub-features are not also granted by other assigned privileges', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['read', 'cool_all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.hasCustomizedSubFeaturePrivileges('with_sub_features', 0)).toEqual(true);
+    });
+
+    it('returns true when a minimal primary feature privilege is assigned, whose corresponding primary grants sub-feature privileges which are not assigned ', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['minimal_read'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.hasCustomizedSubFeaturePrivileges('with_sub_features', 0)).toEqual(true);
+    });
+
+    it('returns false when a minimal primary feature privilege is assigned, whose corresponding primary grants sub-feature privileges which are all assigned ', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['minimal_read', 'cool_read', 'cool_toggle_2'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.hasCustomizedSubFeaturePrivileges('with_sub_features', 0)).toEqual(false);
+    });
+
+    it('returns true when a minimal primary feature privilege is assigned, whose corresponding primary does not grant all assigned sub-feature privileges', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: [
+              'minimal_read',
+              'cool_read',
+              'cool_toggle_2',
+              'cool_excluded_toggle',
+            ],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.hasCustomizedSubFeaturePrivileges('with_sub_features', 0)).toEqual(true);
+    });
+
+    it('returns false when a base privilege is assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['all'],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.hasCustomizedSubFeaturePrivileges('with_sub_features', 0)).toEqual(false);
+    });
+  });
+
+  describe('#getEffectivePrimaryFeaturePrivilege', () => {
+    it('returns undefined when no privileges are assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.getEffectivePrimaryFeaturePrivilege('with_sub_features', 0)
+      ).toBeUndefined();
+    });
+
+    it('returns the most permissive feature privilege granted by the assigned base privilege', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['read'],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectivePrimaryFeaturePrivilege('with_sub_features', 0)).toMatchObject({
+        id: 'read',
+      });
+    });
+
+    it('returns the most permissive feature privilege granted by the assigned feature privileges', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['read'],
+          feature: {
+            with_sub_features: ['read', 'all', 'minimal_all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectivePrimaryFeaturePrivilege('with_sub_features', 0)).toMatchObject({
+        id: 'all',
+      });
+    });
+
+    it('prefers `read` primary over `mininal_all`', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['minimal_all', 'read'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectivePrimaryFeaturePrivilege('with_sub_features', 0)).toMatchObject({
+        id: 'read',
+      });
+    });
+
+    it('returns the minimal primary feature privilege when assigned and not superseded', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['minimal_all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectivePrimaryFeaturePrivilege('with_sub_features', 0)).toMatchObject({
+        id: 'minimal_all',
+      });
+    });
+
+    it('ignores unknown privileges', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['unknown'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.getEffectivePrimaryFeaturePrivilege('with_sub_features', 0)
+      ).toBeUndefined();
+    });
+  });
+
+  describe('#isIndependentSubFeaturePrivilegeGranted', () => {
+    it('returns false when no privileges are assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.isIndependentSubFeaturePrivilegeGranted('with_sub_features', 'cool_toggle_1', 0)
+      ).toEqual(false);
+    });
+
+    it('returns false when an excluded sub-feature privilege is not directly assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['all'],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.isIndependentSubFeaturePrivilegeGranted(
+          'with_sub_features',
+          'cool_excluded_toggle',
+          0
+        )
+      ).toEqual(false);
+    });
+
+    it('returns true when an excluded sub-feature privilege is directly assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['all'],
+          feature: {
+            with_sub_features: ['all', 'cool_excluded_toggle'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.isIndependentSubFeaturePrivilegeGranted(
+          'with_sub_features',
+          'cool_excluded_toggle',
+          0
+        )
+      ).toEqual(true);
+    });
+
+    it('returns true when a sub-feature privilege is directly assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['all'],
+          feature: {
+            with_sub_features: ['all', 'cool_toggle_1'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.isIndependentSubFeaturePrivilegeGranted('with_sub_features', 'cool_toggle_1', 0)
+      ).toEqual(true);
+    });
+
+    it('returns true when a sub-feature privilege is inherited', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['all'],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.isIndependentSubFeaturePrivilegeGranted('with_sub_features', 'cool_toggle_1', 0)
+      ).toEqual(true);
+    });
+  });
+
+  describe('#getSelectedMutuallyExclusiveSubFeaturePrivilege', () => {
+    it('returns undefined when no privileges are assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const feature = kibanaPrivileges.getSecuredFeature('with_sub_features');
+      const coolSubFeature = feature.getSubFeatures().find(sf => sf.name === 'Cool Sub Feature')!;
+      const subFeatureGroup = coolSubFeature
+        .getPrivilegeGroups()
+        .find(pg => pg.groupType === 'mutually_exclusive')!;
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.getSelectedMutuallyExclusiveSubFeaturePrivilege(
+          'with_sub_features',
+          subFeatureGroup,
+          0
+        )
+      ).toBeUndefined();
+    });
+
+    it('returns the inherited privilege when not directly assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const feature = kibanaPrivileges.getSecuredFeature('with_sub_features');
+      const coolSubFeature = feature.getSubFeatures().find(sf => sf.name === 'Cool Sub Feature')!;
+      const subFeatureGroup = coolSubFeature
+        .getPrivilegeGroups()
+        .find(pg => pg.groupType === 'mutually_exclusive')!;
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.getSelectedMutuallyExclusiveSubFeaturePrivilege(
+          'with_sub_features',
+          subFeatureGroup,
+          0
+        )
+      ).toMatchObject({
+        id: 'cool_all',
+      });
+    });
+
+    it('returns the the most permissive effective privilege', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all', 'cool_read', 'cool_all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const feature = kibanaPrivileges.getSecuredFeature('with_sub_features');
+      const coolSubFeature = feature.getSubFeatures().find(sf => sf.name === 'Cool Sub Feature')!;
+      const subFeatureGroup = coolSubFeature
+        .getPrivilegeGroups()
+        .find(pg => pg.groupType === 'mutually_exclusive')!;
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(
+        calculator.getSelectedMutuallyExclusiveSubFeaturePrivilege(
+          'with_sub_features',
+          subFeatureGroup,
+          0
+        )
+      ).toMatchObject({
+        id: 'cool_all',
+      });
+    });
+  });
+
+  describe('#canCustomizeSubFeaturePrivileges', () => {
+    it('returns false if no privileges are assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.canCustomizeSubFeaturePrivileges('with_sub_features', 0)).toEqual(false);
+    });
+
+    it('returns false if a base privilege is assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['all'],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.canCustomizeSubFeaturePrivileges('with_sub_features', 0)).toEqual(false);
+    });
+
+    it('returns true if a minimal privilege is assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['minimal_read'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.canCustomizeSubFeaturePrivileges('with_sub_features', 0)).toEqual(true);
+    });
+
+    it('returns true if a primary feature privilege is assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['read'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+      expect(calculator.canCustomizeSubFeaturePrivileges('with_sub_features', 0)).toEqual(true);
+    });
+  });
+
+  describe('#updateSelectedFeaturePrivilegesForCustomization', () => {
+    it('returns the privileges unmodified if no primary feature privilege is assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['some-privilege'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+      expect(
+        calculator.updateSelectedFeaturePrivilegesForCustomization('with_sub_features', 0, true)
+      ).toEqual(['some-privilege']);
+
+      expect(
+        calculator.updateSelectedFeaturePrivilegesForCustomization('with_sub_features', 0, false)
+      ).toEqual(['some-privilege']);
+    });
+
+    it('switches to the minimal privilege when customizing, but explicitly grants the sub-feature privileges which were originally inherited', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['read'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+      expect(
+        calculator.updateSelectedFeaturePrivilegesForCustomization('with_sub_features', 0, true)
+      ).toEqual(['minimal_read', 'cool_read', 'cool_toggle_2']);
+    });
+
+    it('switches to the non-minimal privilege when customizing, removing all other privileges', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['minimal_read', 'cool_read', 'cool_toggle_2'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+      expect(
+        calculator.updateSelectedFeaturePrivilegesForCustomization('with_sub_features', 0, false)
+      ).toEqual(['read']);
+    });
+  });
+
+  describe('#hasSupersededInheritedPrivileges', () => {
+    // More exhaustive testing is done at the UI layer: `privilege_space_table.test.tsx`
+    it('returns false for the global privilege definition', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['foo'],
+        },
+        {
+          base: ['all'],
+          feature: {
+            with_sub_features: ['read'],
+          },
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+      expect(calculator.hasSupersededInheritedPrivileges(1)).toEqual(false);
+    });
+
+    it('returns false when the global privilege is not more permissive', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['foo'],
+        },
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+      expect(calculator.hasSupersededInheritedPrivileges(0)).toEqual(false);
+    });
+
+    it('returns true when the global feature privilege is more permissive', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['read'],
+          },
+          spaces: ['foo'],
+        },
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+      expect(calculator.hasSupersededInheritedPrivileges(0)).toEqual(true);
+    });
+
+    it('returns true when the global base privilege is more permissive', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['read'],
+          feature: {},
+          spaces: ['foo'],
+        },
+        {
+          base: ['all'],
+          feature: {},
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+      expect(calculator.hasSupersededInheritedPrivileges(0)).toEqual(true);
+    });
+
+    it('returns false when only the global base privilege is assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {},
+          spaces: ['foo'],
+        },
+        {
+          base: ['all'],
+          feature: {},
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeFormCalculator(kibanaPrivileges, role);
+
+      expect(calculator.hasSupersededInheritedPrivileges(0)).toEqual(false);
+    });
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_form_calculator/privilege_form_calculator.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_form_calculator/privilege_form_calculator.ts
new file mode 100644
index 0000000000000..8cff37f4bd4b0
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_form_calculator/privilege_form_calculator.ts
@@ -0,0 +1,303 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Role } from '../../../../../../../common/model';
+import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
+import { KibanaPrivileges, SubFeaturePrivilegeGroup } from '../../../../model';
+
+/**
+ * Calculator responsible for determining the displayed and effective privilege values for the following interfaces:
+ * - <PrivilegeSpaceForm> and children
+ * - <PrivilegeSpaceTable> and children
+ */
+export class PrivilegeFormCalculator {
+  constructor(private readonly kibanaPrivileges: KibanaPrivileges, private readonly role: Role) {}
+
+  /**
+   * Returns the assigned base privilege.
+   * If more than one base privilege is assigned, the most permissive privilege will be returned.
+   * If no base privileges are assigned, then this will return `undefined`.
+   *
+   * @param privilegeIndex the index of the kibana privileges role component
+   */
+  public getBasePrivilege(privilegeIndex: number) {
+    const entry = this.role.kibana[privilegeIndex];
+
+    const basePrivileges = this.kibanaPrivileges.getBasePrivileges(entry);
+    return basePrivileges.find(bp => entry.base.includes(bp.id));
+  }
+
+  /**
+   * Returns the ID of the *displayed* Primary Feature Privilege for the indicated feature and privilege index.
+   * If the effective primary feature privilege is a "minimal" version, then this returns the corresponding non-minimal version.
+   *
+   * @example
+   * The following kibana privilege entry will return `read`:
+   * ```ts
+   * const entry = {
+   *    base: [],
+   *    feature: {
+   *       some_feature: ['minimal_read'],
+   *    }
+   * }
+   * ```
+   *
+   * @param featureId the feature id to get the Primary Feature KibanaPrivilege for.
+   * @param privilegeIndex the index of the kibana privileges role component
+   */
+  public getDisplayedPrimaryFeaturePrivilegeId(featureId: string, privilegeIndex: number) {
+    return this.getDisplayedPrimaryFeaturePrivilege(featureId, privilegeIndex)?.id;
+  }
+
+  /**
+   * Determines if the indicated feature has sub-feature privilege assignments which differ from the "displayed" primary feature privilege.
+   *
+   * @param featureId the feature id
+   * @param privilegeIndex the index of the kibana privileges role component
+   */
+  public hasCustomizedSubFeaturePrivileges(featureId: string, privilegeIndex: number) {
+    const feature = this.kibanaPrivileges.getSecuredFeature(featureId);
+
+    const displayedPrimary = this.getDisplayedPrimaryFeaturePrivilege(featureId, privilegeIndex);
+
+    const formPrivileges = this.kibanaPrivileges.createCollectionFromRoleKibanaPrivileges([
+      this.role.kibana[privilegeIndex],
+    ]);
+
+    return feature.getSubFeaturePrivileges().some(sfp => {
+      const isGranted = formPrivileges.grantsPrivilege(sfp);
+      const isGrantedByDisplayedPrimary = displayedPrimary?.grantsPrivilege(sfp) ?? isGranted;
+
+      return isGranted !== isGrantedByDisplayedPrimary;
+    });
+  }
+
+  /**
+   * Returns the most permissive effective Primary Feature KibanaPrivilege, including the minimal versions.
+   *
+   * @param featureId the feature id
+   * @param privilegeIndex the index of the kibana privileges role component
+   */
+  public getEffectivePrimaryFeaturePrivilege(featureId: string, privilegeIndex: number) {
+    const feature = this.kibanaPrivileges.getSecuredFeature(featureId);
+
+    const basePrivilege = this.getBasePrivilege(privilegeIndex);
+
+    const selectedFeaturePrivileges = this.getSelectedFeaturePrivileges(featureId, privilegeIndex);
+
+    return feature
+      .getPrimaryFeaturePrivileges({ includeMinimalFeaturePrivileges: true })
+      .find(fp => {
+        return selectedFeaturePrivileges.includes(fp.id) || basePrivilege?.grantsPrivilege(fp);
+      });
+  }
+
+  /**
+   * Determines if the indicated sub-feature privilege is granted.
+   *
+   * @param featureId the feature id
+   * @param privilegeId the sub feature privilege id
+   * @param privilegeIndex the index of the kibana privileges role component
+   */
+  public isIndependentSubFeaturePrivilegeGranted(
+    featureId: string,
+    privilegeId: string,
+    privilegeIndex: number
+  ) {
+    const kibanaPrivilege = this.role.kibana[privilegeIndex];
+
+    const feature = this.kibanaPrivileges.getSecuredFeature(featureId);
+    const subFeaturePrivilege = feature
+      .getSubFeaturePrivileges()
+      .find(ap => ap.id === privilegeId)!;
+
+    const assignedPrivileges = this.kibanaPrivileges.createCollectionFromRoleKibanaPrivileges([
+      kibanaPrivilege,
+    ]);
+
+    return assignedPrivileges.grantsPrivilege(subFeaturePrivilege);
+  }
+
+  /**
+   * Returns the most permissive effective privilege within the indicated mutually-exclusive sub feature privilege group.
+   *
+   * @param featureId the feature id
+   * @param subFeatureGroup the mutually-exclusive sub feature group
+   * @param privilegeIndex the index of the kibana privileges role component
+   */
+  public getSelectedMutuallyExclusiveSubFeaturePrivilege(
+    featureId: string,
+    subFeatureGroup: SubFeaturePrivilegeGroup,
+    privilegeIndex: number
+  ) {
+    const kibanaPrivilege = this.role.kibana[privilegeIndex];
+    const assignedPrivileges = this.kibanaPrivileges.createCollectionFromRoleKibanaPrivileges([
+      kibanaPrivilege,
+    ]);
+
+    return subFeatureGroup.privileges.find(p => {
+      return assignedPrivileges.grantsPrivilege(p);
+    });
+  }
+
+  /**
+   * Determines if the indicated feature is capable of having its sub-feature privileges customized.
+   *
+   * @param featureId the feature id
+   * @param privilegeIndex the index of the kibana privileges role component
+   */
+  public canCustomizeSubFeaturePrivileges(featureId: string, privilegeIndex: number) {
+    const selectedFeaturePrivileges = this.getSelectedFeaturePrivileges(featureId, privilegeIndex);
+    const feature = this.kibanaPrivileges.getSecuredFeature(featureId);
+
+    return feature
+      .getPrimaryFeaturePrivileges({ includeMinimalFeaturePrivileges: true })
+      .some(apfp => selectedFeaturePrivileges.includes(apfp.id));
+  }
+
+  /**
+   * Returns an updated set of feature privileges based on the toggling of the "Customize sub-feature privileges" control.
+   *
+   * @param featureId the feature id
+   * @param privilegeIndex  the index of the kibana privileges role component
+   * @param willBeCustomizing flag indicating if this feature is about to have its sub-feature privileges customized or not
+   */
+  public updateSelectedFeaturePrivilegesForCustomization(
+    featureId: string,
+    privilegeIndex: number,
+    willBeCustomizing: boolean
+  ) {
+    const primary = this.getDisplayedPrimaryFeaturePrivilege(featureId, privilegeIndex);
+    const selectedFeaturePrivileges = this.getSelectedFeaturePrivileges(featureId, privilegeIndex);
+
+    if (!primary) {
+      return selectedFeaturePrivileges;
+    }
+
+    const nextPrivileges = [];
+
+    if (willBeCustomizing) {
+      const feature = this.kibanaPrivileges.getSecuredFeature(featureId);
+
+      const startingPrivileges = feature
+        .getSubFeaturePrivileges()
+        .filter(ap => primary.grantsPrivilege(ap))
+        .map(p => p.id);
+
+      nextPrivileges.push(primary.getMinimalPrivilegeId(), ...startingPrivileges);
+    } else {
+      nextPrivileges.push(primary.id);
+    }
+
+    return nextPrivileges;
+  }
+
+  /**
+   * Determines if the indicated privilege entry is less permissive than the configured "global" entry for the role.
+   * @param privilegeIndex the index of the kibana privileges role component
+   */
+  public hasSupersededInheritedPrivileges(privilegeIndex: number) {
+    const global = this.locateGlobalPrivilege(this.role);
+
+    const entry = this.role.kibana[privilegeIndex];
+
+    if (isGlobalPrivilegeDefinition(entry) || !global) {
+      return false;
+    }
+
+    const globalPrivileges = this.kibanaPrivileges.createCollectionFromRoleKibanaPrivileges([
+      global,
+    ]);
+
+    const formPrivileges = this.kibanaPrivileges.createCollectionFromRoleKibanaPrivileges([entry]);
+
+    const hasAssignedBasePrivileges = this.kibanaPrivileges
+      .getBasePrivileges(entry)
+      .some(base => entry.base.includes(base.id));
+
+    const featuresWithDirectlyAssignedPrivileges = this.kibanaPrivileges
+      .getSecuredFeatures()
+      .filter(feature =>
+        feature
+          .getAllPrivileges()
+          .some(privilege => entry.feature[feature.id]?.includes(privilege.id))
+      );
+
+    const hasSupersededBasePrivileges =
+      hasAssignedBasePrivileges &&
+      this.kibanaPrivileges
+        .getBasePrivileges(entry)
+        .some(
+          privilege =>
+            globalPrivileges.grantsPrivilege(privilege) &&
+            !formPrivileges.grantsPrivilege(privilege)
+        );
+
+    const hasSupersededFeaturePrivileges = featuresWithDirectlyAssignedPrivileges.some(feature =>
+      feature
+        .getAllPrivileges()
+        .some(fp => globalPrivileges.grantsPrivilege(fp) && !formPrivileges.grantsPrivilege(fp))
+    );
+
+    return hasSupersededBasePrivileges || hasSupersededFeaturePrivileges;
+  }
+
+  /**
+   * Returns the *displayed* Primary Feature Privilege for the indicated feature and privilege index.
+   * If the effective primary feature privilege is a "minimal" version, then this returns the corresponding non-minimal version.
+   *
+   * @example
+   * The following kibana privilege entry will return `read`:
+   * ```ts
+   * const entry = {
+   *    base: [],
+   *    feature: {
+   *       some_feature: ['minimal_read'],
+   *    }
+   * }
+   * ```
+   *
+   * @param featureId the feature id to get the Primary Feature KibanaPrivilege for.
+   * @param privilegeIndex the index of the kibana privileges role component
+   */
+  private getDisplayedPrimaryFeaturePrivilege(featureId: string, privilegeIndex: number) {
+    const feature = this.kibanaPrivileges.getSecuredFeature(featureId);
+
+    const basePrivilege = this.getBasePrivilege(privilegeIndex);
+
+    const selectedFeaturePrivileges = this.getSelectedFeaturePrivileges(featureId, privilegeIndex);
+
+    return feature.getPrimaryFeaturePrivileges().find(fp => {
+      const correspondingMinimalPrivilegeId = fp.getMinimalPrivilegeId();
+
+      const correspendingMinimalPrivilege = feature
+        .getMinimalFeaturePrivileges()
+        .find(mp => mp.id === correspondingMinimalPrivilegeId)!;
+
+      // There are two cases where the minimal privileges aren't available:
+      // 1. The feature has no registered sub-features
+      // 2. Sub-feature privileges cannot be customized. When this is the case, the minimal privileges aren't registered with ES,
+      // so they end up represented in the UI as an empty privilege. Empty privileges cannot be granted other privileges, so if we
+      // encounter a minimal privilege that isn't granted by it's correspending primary, then we know we've encountered this scenario.
+      const hasMinimalPrivileges =
+        feature.subFeatures.length > 0 && fp.grantsPrivilege(correspendingMinimalPrivilege);
+      return (
+        selectedFeaturePrivileges.includes(fp.id) ||
+        (hasMinimalPrivileges &&
+          selectedFeaturePrivileges.includes(correspondingMinimalPrivilegeId)) ||
+        basePrivilege?.grantsPrivilege(fp)
+      );
+    });
+  }
+
+  private getSelectedFeaturePrivileges(featureId: string, privilegeIndex: number) {
+    return this.role.kibana[privilegeIndex].feature[featureId] ?? [];
+  }
+
+  private locateGlobalPrivilege(role: Role) {
+    return role.kibana.find(entry => isGlobalPrivilegeDefinition(entry));
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/__fixtures__/index.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/__fixtures__/index.ts
new file mode 100644
index 0000000000000..63b38b6967575
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/__fixtures__/index.ts
@@ -0,0 +1,129 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ReactWrapper } from 'enzyme';
+
+import { EuiTableRow } from '@elastic/eui';
+
+import { findTestSubject } from 'test_utils/find_test_subject';
+import { Role, RoleKibanaPrivilege } from '../../../../../../../../common/model';
+import { PrivilegeSummaryExpandedRow } from '../privilege_summary_expanded_row';
+import { FeatureTableCell } from '../../feature_table_cell';
+
+interface DisplayedFeaturePrivileges {
+  [featureId: string]: {
+    [spaceGroup: string]: {
+      primaryFeaturePrivilege: string;
+      subFeaturesPrivileges: {
+        [subFeatureName: string]: string[];
+      };
+      hasCustomizedSubFeaturePrivileges: boolean;
+    };
+  };
+}
+
+const getSpaceKey = (entry: RoleKibanaPrivilege) => entry.spaces.join(', ');
+
+export function getDisplayedFeaturePrivileges(
+  wrapper: ReactWrapper<any>,
+  role: Role
+): DisplayedFeaturePrivileges {
+  const allExpanderButtons = findTestSubject(wrapper, 'expandPrivilegeSummaryRow');
+  allExpanderButtons.forEach(button => button.simulate('click'));
+
+  // each expanded row renders its own `EuiTableRow`, so there are 2 rows
+  // for each feature: one for the primary feature privilege, and one for the sub privilege form
+  const rows = wrapper.find(EuiTableRow);
+
+  return rows.reduce((acc, row) => {
+    const expandedRow = row.find(PrivilegeSummaryExpandedRow);
+    if (expandedRow.length > 0) {
+      return {
+        ...acc,
+        ...getDisplayedSubFeaturePrivileges(acc, expandedRow, role),
+      };
+    } else {
+      const feature = row.find(FeatureTableCell).props().feature;
+
+      const primaryFeaturePrivileges = findTestSubject(row, 'privilegeColumn');
+
+      expect(primaryFeaturePrivileges).toHaveLength(role.kibana.length);
+
+      acc[feature.id] = acc[feature.id] ?? {};
+
+      primaryFeaturePrivileges.forEach((primary, index) => {
+        const key = getSpaceKey(role.kibana[index]);
+
+        acc[feature.id][key] = {
+          ...acc[feature.id][key],
+          primaryFeaturePrivilege: primary.text().trim(),
+          hasCustomizedSubFeaturePrivileges:
+            findTestSubject(primary, 'additionalPrivilegesGranted').length > 0,
+        };
+      });
+
+      return acc;
+    }
+  }, {} as DisplayedFeaturePrivileges);
+}
+
+function getDisplayedSubFeaturePrivileges(
+  displayedFeatures: DisplayedFeaturePrivileges,
+  expandedRow: ReactWrapper<any>,
+  role: Role
+) {
+  const { feature } = expandedRow.props();
+
+  const subFeatureEntries = findTestSubject(expandedRow as ReactWrapper<any>, 'subFeatureEntry');
+
+  displayedFeatures[feature.id] = displayedFeatures[feature.id] ?? {};
+
+  subFeatureEntries.forEach(subFeatureEntry => {
+    const subFeatureName = findTestSubject(subFeatureEntry, 'subFeatureName').text();
+
+    const entryElements = findTestSubject(subFeatureEntry as ReactWrapper<any>, 'entry', '|=');
+
+    expect(entryElements).toHaveLength(role.kibana.length);
+
+    role.kibana.forEach((entry, index) => {
+      const key = getSpaceKey(entry);
+      const element = findTestSubject(expandedRow as ReactWrapper<any>, `entry-${index}`);
+
+      const independentPrivileges = element
+        .find('EuiFlexGroup[data-test-subj="independentPrivilege"]')
+        .reduce((acc2, flexGroup) => {
+          const privilegeName = findTestSubject(flexGroup, 'privilegeName').text();
+          const isGranted = flexGroup.exists('EuiIconTip[type="check"]');
+          if (isGranted) {
+            return [...acc2, privilegeName];
+          }
+          return acc2;
+        }, [] as string[]);
+
+      const mutuallyExclusivePrivileges = element
+        .find('EuiFlexGroup[data-test-subj="mutexPrivilege"]')
+        .reduce((acc2, flexGroup) => {
+          const privilegeName = findTestSubject(flexGroup, 'privilegeName').text();
+          const isGranted = flexGroup.exists('EuiIconTip[type="check"]');
+
+          if (isGranted) {
+            return [...acc2, privilegeName];
+          }
+          return acc2;
+        }, [] as string[]);
+
+      displayedFeatures[feature.id][key] = {
+        ...displayedFeatures[feature.id][key],
+        subFeaturesPrivileges: {
+          ...displayedFeatures[feature.id][key].subFeaturesPrivileges,
+          [subFeatureName]: [...independentPrivileges, ...mutuallyExclusivePrivileges],
+        },
+      };
+    });
+  });
+
+  return displayedFeatures;
+}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/index.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/index.ts
new file mode 100644
index 0000000000000..5f7dc0d99654e
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { PrivilegeSummary } from './privilege_summary';
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary.test.tsx
new file mode 100644
index 0000000000000..85144d37ce754
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary.test.tsx
@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { kibanaFeatures } from '../../../../__fixtures__/kibana_features';
+import { RoleKibanaPrivilege } from '../../../../../../../common/model';
+import { PrivilegeSummary } from '.';
+import { findTestSubject } from 'test_utils/find_test_subject';
+import { PrivilegeSummaryTable } from './privilege_summary_table';
+
+const createRole = (roleKibanaPrivileges: RoleKibanaPrivilege[]) => ({
+  name: 'some-role',
+  elasticsearch: {
+    cluster: [],
+    indices: [],
+    run_as: [],
+  },
+  kibana: roleKibanaPrivileges,
+});
+
+const spaces = [
+  {
+    id: 'default',
+    name: 'Default Space',
+    disabledFeatures: [],
+  },
+];
+
+describe('PrivilegeSummary', () => {
+  it('initially renders a button', () => {
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const role = createRole([
+      {
+        base: ['all'],
+        feature: {},
+        spaces: ['default'],
+      },
+    ]);
+
+    const wrapper = mountWithIntl(
+      <PrivilegeSummary
+        spaces={spaces}
+        kibanaPrivileges={kibanaPrivileges}
+        role={role}
+        canCustomizeSubFeaturePrivileges={true}
+      />
+    );
+
+    expect(findTestSubject(wrapper, 'viewPrivilegeSummaryButton')).toHaveLength(1);
+    expect(wrapper.find(PrivilegeSummaryTable)).toHaveLength(0);
+  });
+
+  it('clicking the button renders the privilege summary table', () => {
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const role = createRole([
+      {
+        base: ['all'],
+        feature: {},
+        spaces: ['default'],
+      },
+    ]);
+
+    const wrapper = mountWithIntl(
+      <PrivilegeSummary
+        spaces={spaces}
+        kibanaPrivileges={kibanaPrivileges}
+        role={role}
+        canCustomizeSubFeaturePrivileges={true}
+      />
+    );
+
+    findTestSubject(wrapper, 'viewPrivilegeSummaryButton').simulate('click');
+    expect(wrapper.find(PrivilegeSummaryTable)).toHaveLength(1);
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary.tsx
new file mode 100644
index 0000000000000..e0889d91d759a
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary.tsx
@@ -0,0 +1,73 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState, Fragment } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiModal,
+  EuiButtonEmpty,
+  EuiOverlayMask,
+  EuiModalHeader,
+  EuiModalHeaderTitle,
+  EuiModalBody,
+  EuiModalFooter,
+  EuiButton,
+} from '@elastic/eui';
+import { Space } from '../../../../../../../../spaces/common/model/space';
+import { Role } from '../../../../../../../common/model';
+import { PrivilegeSummaryTable } from './privilege_summary_table';
+import { KibanaPrivileges } from '../../../../model';
+
+interface Props {
+  role: Role;
+  spaces: Space[];
+  kibanaPrivileges: KibanaPrivileges;
+  canCustomizeSubFeaturePrivileges: boolean;
+}
+export const PrivilegeSummary = (props: Props) => {
+  const [isOpen, setIsOpen] = useState(false);
+
+  return (
+    <Fragment>
+      <EuiButtonEmpty onClick={() => setIsOpen(true)} data-test-subj="viewPrivilegeSummaryButton">
+        <FormattedMessage
+          id="xpack.security.management.editRole.privilegeSummary.viewSummaryButtonText"
+          defaultMessage="View privilege summary"
+        />
+      </EuiButtonEmpty>
+      {isOpen && (
+        <EuiOverlayMask>
+          <EuiModal onClose={() => setIsOpen(false)} maxWidth={false}>
+            <EuiModalHeader>
+              <EuiModalHeaderTitle>
+                <FormattedMessage
+                  id="xpack.security.management.editRole.privilegeSummary.modalHeaderTitle"
+                  defaultMessage="Privilege summary"
+                />
+              </EuiModalHeaderTitle>
+            </EuiModalHeader>
+            <EuiModalBody>
+              <PrivilegeSummaryTable
+                role={props.role}
+                spaces={props.spaces}
+                kibanaPrivileges={props.kibanaPrivileges}
+                canCustomizeSubFeaturePrivileges={props.canCustomizeSubFeaturePrivileges}
+              />
+            </EuiModalBody>
+            <EuiModalFooter>
+              <EuiButton onClick={() => setIsOpen(false)}>
+                <FormattedMessage
+                  id="xpack.security.management.editRole.privilegeSummary.closeSummaryButtonText"
+                  defaultMessage="Close"
+                />
+              </EuiButton>
+            </EuiModalFooter>
+          </EuiModal>
+        </EuiOverlayMask>
+      )}
+    </Fragment>
+  );
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_calculator.test.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_calculator.test.ts
new file mode 100644
index 0000000000000..6163a6ec7ba23
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_calculator.test.ts
@@ -0,0 +1,338 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Role } from '../../../../../../../common/model';
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { kibanaFeatures } from '../../../../__fixtures__/kibana_features';
+import { PrivilegeSummaryCalculator } from './privilege_summary_calculator';
+
+const createRole = (kibana: Role['kibana'] = []): Role => {
+  return {
+    name: 'unit test role',
+    elasticsearch: { cluster: [], indices: [], run_as: [] },
+    kibana,
+  };
+};
+describe('PrivilegeSummaryCalculator', () => {
+  describe('#getEffectiveFeaturePrivileges', () => {
+    it('returns an empty privilege set when nothing is assigned', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeSummaryCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectiveFeaturePrivileges(role.kibana[0])).toEqual({
+        excluded_from_base: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        no_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        with_excluded_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        with_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+      });
+    });
+
+    it('calculates effective privileges when inherited from the global privilege', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {},
+          spaces: ['foo'],
+        },
+        {
+          base: ['all'],
+          feature: {},
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeSummaryCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectiveFeaturePrivileges(role.kibana[0])).toEqual({
+        excluded_from_base: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        no_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_excluded_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: ['cool_all', 'cool_read', 'cool_toggle_1', 'cool_toggle_2'],
+        },
+      });
+    });
+
+    it('calculates effective privileges when there are non-superseded sub-feature privileges', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['cool_excluded_toggle'],
+          },
+          spaces: ['foo'],
+        },
+        {
+          base: ['all'],
+          feature: {
+            with_sub_features: [],
+          },
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeSummaryCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectiveFeaturePrivileges(role.kibana[0])).toEqual({
+        excluded_from_base: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        no_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_excluded_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_sub_features: {
+          hasCustomizedSubFeaturePrivileges: true,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [
+            'cool_all',
+            'cool_read',
+            'cool_toggle_1',
+            'cool_toggle_2',
+            'cool_excluded_toggle',
+          ],
+        },
+      });
+    });
+
+    it('calculates privileges for all features for a space entry', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['read'],
+          feature: {
+            excluded_from_base: ['all'],
+            no_sub_features: ['read'],
+            with_excluded_sub_features: ['all'],
+            with_sub_features: ['minimal_read', 'cool_excluded_toggle'],
+          },
+          spaces: ['foo'],
+        },
+        {
+          base: ['all'],
+          feature: {},
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeSummaryCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectiveFeaturePrivileges(role.kibana[0])).toEqual({
+        excluded_from_base: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: ['cool_all', 'cool_read', 'cool_toggle_1', 'cool_toggle_2'],
+        },
+        no_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_excluded_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_sub_features: {
+          hasCustomizedSubFeaturePrivileges: true,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [
+            'cool_all',
+            'cool_read',
+            'cool_toggle_1',
+            'cool_toggle_2',
+            'cool_excluded_toggle',
+          ],
+        },
+      });
+    });
+
+    it('calculates privileges for all features for a global entry', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: ['all'],
+          feature: {},
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeSummaryCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectiveFeaturePrivileges(role.kibana[0])).toEqual({
+        excluded_from_base: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        no_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_excluded_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: ['cool_all', 'cool_read', 'cool_toggle_1', 'cool_toggle_2'],
+        },
+      });
+    });
+
+    it('calculates privileges for a single feature at a space entry', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_excluded_sub_features: ['all'],
+          },
+          spaces: ['foo'],
+        },
+      ]);
+
+      const calculator = new PrivilegeSummaryCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectiveFeaturePrivileges(role.kibana[0])).toEqual({
+        excluded_from_base: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        no_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        with_excluded_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+      });
+    });
+
+    it('calculates privileges for a single feature at the global entry', () => {
+      const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+      const role = createRole([
+        {
+          base: [],
+          feature: {
+            with_excluded_sub_features: ['all'],
+          },
+          spaces: ['*'],
+        },
+      ]);
+
+      const calculator = new PrivilegeSummaryCalculator(kibanaPrivileges, role);
+      expect(calculator.getEffectiveFeaturePrivileges(role.kibana[0])).toEqual({
+        excluded_from_base: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        no_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+        with_excluded_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: expect.objectContaining({
+            id: 'all',
+          }),
+          subFeature: [],
+        },
+        with_sub_features: {
+          hasCustomizedSubFeaturePrivileges: false,
+          primary: undefined,
+          subFeature: [],
+        },
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_calculator.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_calculator.ts
new file mode 100644
index 0000000000000..27ed8c443045a
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_calculator.ts
@@ -0,0 +1,109 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Role, RoleKibanaPrivilege } from '../../../../../../../common/model';
+import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
+import { KibanaPrivileges, PrimaryFeaturePrivilege, SecuredFeature } from '../../../../model';
+import { PrivilegeCollection } from '../../../../model/privilege_collection';
+
+export interface EffectiveFeaturePrivileges {
+  [featureId: string]: {
+    primary?: PrimaryFeaturePrivilege;
+    subFeature: string[];
+    hasCustomizedSubFeaturePrivileges: boolean;
+  };
+}
+export class PrivilegeSummaryCalculator {
+  constructor(private readonly kibanaPrivileges: KibanaPrivileges, private readonly role: Role) {}
+
+  public getEffectiveFeaturePrivileges(entry: RoleKibanaPrivilege): EffectiveFeaturePrivileges {
+    const assignedPrivileges = this.collectAssignedPrivileges(entry);
+
+    const features = this.kibanaPrivileges.getSecuredFeatures();
+
+    return features.reduce((acc, feature) => {
+      const displayedPrimaryFeaturePrivilege = this.getDisplayedPrimaryFeaturePrivilege(
+        assignedPrivileges,
+        feature
+      );
+
+      const effectiveSubPrivileges = feature
+        .getSubFeaturePrivileges()
+        .filter(ap => assignedPrivileges.grantsPrivilege(ap));
+
+      const hasCustomizedSubFeaturePrivileges = this.hasCustomizedSubFeaturePrivileges(
+        feature,
+        displayedPrimaryFeaturePrivilege,
+        entry
+      );
+
+      return {
+        ...acc,
+        [feature.id]: {
+          primary: displayedPrimaryFeaturePrivilege,
+          hasCustomizedSubFeaturePrivileges,
+          subFeature: effectiveSubPrivileges.map(p => p.id),
+        },
+      };
+    }, {} as EffectiveFeaturePrivileges);
+  }
+
+  private hasCustomizedSubFeaturePrivileges(
+    feature: SecuredFeature,
+    displayedPrimaryFeaturePrivilege: PrimaryFeaturePrivilege | undefined,
+    entry: RoleKibanaPrivilege
+  ) {
+    const formPrivileges = this.collectAssignedPrivileges(entry);
+
+    return feature.getSubFeaturePrivileges().some(sfp => {
+      const isGranted = formPrivileges.grantsPrivilege(sfp);
+      const isGrantedByDisplayedPrimary =
+        displayedPrimaryFeaturePrivilege?.grantsPrivilege(sfp) ?? isGranted;
+
+      // if displayed primary is derived from base, then excluded sub-feature-privs should not count.
+      return isGranted !== isGrantedByDisplayedPrimary;
+    });
+  }
+
+  private getDisplayedPrimaryFeaturePrivilege(
+    assignedPrivileges: PrivilegeCollection,
+    feature: SecuredFeature
+  ) {
+    const primaryFeaturePrivileges = feature.getPrimaryFeaturePrivileges();
+    const minimalPrimaryFeaturePrivileges = feature.getMinimalFeaturePrivileges();
+
+    const hasMinimalPrivileges = feature.subFeatures.length > 0;
+
+    const effectivePrivilege = primaryFeaturePrivileges.find(pfp => {
+      const isPrimaryGranted = assignedPrivileges.grantsPrivilege(pfp);
+      if (!isPrimaryGranted && hasMinimalPrivileges) {
+        const correspondingMinimal = minimalPrimaryFeaturePrivileges.find(
+          mpfp => mpfp.id === pfp.getMinimalPrivilegeId()
+        )!;
+
+        return assignedPrivileges.grantsPrivilege(correspondingMinimal);
+      }
+      return isPrimaryGranted;
+    });
+
+    return effectivePrivilege;
+  }
+
+  private collectAssignedPrivileges(entry: RoleKibanaPrivilege) {
+    if (isGlobalPrivilegeDefinition(entry)) {
+      return this.kibanaPrivileges.createCollectionFromRoleKibanaPrivileges([entry]);
+    }
+
+    const globalPrivilege = this.locateGlobalPrivilege(this.role);
+    return this.kibanaPrivileges.createCollectionFromRoleKibanaPrivileges(
+      globalPrivilege ? [globalPrivilege, entry] : [entry]
+    );
+  }
+
+  private locateGlobalPrivilege(role: Role) {
+    return role.kibana.find(entry => isGlobalPrivilegeDefinition(entry));
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_expanded_row.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_expanded_row.tsx
new file mode 100644
index 0000000000000..3283f7a58a27c
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_expanded_row.tsx
@@ -0,0 +1,131 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { i18n } from '@kbn/i18n';
+import { EuiFlexGroup, EuiFlexItem, EuiText, EuiIconTip } from '@elastic/eui';
+import { SecuredFeature, SubFeaturePrivilegeGroup, SubFeaturePrivilege } from '../../../../model';
+import { EffectiveFeaturePrivileges } from './privilege_summary_calculator';
+
+interface Props {
+  feature: SecuredFeature;
+  effectiveFeaturePrivileges: Array<EffectiveFeaturePrivileges['featureId']>;
+}
+
+export const PrivilegeSummaryExpandedRow = (props: Props) => {
+  return (
+    <EuiFlexGroup direction="column">
+      {props.feature.getSubFeatures().map(subFeature => {
+        return (
+          <EuiFlexItem key={subFeature.name} data-test-subj="subFeatureEntry">
+            <EuiFlexGroup>
+              <EuiFlexItem>
+                <EuiText size="s" data-test-subj="subFeatureName">
+                  {subFeature.name}
+                </EuiText>
+              </EuiFlexItem>
+              {props.effectiveFeaturePrivileges.map((privs, index) => {
+                return (
+                  <EuiFlexItem key={index} data-test-subj={`entry-${index}`}>
+                    {subFeature.getPrivilegeGroups().map(renderPrivilegeGroup(privs.subFeature))}
+                  </EuiFlexItem>
+                );
+              })}
+            </EuiFlexGroup>
+          </EuiFlexItem>
+        );
+      })}
+    </EuiFlexGroup>
+  );
+
+  function renderPrivilegeGroup(effectiveSubFeaturePrivileges: string[]) {
+    return (privilegeGroup: SubFeaturePrivilegeGroup, index: number) => {
+      switch (privilegeGroup.groupType) {
+        case 'independent':
+          return renderIndependentPrivilegeGroup(
+            effectiveSubFeaturePrivileges,
+            privilegeGroup,
+            index
+          );
+        case 'mutually_exclusive':
+          return renderMutuallyExclusivePrivilegeGroup(
+            effectiveSubFeaturePrivileges,
+            privilegeGroup,
+            index
+          );
+        default:
+          throw new Error(`Unsupported privilege group type: ${privilegeGroup.groupType}`);
+      }
+    };
+  }
+
+  function renderIndependentPrivilegeGroup(
+    effectiveSubFeaturePrivileges: string[],
+    privilegeGroup: SubFeaturePrivilegeGroup,
+    index: number
+  ) {
+    return (
+      <div key={index}>
+        {privilegeGroup.privileges.map((privilege: SubFeaturePrivilege) => {
+          const isGranted = effectiveSubFeaturePrivileges.includes(privilege.id);
+          return (
+            <EuiFlexGroup gutterSize="s" data-test-subj="independentPrivilege" key={privilege.id}>
+              <EuiFlexItem grow={false}>
+                <EuiIconTip
+                  type={isGranted ? 'check' : 'cross'}
+                  color={isGranted ? 'primary' : 'danger'}
+                  content={
+                    isGranted
+                      ? i18n.translate(
+                          'xpack.security.management.editRole.privilegeSummary.privilegeGrantedIconTip',
+                          { defaultMessage: 'Privilege is granted' }
+                        )
+                      : i18n.translate(
+                          'xpack.security.management.editRole.privilegeSummary.privilegeNotGrantedIconTip',
+                          { defaultMessage: 'Privilege is not granted' }
+                        )
+                  }
+                />
+              </EuiFlexItem>
+              <EuiFlexItem>
+                <EuiText size="s" data-test-subj="privilegeName">
+                  {privilege.name}
+                </EuiText>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          );
+        })}
+      </div>
+    );
+  }
+
+  function renderMutuallyExclusivePrivilegeGroup(
+    effectiveSubFeaturePrivileges: string[],
+    privilegeGroup: SubFeaturePrivilegeGroup,
+    index: number
+  ) {
+    const firstSelectedPrivilege = privilegeGroup.privileges.find(p =>
+      effectiveSubFeaturePrivileges.includes(p.id)
+    )?.name;
+
+    return (
+      <EuiFlexGroup gutterSize="s" key={index} data-test-subj="mutexPrivilege">
+        <EuiFlexItem grow={false}>
+          <EuiIconTip
+            type={firstSelectedPrivilege ? 'check' : 'cross'}
+            color={firstSelectedPrivilege ? 'primary' : 'danger'}
+            content={firstSelectedPrivilege ? 'Privilege is granted' : 'Privilege is not granted'}
+          />
+        </EuiFlexItem>
+        <EuiFlexItem>
+          <EuiText size="s" data-test-subj="privilegeName">
+            {firstSelectedPrivilege ?? 'None'}
+          </EuiText>
+        </EuiFlexItem>
+      </EuiFlexGroup>
+    );
+  }
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_table.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_table.test.tsx
new file mode 100644
index 0000000000000..0498f099b536b
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_table.test.tsx
@@ -0,0 +1,922 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { kibanaFeatures } from '../../../../__fixtures__/kibana_features';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { PrivilegeSummaryTable } from './privilege_summary_table';
+import { RoleKibanaPrivilege } from '../../../../../../../common/model';
+import { getDisplayedFeaturePrivileges } from './__fixtures__';
+
+const createRole = (roleKibanaPrivileges: RoleKibanaPrivilege[]) => ({
+  name: 'some-role',
+  elasticsearch: {
+    cluster: [],
+    indices: [],
+    run_as: [],
+  },
+  kibana: roleKibanaPrivileges,
+});
+
+const spaces = [
+  {
+    id: 'default',
+    name: 'Default Space',
+    disabledFeatures: [],
+  },
+  {
+    id: 'space-1',
+    name: 'First Space',
+    disabledFeatures: [],
+  },
+  {
+    id: 'space-2',
+    name: 'Second Space',
+    disabledFeatures: [],
+  },
+];
+
+const maybeExpectSubFeaturePrivileges = (expect: boolean, subFeaturesPrivileges: unknown) => {
+  return expect ? { subFeaturesPrivileges } : {};
+};
+
+const expectNoPrivileges = (displayedPrivileges: any, expectSubFeatures: boolean) => {
+  expect(displayedPrivileges).toEqual({
+    excluded_from_base: {
+      '*': {
+        hasCustomizedSubFeaturePrivileges: false,
+        primaryFeaturePrivilege: 'None',
+        ...maybeExpectSubFeaturePrivileges(expectSubFeatures, {
+          'Cool Sub Feature': [],
+        }),
+      },
+    },
+    no_sub_features: {
+      '*': {
+        hasCustomizedSubFeaturePrivileges: false,
+        primaryFeaturePrivilege: 'None',
+      },
+    },
+    with_excluded_sub_features: {
+      '*': {
+        hasCustomizedSubFeaturePrivileges: false,
+        primaryFeaturePrivilege: 'None',
+        ...maybeExpectSubFeaturePrivileges(expectSubFeatures, {
+          'Excluded Sub Feature': [],
+        }),
+      },
+    },
+    with_sub_features: {
+      '*': {
+        hasCustomizedSubFeaturePrivileges: false,
+        primaryFeaturePrivilege: 'None',
+        ...maybeExpectSubFeaturePrivileges(expectSubFeatures, {
+          'Cool Sub Feature': [],
+        }),
+      },
+    },
+  });
+};
+
+describe('PrivilegeSummaryTable', () => {
+  [true, false].forEach(allowSubFeaturePrivileges => {
+    describe(`when sub feature privileges are ${
+      allowSubFeaturePrivileges ? 'allowed' : 'disallowed'
+    }`, () => {
+      it('ignores unknown base privileges', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: ['idk_what_this_means'],
+            feature: {},
+            spaces: ['*'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expectNoPrivileges(displayedPrivileges, allowSubFeaturePrivileges);
+      });
+
+      it('ignores unknown feature privileges', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: [],
+            feature: {
+              with_sub_features: ['this_doesnt_exist_either'],
+            },
+            spaces: ['*'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expectNoPrivileges(displayedPrivileges, allowSubFeaturePrivileges);
+      });
+
+      it('ignores unknown features', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: [],
+            feature: {
+              unknown_feature: ['this_doesnt_exist_either'],
+            },
+            spaces: ['*'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expectNoPrivileges(displayedPrivileges, allowSubFeaturePrivileges);
+      });
+
+      it('renders effective privileges for the global base privilege', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: ['all'],
+            feature: {},
+            spaces: ['*'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+          },
+          no_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+            },
+          },
+          with_excluded_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+          },
+          with_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 1', 'Cool toggle 2', 'All'],
+              }),
+            },
+          },
+        });
+      });
+
+      it('renders effective privileges for a global feature privilege', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: ['all'],
+            feature: {
+              with_sub_features: ['minimal_read'],
+            },
+            spaces: ['*'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+          },
+          no_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+            },
+          },
+          with_excluded_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+          },
+          with_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 1', 'Cool toggle 2', 'All'],
+              }),
+            },
+          },
+        });
+      });
+
+      it('renders effective privileges for the space base privilege', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: ['all'],
+            feature: {},
+            spaces: ['default', 'space-1'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+          },
+          no_sub_features: {
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+            },
+          },
+          with_excluded_sub_features: {
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+          },
+          with_sub_features: {
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 1', 'Cool toggle 2', 'All'],
+              }),
+            },
+          },
+        });
+      });
+
+      it('renders effective privileges for a space feature privilege', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: [],
+            feature: {
+              with_sub_features: ['minimal_read'],
+            },
+            spaces: ['default', 'space-1'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+          },
+          no_sub_features: {
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+            },
+          },
+          with_excluded_sub_features: {
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+          },
+          with_sub_features: {
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: allowSubFeaturePrivileges,
+              primaryFeaturePrivilege: allowSubFeaturePrivileges ? 'Read' : 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+          },
+        });
+      });
+
+      it('renders effective privileges for global base + space base privileges', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: ['read'],
+            feature: {},
+            spaces: ['*'],
+          },
+          {
+            base: ['all'],
+            feature: {},
+            spaces: ['default', 'space-1'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+          },
+          no_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+            },
+          },
+          with_excluded_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+          },
+          with_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 2', 'Read'],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 1', 'Cool toggle 2', 'All'],
+              }),
+            },
+          },
+        });
+      });
+
+      it('renders effective privileges for global base + space feature privileges', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: ['read'],
+            feature: {},
+            spaces: ['*'],
+          },
+          {
+            base: [],
+            feature: {
+              with_sub_features: ['minimal_read', 'cool_all'],
+            },
+            spaces: ['default', 'space-1'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+          },
+          no_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+            },
+          },
+          with_excluded_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+          },
+          with_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 2', 'Read'],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: allowSubFeaturePrivileges,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 2', 'All'],
+              }),
+            },
+          },
+        });
+      });
+
+      it('renders effective privileges for global feature + space base privileges', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: [],
+            feature: {
+              with_sub_features: ['minimal_read', 'cool_all'],
+            },
+            spaces: ['*'],
+          },
+          {
+            base: ['read'],
+            feature: {},
+            spaces: ['default', 'space-1'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+          },
+          no_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+            },
+          },
+          with_excluded_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+          },
+          with_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: allowSubFeaturePrivileges,
+              primaryFeaturePrivilege: allowSubFeaturePrivileges ? 'Read' : 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['All'],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: allowSubFeaturePrivileges,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 2', 'All'],
+              }),
+            },
+          },
+        });
+      });
+
+      it('renders effective privileges for global feature + space feature privileges', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: [],
+            feature: {
+              with_sub_features: ['minimal_read', 'cool_all'],
+            },
+            spaces: ['*'],
+          },
+          {
+            base: [],
+            feature: {
+              with_sub_features: ['all'],
+            },
+            spaces: ['default', 'space-1'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+          },
+          no_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+            },
+          },
+          with_excluded_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+          },
+          with_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: allowSubFeaturePrivileges,
+              primaryFeaturePrivilege: allowSubFeaturePrivileges ? 'Read' : 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['All'],
+              }),
+            },
+            'default, space-1': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 1', 'Cool toggle 2', 'All'],
+              }),
+            },
+          },
+        });
+      });
+
+      it('renders effective privileges for a complex setup', () => {
+        const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures, {
+          allowSubFeaturePrivileges,
+        });
+
+        const role = createRole([
+          {
+            base: ['read'],
+            feature: {},
+            spaces: ['*'],
+          },
+          {
+            base: ['read', 'all'],
+            feature: {},
+            spaces: ['default'],
+          },
+          {
+            base: [],
+            feature: {
+              with_sub_features: ['minimal_read'],
+              with_excluded_sub_features: ['all', 'cool_toggle_1'],
+              no_sub_features: ['all'],
+              excluded_from_base: ['minimal_all', 'cool_toggle_1'],
+            },
+            spaces: ['space-1', 'space-2'],
+          },
+        ]);
+
+        const wrapper = mountWithIntl(
+          <PrivilegeSummaryTable
+            spaces={spaces}
+            kibanaPrivileges={kibanaPrivileges}
+            role={role}
+            canCustomizeSubFeaturePrivileges={allowSubFeaturePrivileges}
+          />
+        );
+
+        const displayedPrivileges = getDisplayedFeaturePrivileges(wrapper, role);
+
+        expect(displayedPrivileges).toEqual({
+          excluded_from_base: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+            default: {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': [],
+              }),
+            },
+            'space-1, space-2': {
+              hasCustomizedSubFeaturePrivileges: allowSubFeaturePrivileges,
+              primaryFeaturePrivilege: allowSubFeaturePrivileges ? 'All' : 'None',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 2'],
+              }),
+            },
+          },
+          no_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+            },
+            default: {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+            },
+            'space-1, space-2': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+            },
+          },
+          with_excluded_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+            default: {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': [],
+              }),
+            },
+            'space-1, space-2': {
+              hasCustomizedSubFeaturePrivileges: allowSubFeaturePrivileges,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Excluded Sub Feature': ['Cool toggle 1'],
+              }),
+            },
+          },
+          with_sub_features: {
+            '*': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 2', 'Read'],
+              }),
+            },
+            default: {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'All',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 1', 'Cool toggle 2', 'All'],
+              }),
+            },
+            'space-1, space-2': {
+              hasCustomizedSubFeaturePrivileges: false,
+              primaryFeaturePrivilege: 'Read',
+              ...maybeExpectSubFeaturePrivileges(allowSubFeaturePrivileges, {
+                'Cool Sub Feature': ['Cool toggle 2', 'Read'],
+              }),
+            },
+          },
+        });
+      });
+    });
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_table.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_table.tsx
new file mode 100644
index 0000000000000..e04ca36b6d193
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/privilege_summary_table.tsx
@@ -0,0 +1,174 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React, { useState } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import {
+  EuiInMemoryTable,
+  EuiBasicTableColumn,
+  EuiButtonIcon,
+  EuiIcon,
+  EuiIconTip,
+} from '@elastic/eui';
+import { Space } from '../../../../../../../../spaces/common/model/space';
+import { Role, RoleKibanaPrivilege } from '../../../../../../../common/model';
+import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
+import { FeatureTableCell } from '../feature_table_cell';
+import { SpaceColumnHeader } from './space_column_header';
+import { PrivilegeSummaryExpandedRow } from './privilege_summary_expanded_row';
+import { SecuredFeature, KibanaPrivileges } from '../../../../model';
+import {
+  PrivilegeSummaryCalculator,
+  EffectiveFeaturePrivileges,
+} from './privilege_summary_calculator';
+
+interface Props {
+  role: Role;
+  spaces: Space[];
+  kibanaPrivileges: KibanaPrivileges;
+  canCustomizeSubFeaturePrivileges: boolean;
+}
+
+function getColumnKey(entry: RoleKibanaPrivilege) {
+  return `privilege_entry_${entry.spaces.join('|')}`;
+}
+
+export const PrivilegeSummaryTable = (props: Props) => {
+  const [expandedFeatures, setExpandedFeatures] = useState<string[]>([]);
+
+  const calculator = new PrivilegeSummaryCalculator(props.kibanaPrivileges, props.role);
+
+  const toggleExpandedFeature = (featureId: string) => {
+    if (expandedFeatures.includes(featureId)) {
+      setExpandedFeatures(expandedFeatures.filter(ef => ef !== featureId));
+    } else {
+      setExpandedFeatures([...expandedFeatures, featureId]);
+    }
+  };
+
+  const featureColumn: EuiBasicTableColumn<any> = {
+    name: 'Feature',
+    field: 'feature',
+    render: (feature: any) => {
+      return <FeatureTableCell feature={feature} />;
+    },
+  };
+  const rowExpanderColumn: EuiBasicTableColumn<any> = {
+    align: 'right',
+    width: '40px',
+    isExpander: true,
+    field: 'featureId',
+    name: '',
+    render: (featureId: string, record: any) => {
+      const feature = record.feature as SecuredFeature;
+      const hasSubFeaturePrivileges = feature.getSubFeaturePrivileges().length > 0;
+      if (!hasSubFeaturePrivileges) {
+        return null;
+      }
+      return (
+        <EuiButtonIcon
+          onClick={() => toggleExpandedFeature(featureId)}
+          data-test-subj={`expandPrivilegeSummaryRow`}
+          aria-label={expandedFeatures.includes(featureId) ? 'Collapse' : 'Expand'}
+          iconType={expandedFeatures.includes(featureId) ? 'arrowUp' : 'arrowDown'}
+        />
+      );
+    },
+  };
+
+  const rawKibanaPrivileges = [...props.role.kibana].sort((entry1, entry2) => {
+    if (isGlobalPrivilegeDefinition(entry1)) {
+      return -1;
+    }
+    if (isGlobalPrivilegeDefinition(entry2)) {
+      return 1;
+    }
+    return 0;
+  });
+  const privilegeColumns = rawKibanaPrivileges.map(entry => {
+    const key = getColumnKey(entry);
+    return {
+      name: <SpaceColumnHeader entry={entry} spaces={props.spaces} />,
+      field: key,
+      render: (kibanaPrivilege: EffectiveFeaturePrivileges, record: { featureId: string }) => {
+        const { primary, hasCustomizedSubFeaturePrivileges } = kibanaPrivilege[record.featureId];
+        let iconTip = null;
+        if (hasCustomizedSubFeaturePrivileges) {
+          iconTip = (
+            <EuiIconTip
+              size="s"
+              type="iInCircle"
+              content={
+                <span>
+                  <FormattedMessage
+                    id="xpack.security.management.editRole.privilegeSummary.additionalPrivilegesGrantedIconTip"
+                    defaultMessage="Additional privileges granted. Expand this row for more information."
+                  />
+                </span>
+              }
+            />
+          );
+        } else {
+          iconTip = <EuiIcon size="s" type="empty" />;
+        }
+        return (
+          <span
+            data-test-subj={`privilegeColumn ${
+              hasCustomizedSubFeaturePrivileges ? 'additionalPrivilegesGranted' : ''
+            }`}
+          >
+            {primary?.name ?? 'None'} {iconTip}
+          </span>
+        );
+      },
+    };
+  });
+
+  const columns: Array<EuiBasicTableColumn<any>> = [];
+  if (props.canCustomizeSubFeaturePrivileges) {
+    columns.push(rowExpanderColumn);
+  }
+  columns.push(featureColumn, ...privilegeColumns);
+
+  const privileges = rawKibanaPrivileges.reduce((acc, entry) => {
+    return {
+      ...acc,
+      [getColumnKey(entry)]: calculator.getEffectiveFeaturePrivileges(entry),
+    };
+  }, {} as Record<string, EffectiveFeaturePrivileges>);
+
+  const items = props.kibanaPrivileges.getSecuredFeatures().map(feature => {
+    return {
+      feature,
+      featureId: feature.id,
+      ...privileges,
+    };
+  });
+
+  return (
+    <EuiInMemoryTable
+      columns={columns}
+      items={items}
+      itemId="featureId"
+      rowProps={record => {
+        return {
+          'data-test-subj': `summaryTableRow-${record.featureId}`,
+        };
+      }}
+      itemIdToExpandedRowMap={expandedFeatures.reduce((acc, featureId) => {
+        return {
+          ...acc,
+          [featureId]: (
+            <PrivilegeSummaryExpandedRow
+              feature={props.kibanaPrivileges.getSecuredFeature(featureId)}
+              effectiveFeaturePrivileges={Object.values(privileges).map(p => p[featureId])}
+            />
+          ),
+        };
+      }, {})}
+    />
+  );
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/space_column_header.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/space_column_header.test.tsx
new file mode 100644
index 0000000000000..b691056528498
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/space_column_header.test.tsx
@@ -0,0 +1,123 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React from 'react';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { SpaceColumnHeader } from './space_column_header';
+import { SpacesPopoverList } from '../../../spaces_popover_list';
+import { SpaceAvatar } from '../../../../../../../../spaces/public';
+
+const spaces = [
+  {
+    id: '*',
+    name: 'Global',
+    disabledFeatures: [],
+  },
+  {
+    id: 'space-1',
+    name: 'Space 1',
+    disabledFeatures: [],
+  },
+  {
+    id: 'space-2',
+    name: 'Space 2',
+    disabledFeatures: [],
+  },
+  {
+    id: 'space-3',
+    name: 'Space 3',
+    disabledFeatures: [],
+  },
+  {
+    id: 'space-4',
+    name: 'Space 4',
+    disabledFeatures: [],
+  },
+  {
+    id: 'space-5',
+    name: 'Space 5',
+    disabledFeatures: [],
+  },
+];
+
+describe('SpaceColumnHeader', () => {
+  it('renders the Global privilege definition with a special label and popover control', () => {
+    const wrapper = mountWithIntl(
+      <SpaceColumnHeader
+        spaces={spaces}
+        entry={{
+          base: [],
+          feature: {},
+          spaces: ['*'],
+        }}
+      />
+    );
+
+    expect(wrapper.find(SpacesPopoverList)).toHaveLength(1);
+    // Snapshot includes space avatar (The first "G"), followed by the "Global" label,
+    // followed by the (all spaces) text as part of the SpacesPopoverList
+    expect(wrapper.text()).toMatchInlineSnapshot(`"G Global(all spaces)"`);
+  });
+
+  it('renders a placeholder space when the requested space no longer exists', () => {
+    const wrapper = mountWithIntl(
+      <SpaceColumnHeader
+        spaces={spaces}
+        entry={{
+          base: [],
+          feature: {},
+          spaces: ['space-1', 'missing-space', 'space-3'],
+        }}
+      />
+    );
+
+    expect(wrapper.find(SpacesPopoverList)).toHaveLength(0);
+
+    const avatars = wrapper.find(SpaceAvatar);
+    expect(avatars).toHaveLength(3);
+
+    expect(wrapper.text()).toMatchInlineSnapshot(`"S1 m S3 "`);
+  });
+
+  it('renders a space privilege definition with an avatar for each space in the group', () => {
+    const wrapper = mountWithIntl(
+      <SpaceColumnHeader
+        spaces={spaces}
+        entry={{
+          base: [],
+          feature: {},
+          spaces: ['space-1', 'space-2', 'space-3', 'space-4'],
+        }}
+      />
+    );
+
+    expect(wrapper.find(SpacesPopoverList)).toHaveLength(0);
+
+    const avatars = wrapper.find(SpaceAvatar);
+    expect(avatars).toHaveLength(4);
+
+    expect(wrapper.text()).toMatchInlineSnapshot(`"S1 S2 S3 S4 "`);
+  });
+
+  it('renders a space privilege definition with an avatar for the first 4 spaces in the group, with the popover control showing the rest', () => {
+    const wrapper = mountWithIntl(
+      <SpaceColumnHeader
+        spaces={spaces}
+        entry={{
+          base: [],
+          feature: {},
+          spaces: ['space-1', 'space-2', 'space-3', 'space-4', 'space-5'],
+        }}
+      />
+    );
+
+    expect(wrapper.find(SpacesPopoverList)).toHaveLength(1);
+
+    const avatars = wrapper.find(SpaceAvatar);
+    expect(avatars).toHaveLength(4);
+
+    expect(wrapper.text()).toMatchInlineSnapshot(`"S1 S2 S3 S4 +1 more"`);
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/space_column_header.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/space_column_header.tsx
new file mode 100644
index 0000000000000..8ed9bb449b595
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/privilege_summary/space_column_header.tsx
@@ -0,0 +1,78 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import React, { Fragment } from 'react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+import { Space, SpaceAvatar } from '../../../../../../../../spaces/public';
+import { RoleKibanaPrivilege } from '../../../../../../../common/model';
+import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
+import { SpacesPopoverList } from '../../../spaces_popover_list';
+
+interface Props {
+  spaces: Space[];
+  entry: RoleKibanaPrivilege;
+}
+
+const SPACES_DISPLAY_COUNT = 4;
+
+export const SpaceColumnHeader = (props: Props) => {
+  const isGlobal = isGlobalPrivilegeDefinition(props.entry);
+  const entrySpaces = props.entry.spaces.map(spaceId => {
+    return (
+      props.spaces.find(s => s.id === spaceId) ?? {
+        id: spaceId,
+        name: spaceId,
+        disabledFeatures: [],
+      }
+    );
+  });
+  return (
+    <div>
+      {entrySpaces.slice(0, SPACES_DISPLAY_COUNT).map(space => {
+        return (
+          <span key={space.id}>
+            <SpaceAvatar size="s" space={space} />{' '}
+            {isGlobal && (
+              <span>
+                <FormattedMessage
+                  id="xpack.security.management.editRole.spacePrivilegeMatrix.globalSpaceName"
+                  defaultMessage="Global"
+                />
+                <br />
+                <SpacesPopoverList
+                  spaces={props.spaces.filter(s => s.id !== '*')}
+                  buttonText={i18n.translate(
+                    'xpack.security.management.editRole.spacePrivilegeMatrix.showAllSpacesLink',
+                    {
+                      defaultMessage: '(all spaces)',
+                    }
+                  )}
+                />
+              </span>
+            )}
+          </span>
+        );
+      })}
+      {entrySpaces.length > SPACES_DISPLAY_COUNT && (
+        <Fragment>
+          <br />
+          <SpacesPopoverList
+            spaces={entrySpaces}
+            buttonText={i18n.translate(
+              'xpack.security.management.editRole.spacePrivilegeMatrix.showNMoreSpacesLink',
+              {
+                defaultMessage: '+{count} more',
+                values: {
+                  count: entrySpaces.length - SPACES_DISPLAY_COUNT,
+                },
+              }
+            )}
+          />
+        </Fragment>
+      )}
+    </div>
+  );
+};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/__snapshots__/simple_privilege_section.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/__snapshots__/simple_privilege_section.test.tsx.snap
index 4d8f590f286ae..7873e47d2e0ff 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/__snapshots__/simple_privilege_section.test.tsx.snap
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/__snapshots__/simple_privilege_section.test.tsx.snap
@@ -2,153 +2,159 @@
 
 exports[`<SimplePrivilegeForm> renders without crashing 1`] = `
 <Fragment>
-  <EuiDescribedFormGroup
-    description={
-      <p>
-        <FormattedMessage
-          defaultMessage="Specifies the Kibana privilege for this role."
-          id="xpack.security.management.editRole.simplePrivilegeForm.specifyPrivilegeForRoleDescription"
-          values={Object {}}
-        />
-      </p>
-    }
-    title={
-      <h3>
-        <FormattedMessage
-          defaultMessage="Kibana privileges"
-          id="xpack.security.management.editRole.simplePrivilegeForm.kibanaPrivilegesTitle"
-          values={Object {}}
-        />
-      </h3>
-    }
+  <EuiFlexGroup
+    direction="column"
   >
-    <EuiFormRow
-      describedByIds={Array []}
-      display="row"
-      fullWidth={false}
-      hasChildLabel={true}
-      hasEmptyLabelSpace={true}
-      labelType="label"
-    >
-      <EuiSuperSelect
-        compressed={false}
-        disabled={false}
+    <EuiFlexItem>
+      <EuiText
+        color="subdued"
+        size="s"
+      >
+        <p>
+          <FormattedMessage
+            defaultMessage="Specifies the Kibana privilege for this role."
+            id="xpack.security.management.editRole.simplePrivilegeForm.specifyPrivilegeForRoleDescription"
+            values={Object {}}
+          />
+        </p>
+      </EuiText>
+    </EuiFlexItem>
+    <EuiFlexItem>
+      <EuiFormRow
+        describedByIds={Array []}
+        display="row"
         fullWidth={false}
-        hasDividers={true}
-        isInvalid={false}
-        isLoading={false}
-        onChange={[Function]}
-        options={
-          Array [
-            Object {
-              "dropdownDisplay": <EuiText>
-                <strong>
+        hasChildLabel={true}
+        hasEmptyLabelSpace={false}
+        label={
+          <FormattedMessage
+            defaultMessage="Kibana privileges"
+            id="xpack.security.management.editRole.simplePrivilegeForm.kibanaPrivilegesTitle"
+            values={Object {}}
+          />
+        }
+        labelType="label"
+      >
+        <EuiSuperSelect
+          compressed={false}
+          disabled={false}
+          fullWidth={false}
+          hasDividers={true}
+          isInvalid={false}
+          isLoading={false}
+          onChange={[Function]}
+          options={
+            Array [
+              Object {
+                "dropdownDisplay": <EuiText>
+                  <strong>
+                    <FormattedMessage
+                      defaultMessage="None"
+                      id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeDropdown"
+                      values={Object {}}
+                    />
+                  </strong>
+                  <p>
+                    <FormattedMessage
+                      defaultMessage="No access to Kibana"
+                      id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeDropdownDescription"
+                      values={Object {}}
+                    />
+                  </p>
+                </EuiText>,
+                "inputDisplay": <EuiText>
                   <FormattedMessage
                     defaultMessage="None"
-                    id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeDropdown"
+                    id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeInput"
                     values={Object {}}
                   />
-                </strong>
-                <p>
-                  <FormattedMessage
-                    defaultMessage="No access to Kibana"
-                    id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeDropdownDescription"
-                    values={Object {}}
-                  />
-                </p>
-              </EuiText>,
-              "inputDisplay": <EuiText>
-                <FormattedMessage
-                  defaultMessage="None"
-                  id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeInput"
-                  values={Object {}}
-                />
-              </EuiText>,
-              "value": "none",
-            },
-            Object {
-              "dropdownDisplay": <EuiText>
-                <strong>
+                </EuiText>,
+                "value": "none",
+              },
+              Object {
+                "dropdownDisplay": <EuiText>
+                  <strong>
+                    <FormattedMessage
+                      defaultMessage="Custom"
+                      id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeDropdown"
+                      values={Object {}}
+                    />
+                  </strong>
+                  <p>
+                    <FormattedMessage
+                      defaultMessage="Customize access to Kibana"
+                      id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeDropdownDescription"
+                      values={Object {}}
+                    />
+                  </p>
+                </EuiText>,
+                "inputDisplay": <EuiText>
                   <FormattedMessage
                     defaultMessage="Custom"
-                    id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeDropdown"
-                    values={Object {}}
-                  />
-                </strong>
-                <p>
-                  <FormattedMessage
-                    defaultMessage="Customize access to Kibana"
-                    id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeDropdownDescription"
+                    id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeInput"
                     values={Object {}}
                   />
-                </p>
-              </EuiText>,
-              "inputDisplay": <EuiText>
-                <FormattedMessage
-                  defaultMessage="Custom"
-                  id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeInput"
-                  values={Object {}}
-                />
-              </EuiText>,
-              "value": "custom",
-            },
-            Object {
-              "dropdownDisplay": <EuiText>
-                <strong>
+                </EuiText>,
+                "value": "custom",
+              },
+              Object {
+                "dropdownDisplay": <EuiText>
+                  <strong>
+                    <FormattedMessage
+                      defaultMessage="Read"
+                      id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeDropdown"
+                      values={Object {}}
+                    />
+                  </strong>
+                  <p>
+                    <FormattedMessage
+                      defaultMessage="Grants read-only access to all of Kibana"
+                      id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeDropdownDescription"
+                      values={Object {}}
+                    />
+                  </p>
+                </EuiText>,
+                "inputDisplay": <EuiText>
                   <FormattedMessage
                     defaultMessage="Read"
-                    id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeDropdown"
+                    id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeInput"
                     values={Object {}}
                   />
-                </strong>
-                <p>
-                  <FormattedMessage
-                    defaultMessage="Grants read-only access to all of Kibana"
-                    id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeDropdownDescription"
-                    values={Object {}}
-                  />
-                </p>
-              </EuiText>,
-              "inputDisplay": <EuiText>
-                <FormattedMessage
-                  defaultMessage="Read"
-                  id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeInput"
-                  values={Object {}}
-                />
-              </EuiText>,
-              "value": "read",
-            },
-            Object {
-              "dropdownDisplay": <EuiText>
-                <strong>
+                </EuiText>,
+                "value": "read",
+              },
+              Object {
+                "dropdownDisplay": <EuiText>
+                  <strong>
+                    <FormattedMessage
+                      defaultMessage="All"
+                      id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeDropdown"
+                      values={Object {}}
+                    />
+                  </strong>
+                  <p>
+                    <FormattedMessage
+                      defaultMessage="Grants full access to all of Kibana"
+                      id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeDropdownDescription"
+                      values={Object {}}
+                    />
+                  </p>
+                </EuiText>,
+                "inputDisplay": <EuiText>
                   <FormattedMessage
                     defaultMessage="All"
-                    id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeDropdown"
-                    values={Object {}}
-                  />
-                </strong>
-                <p>
-                  <FormattedMessage
-                    defaultMessage="Grants full access to all of Kibana"
-                    id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeDropdownDescription"
+                    id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeInput"
                     values={Object {}}
                   />
-                </p>
-              </EuiText>,
-              "inputDisplay": <EuiText>
-                <FormattedMessage
-                  defaultMessage="All"
-                  id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeInput"
-                  values={Object {}}
-                />
-              </EuiText>,
-              "value": "all",
-            },
-          ]
-        }
-        valueOfSelected="none"
-      />
-    </EuiFormRow>
-  </EuiDescribedFormGroup>
+                </EuiText>,
+                "value": "all",
+              },
+            ]
+          }
+          valueOfSelected="none"
+        />
+      </EuiFormRow>
+    </EuiFlexItem>
+  </EuiFlexGroup>
 </Fragment>
 `;
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/simple_privilege_section.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/simple_privilege_section.test.tsx
index db1e3cfd61621..7ecf32ee45b85 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/simple_privilege_section.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/simple_privilege_section.test.tsx
@@ -7,24 +7,53 @@
 import { EuiButtonGroup, EuiButtonGroupProps, EuiComboBox, EuiSuperSelect } from '@elastic/eui';
 import React from 'react';
 import { mountWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
-import { Feature } from '../../../../../../../../features/public';
-import { KibanaPrivileges, Role } from '../../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from '../kibana_privilege_calculator';
+import { Role } from '../../../../../../../common/model';
 import { SimplePrivilegeSection } from './simple_privilege_section';
 import { UnsupportedSpacePrivilegesWarning } from './unsupported_space_privileges_warning';
+import { KibanaPrivileges, SecuredFeature } from '../../../../model';
 
 const buildProps = (customProps: any = {}) => {
-  const kibanaPrivileges = new KibanaPrivileges({
-    features: {
-      feature1: {
-        all: ['*'],
-        read: ['read'],
+  const features = [
+    new SecuredFeature({
+      id: 'feature1',
+      name: 'Feature 1',
+      app: ['app'],
+      icon: 'spacesApp',
+      privileges: {
+        all: {
+          app: ['app'],
+          savedObject: {
+            all: ['foo'],
+            read: [],
+          },
+          ui: ['app-ui'],
+        },
+        read: {
+          app: ['app'],
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: ['app-ui'],
+        },
       },
+    }),
+  ] as SecuredFeature[];
+
+  const kibanaPrivileges = new KibanaPrivileges(
+    {
+      features: {
+        feature1: {
+          all: ['*'],
+          read: ['read'],
+        },
+      },
+      global: {},
+      space: {},
+      reserved: {},
     },
-    global: {},
-    space: {},
-    reserved: {},
-  });
+    features
+  );
 
   const role = {
     name: '',
@@ -40,34 +69,9 @@ const buildProps = (customProps: any = {}) => {
   return {
     editable: true,
     kibanaPrivileges,
-    privilegeCalculatorFactory: new KibanaPrivilegeCalculatorFactory(kibanaPrivileges),
-    features: [
-      {
-        id: 'feature1',
-        name: 'Feature 1',
-        app: ['app'],
-        icon: 'spacesApp',
-        privileges: {
-          all: {
-            app: ['app'],
-            savedObject: {
-              all: ['foo'],
-              read: [],
-            },
-            ui: ['app-ui'],
-          },
-          read: {
-            app: ['app'],
-            savedObject: {
-              all: [],
-              read: [],
-            },
-            ui: ['app-ui'],
-          },
-        },
-      },
-    ] as Feature[],
+    features,
     onChange: jest.fn(),
+    canCustomizeSubFeaturePrivileges: true,
     ...customProps,
     role,
   };
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/simple_privilege_section.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/simple_privilege_section.tsx
index 2221fc6bab279..d68d43e8089c7 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/simple_privilege_section.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/simple_privilege_section/simple_privilege_section.tsx
@@ -6,34 +6,28 @@
 
 import {
   EuiComboBox,
-  EuiDescribedFormGroup,
   EuiFormRow,
   EuiSuperSelect,
   EuiText,
+  EuiFlexGroup,
+  EuiFlexItem,
 } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { Component, Fragment } from 'react';
-
-import { Feature } from '../../../../../../../../features/public';
-import {
-  KibanaPrivileges,
-  Role,
-  RoleKibanaPrivilege,
-  copyRole,
-} from '../../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from '../kibana_privilege_calculator';
+import { Role, RoleKibanaPrivilege, copyRole } from '../../../../../../../common/model';
 import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
 import { CUSTOM_PRIVILEGE_VALUE, NO_PRIVILEGE_VALUE } from '../constants';
 import { FeatureTable } from '../feature_table';
 import { UnsupportedSpacePrivilegesWarning } from './unsupported_space_privileges_warning';
+import { KibanaPrivileges } from '../../../../model';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
 
 interface Props {
   role: Role;
   kibanaPrivileges: KibanaPrivileges;
-  privilegeCalculatorFactory: KibanaPrivilegeCalculatorFactory;
-  features: Feature[];
   onChange: (role: Role) => void;
   editable: boolean;
+  canCustomizeSubFeaturePrivileges: boolean;
 }
 
 interface State {
@@ -58,20 +52,14 @@ export class SimplePrivilegeSection extends Component<Props, State> {
   public render() {
     const kibanaPrivilege = this.getDisplayedBasePrivilege();
 
-    const privilegeCalculator = this.props.privilegeCalculatorFactory.getInstance(this.props.role);
-
-    const calculatedPrivileges = privilegeCalculator.calculateEffectivePrivileges()[
-      this.state.globalPrivsIndex
-    ];
-
-    const allowedPrivileges = privilegeCalculator.calculateAllowedPrivileges()[
-      this.state.globalPrivsIndex
-    ];
+    const reservedPrivileges = this.props.role.kibana[this.state.globalPrivsIndex]?._reserved ?? [];
 
-    const hasReservedPrivileges =
-      calculatedPrivileges &&
-      calculatedPrivileges.reserved != null &&
-      calculatedPrivileges.reserved.length > 0;
+    const title = (
+      <FormattedMessage
+        id="xpack.security.management.editRole.simplePrivilegeForm.kibanaPrivilegesTitle"
+        defaultMessage="Kibana privileges"
+      />
+    );
 
     const description = (
       <p>
@@ -84,162 +72,159 @@ export class SimplePrivilegeSection extends Component<Props, State> {
 
     return (
       <Fragment>
-        <EuiDescribedFormGroup
-          title={
-            <h3>
-              <FormattedMessage
-                id="xpack.security.management.editRole.simplePrivilegeForm.kibanaPrivilegesTitle"
-                defaultMessage="Kibana privileges"
-              />
-            </h3>
-          }
-          description={description}
-        >
-          <EuiFormRow hasEmptyLabelSpace>
-            {hasReservedPrivileges ? (
-              <EuiComboBox
-                fullWidth
-                selectedOptions={calculatedPrivileges.reserved!.map(privilege => ({
-                  label: privilege,
-                }))}
-                isDisabled
-              />
-            ) : (
-              <EuiSuperSelect
-                disabled={!this.props.editable}
-                onChange={this.onKibanaPrivilegeChange}
-                options={[
-                  {
-                    value: NO_PRIVILEGE_VALUE,
-                    inputDisplay: (
-                      <EuiText>
-                        <FormattedMessage
-                          id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeInput"
-                          defaultMessage="None"
-                        />
-                      </EuiText>
-                    ),
-                    dropdownDisplay: (
-                      <EuiText>
-                        <strong>
+        <EuiFlexGroup direction="column">
+          <EuiFlexItem>
+            <EuiText size="s" color="subdued">
+              {description}
+            </EuiText>
+          </EuiFlexItem>
+          <EuiFlexItem>
+            <EuiFormRow label={title}>
+              {reservedPrivileges.length > 0 ? (
+                <EuiComboBox
+                  fullWidth
+                  selectedOptions={reservedPrivileges.map(rp => ({ label: rp }))}
+                  isDisabled
+                />
+              ) : (
+                <EuiSuperSelect
+                  disabled={!this.props.editable}
+                  onChange={this.onKibanaPrivilegeChange}
+                  options={[
+                    {
+                      value: NO_PRIVILEGE_VALUE,
+                      inputDisplay: (
+                        <EuiText>
                           <FormattedMessage
-                            id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeDropdown"
+                            id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeInput"
                             defaultMessage="None"
                           />
-                        </strong>
-                        <p>
-                          <FormattedMessage
-                            id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeDropdownDescription"
-                            defaultMessage="No access to Kibana"
-                          />
-                        </p>
-                      </EuiText>
-                    ),
-                  },
-                  {
-                    value: CUSTOM_PRIVILEGE_VALUE,
-                    inputDisplay: (
-                      <EuiText>
-                        <FormattedMessage
-                          id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeInput"
-                          defaultMessage="Custom"
-                        />
-                      </EuiText>
-                    ),
-                    dropdownDisplay: (
-                      <EuiText>
-                        <strong>
+                        </EuiText>
+                      ),
+                      dropdownDisplay: (
+                        <EuiText>
+                          <strong>
+                            <FormattedMessage
+                              id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeDropdown"
+                              defaultMessage="None"
+                            />
+                          </strong>
+                          <p>
+                            <FormattedMessage
+                              id="xpack.security.management.editRole.simplePrivilegeForm.noPrivilegeDropdownDescription"
+                              defaultMessage="No access to Kibana"
+                            />
+                          </p>
+                        </EuiText>
+                      ),
+                    },
+                    {
+                      value: CUSTOM_PRIVILEGE_VALUE,
+                      inputDisplay: (
+                        <EuiText>
                           <FormattedMessage
-                            id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeDropdown"
+                            id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeInput"
                             defaultMessage="Custom"
                           />
-                        </strong>
-                        <p>
+                        </EuiText>
+                      ),
+                      dropdownDisplay: (
+                        <EuiText>
+                          <strong>
+                            <FormattedMessage
+                              id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeDropdown"
+                              defaultMessage="Custom"
+                            />
+                          </strong>
+                          <p>
+                            <FormattedMessage
+                              id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeDropdownDescription"
+                              defaultMessage="Customize access to Kibana"
+                            />
+                          </p>
+                        </EuiText>
+                      ),
+                    },
+                    {
+                      value: 'read',
+                      inputDisplay: (
+                        <EuiText>
                           <FormattedMessage
-                            id="xpack.security.management.editRole.simplePrivilegeForm.customPrivilegeDropdownDescription"
-                            defaultMessage="Customize access to Kibana"
-                          />
-                        </p>
-                      </EuiText>
-                    ),
-                  },
-                  {
-                    value: 'read',
-                    inputDisplay: (
-                      <EuiText>
-                        <FormattedMessage
-                          id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeInput"
-                          defaultMessage="Read"
-                        />
-                      </EuiText>
-                    ),
-                    dropdownDisplay: (
-                      <EuiText>
-                        <strong>
-                          <FormattedMessage
-                            id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeDropdown"
+                            id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeInput"
                             defaultMessage="Read"
                           />
-                        </strong>
-                        <p>
-                          <FormattedMessage
-                            id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeDropdownDescription"
-                            defaultMessage="Grants read-only access to all of Kibana"
-                          />
-                        </p>
-                      </EuiText>
-                    ),
-                  },
-                  {
-                    value: 'all',
-                    inputDisplay: (
-                      <EuiText>
-                        <FormattedMessage
-                          id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeInput"
-                          defaultMessage="All"
-                        />
-                      </EuiText>
-                    ),
-                    dropdownDisplay: (
-                      <EuiText>
-                        <strong>
+                        </EuiText>
+                      ),
+                      dropdownDisplay: (
+                        <EuiText>
+                          <strong>
+                            <FormattedMessage
+                              id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeDropdown"
+                              defaultMessage="Read"
+                            />
+                          </strong>
+                          <p>
+                            <FormattedMessage
+                              id="xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeDropdownDescription"
+                              defaultMessage="Grants read-only access to all of Kibana"
+                            />
+                          </p>
+                        </EuiText>
+                      ),
+                    },
+                    {
+                      value: 'all',
+                      inputDisplay: (
+                        <EuiText>
                           <FormattedMessage
-                            id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeDropdown"
+                            id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeInput"
                             defaultMessage="All"
                           />
-                        </strong>
-                        <p>
-                          <FormattedMessage
-                            id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeDropdownDescription"
-                            defaultMessage="Grants full access to all of Kibana"
-                          />
-                        </p>
-                      </EuiText>
-                    ),
-                  },
-                ]}
-                hasDividers
-                valueOfSelected={kibanaPrivilege}
-              />
-            )}
-          </EuiFormRow>
-          {this.state.isCustomizingGlobalPrivilege && (
-            <EuiFormRow>
-              <FeatureTable
-                role={this.props.role}
-                kibanaPrivileges={this.props.kibanaPrivileges}
-                calculatedPrivileges={calculatedPrivileges}
-                allowedPrivileges={allowedPrivileges}
-                rankedFeaturePrivileges={privilegeCalculator.rankedFeaturePrivileges}
-                features={this.props.features}
-                onChange={this.onFeaturePrivilegeChange}
-                onChangeAll={this.onChangeAllFeaturePrivileges}
-                spacesIndex={this.props.role.kibana.findIndex(k => isGlobalPrivilegeDefinition(k))}
-              />
+                        </EuiText>
+                      ),
+                      dropdownDisplay: (
+                        <EuiText>
+                          <strong>
+                            <FormattedMessage
+                              id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeDropdown"
+                              defaultMessage="All"
+                            />
+                          </strong>
+                          <p>
+                            <FormattedMessage
+                              id="xpack.security.management.editRole.simplePrivilegeForm.allPrivilegeDropdownDescription"
+                              defaultMessage="Grants full access to all of Kibana"
+                            />
+                          </p>
+                        </EuiText>
+                      ),
+                    },
+                  ]}
+                  hasDividers
+                  valueOfSelected={kibanaPrivilege}
+                />
+              )}
             </EuiFormRow>
-          )}
-          {this.maybeRenderSpacePrivilegeWarning()}
-        </EuiDescribedFormGroup>
+            {this.state.isCustomizingGlobalPrivilege && (
+              <EuiFormRow fullWidth>
+                <FeatureTable
+                  role={this.props.role}
+                  kibanaPrivileges={this.props.kibanaPrivileges}
+                  privilegeCalculator={
+                    new PrivilegeFormCalculator(this.props.kibanaPrivileges, this.props.role)
+                  }
+                  onChange={this.onFeaturePrivilegeChange}
+                  onChangeAll={this.onChangeAllFeaturePrivileges}
+                  privilegeIndex={this.props.role.kibana.findIndex(k =>
+                    isGlobalPrivilegeDefinition(k)
+                  )}
+                  canCustomizeSubFeaturePrivileges={this.props.canCustomizeSubFeaturePrivileges}
+                />
+              </EuiFormRow>
+            )}
+            {this.maybeRenderSpacePrivilegeWarning()}
+          </EuiFlexItem>
+        </EuiFlexGroup>
       </Fragment>
     );
   }
@@ -295,7 +280,7 @@ export class SimplePrivilegeSection extends Component<Props, State> {
 
     const form = this.locateGlobalPrivilege(role) || this.createGlobalPrivilegeEntry(role);
     if (privileges.length > 0) {
-      this.props.features.forEach(feature => {
+      this.props.kibanaPrivileges.getSecuredFeatures().forEach(feature => {
         form.feature[feature.id] = [...privileges];
       });
     } else {
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__fixtures__/raw_kibana_privileges.ts b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__fixtures__/raw_kibana_privileges.ts
deleted file mode 100644
index 428836c9f181b..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__fixtures__/raw_kibana_privileges.ts
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { RawKibanaPrivileges } from '../../../../../../../../common/model';
-
-export const rawKibanaPrivileges: RawKibanaPrivileges = {
-  global: {
-    all: [
-      'normal-feature-all',
-      'normal-feature-read',
-      'just-global-all',
-      'all-privilege-excluded-from-base-read',
-    ],
-    read: ['normal-feature-read', 'all-privilege-excluded-from-base-read'],
-  },
-  space: {
-    all: ['normal-feature-all', 'normal-feature-read', 'all-privilege-excluded-from-base-read'],
-    read: ['normal-feature-read', 'all-privilege-excluded-from-base-read'],
-  },
-  reserved: {},
-  features: {
-    normal: {
-      all: ['normal-feature-all', 'normal-feature-read'],
-      read: ['normal-feature-read'],
-    },
-    bothPrivilegesExcludedFromBase: {
-      all: ['both-privileges-excluded-from-base-all', 'both-privileges-excluded-from-base-read'],
-      read: ['both-privileges-excluded-from-base-read'],
-    },
-    allPrivilegeExcludedFromBase: {
-      all: ['all-privilege-excluded-from-base-all', 'all-privilege-excluded-from-base-read'],
-      read: ['all-privilege-excluded-from-base-read'],
-    },
-  },
-};
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__snapshots__/privilege_display.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__snapshots__/privilege_display.test.tsx.snap
deleted file mode 100644
index a3fbdebee7eba..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__snapshots__/privilege_display.test.tsx.snap
+++ /dev/null
@@ -1,118 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`PrivilegeDisplay renders a superceded privilege 1`] = `
-<SupersededPrivilegeDisplay
-  explanation={
-    Object {
-      "actualPrivilege": "all",
-      "actualPrivilegeSource": 40,
-      "isDirectlyAssigned": false,
-      "supersededPrivilege": "read",
-      "supersededPrivilegeSource": 20,
-    }
-  }
-  intl={
-    Object {
-      "defaultFormats": Object {},
-      "defaultLocale": "en",
-      "formatDate": [Function],
-      "formatHTMLMessage": [Function],
-      "formatMessage": [Function],
-      "formatNumber": [Function],
-      "formatPlural": [Function],
-      "formatRelative": [Function],
-      "formatTime": [Function],
-      "formats": Object {
-        "date": Object {
-          "full": Object {
-            "day": "numeric",
-            "month": "long",
-            "weekday": "long",
-            "year": "numeric",
-          },
-          "long": Object {
-            "day": "numeric",
-            "month": "long",
-            "year": "numeric",
-          },
-          "medium": Object {
-            "day": "numeric",
-            "month": "short",
-            "year": "numeric",
-          },
-          "short": Object {
-            "day": "numeric",
-            "month": "numeric",
-            "year": "2-digit",
-          },
-        },
-        "number": Object {
-          "currency": Object {
-            "style": "currency",
-          },
-          "percent": Object {
-            "style": "percent",
-          },
-        },
-        "relative": Object {
-          "days": Object {
-            "units": "day",
-          },
-          "hours": Object {
-            "units": "hour",
-          },
-          "minutes": Object {
-            "units": "minute",
-          },
-          "months": Object {
-            "units": "month",
-          },
-          "seconds": Object {
-            "units": "second",
-          },
-          "years": Object {
-            "units": "year",
-          },
-        },
-        "time": Object {
-          "full": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "long": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-            "timeZoneName": "short",
-          },
-          "medium": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-            "second": "numeric",
-          },
-          "short": Object {
-            "hour": "numeric",
-            "minute": "numeric",
-          },
-        },
-      },
-      "formatters": Object {
-        "getDateTimeFormat": [Function],
-        "getMessageFormat": [Function],
-        "getNumberFormat": [Function],
-        "getPluralFormat": [Function],
-        "getRelativeFormat": [Function],
-      },
-      "locale": "en",
-      "messages": Object {},
-      "now": [Function],
-      "onError": [Function],
-      "textComponent": Symbol(react.fragment),
-      "timeZone": null,
-    }
-  }
-  privilege="all"
-/>
-`;
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__snapshots__/privilege_space_form.test.tsx.snap b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__snapshots__/privilege_space_form.test.tsx.snap
deleted file mode 100644
index 8d10e27df9694..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/__snapshots__/privilege_space_form.test.tsx.snap
+++ /dev/null
@@ -1,497 +0,0 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
-
-exports[`<PrivilegeSpaceForm> renders without crashing 1`] = `
-<EuiOverlayMask>
-  <EuiFlyout
-    closeButtonAriaLabel="Closes this dialog"
-    hideCloseButton={false}
-    maxWidth={true}
-    onClose={[Function]}
-    ownFocus={false}
-    size="m"
-  >
-    <EuiFlyoutHeader
-      hasBorder={true}
-    >
-      <EuiTitle
-        size="m"
-      >
-        <h2>
-          <FormattedMessage
-            defaultMessage="Space privileges"
-            id="xpack.security.management.editRole.spacePrivilegeForm.modalTitle"
-            values={Object {}}
-          />
-        </h2>
-      </EuiTitle>
-    </EuiFlyoutHeader>
-    <EuiFlyoutBody>
-      <EuiForm>
-        <EuiFormRow
-          describedByIds={Array []}
-          display="row"
-          fullWidth={true}
-          hasChildLabel={true}
-          hasEmptyLabelSpace={false}
-          label="Spaces"
-          labelType="label"
-        >
-          <SpaceSelector
-            intl={
-              Object {
-                "defaultFormats": Object {},
-                "defaultLocale": "en",
-                "formatDate": [Function],
-                "formatHTMLMessage": [Function],
-                "formatMessage": [Function],
-                "formatNumber": [Function],
-                "formatPlural": [Function],
-                "formatRelative": [Function],
-                "formatTime": [Function],
-                "formats": Object {
-                  "date": Object {
-                    "full": Object {
-                      "day": "numeric",
-                      "month": "long",
-                      "weekday": "long",
-                      "year": "numeric",
-                    },
-                    "long": Object {
-                      "day": "numeric",
-                      "month": "long",
-                      "year": "numeric",
-                    },
-                    "medium": Object {
-                      "day": "numeric",
-                      "month": "short",
-                      "year": "numeric",
-                    },
-                    "short": Object {
-                      "day": "numeric",
-                      "month": "numeric",
-                      "year": "2-digit",
-                    },
-                  },
-                  "number": Object {
-                    "currency": Object {
-                      "style": "currency",
-                    },
-                    "percent": Object {
-                      "style": "percent",
-                    },
-                  },
-                  "relative": Object {
-                    "days": Object {
-                      "units": "day",
-                    },
-                    "hours": Object {
-                      "units": "hour",
-                    },
-                    "minutes": Object {
-                      "units": "minute",
-                    },
-                    "months": Object {
-                      "units": "month",
-                    },
-                    "seconds": Object {
-                      "units": "second",
-                    },
-                    "years": Object {
-                      "units": "year",
-                    },
-                  },
-                  "time": Object {
-                    "full": Object {
-                      "hour": "numeric",
-                      "minute": "numeric",
-                      "second": "numeric",
-                      "timeZoneName": "short",
-                    },
-                    "long": Object {
-                      "hour": "numeric",
-                      "minute": "numeric",
-                      "second": "numeric",
-                      "timeZoneName": "short",
-                    },
-                    "medium": Object {
-                      "hour": "numeric",
-                      "minute": "numeric",
-                      "second": "numeric",
-                    },
-                    "short": Object {
-                      "hour": "numeric",
-                      "minute": "numeric",
-                    },
-                  },
-                },
-                "formatters": Object {
-                  "getDateTimeFormat": [Function],
-                  "getMessageFormat": [Function],
-                  "getNumberFormat": [Function],
-                  "getPluralFormat": [Function],
-                  "getRelativeFormat": [Function],
-                },
-                "locale": "en",
-                "messages": Object {},
-                "now": [Function],
-                "onError": [Function],
-                "textComponent": Symbol(react.fragment),
-                "timeZone": null,
-              }
-            }
-            onChange={[Function]}
-            selectedSpaceIds={Array []}
-            spaces={
-              Array [
-                Object {
-                  "_reserved": true,
-                  "description": "",
-                  "disabledFeatures": Array [],
-                  "id": "default",
-                  "name": "Default Space",
-                },
-                Object {
-                  "description": "",
-                  "disabledFeatures": Array [],
-                  "id": "marketing",
-                  "name": "Marketing",
-                },
-              ]
-            }
-          />
-        </EuiFormRow>
-        <EuiFormRow
-          describedByIds={Array []}
-          display="row"
-          fullWidth={true}
-          hasChildLabel={true}
-          hasEmptyLabelSpace={false}
-          label="Privilege"
-          labelType="label"
-        >
-          <EuiSuperSelect
-            compressed={false}
-            data-test-subj="basePrivilegeComboBox"
-            disabled={true}
-            fullWidth={true}
-            hasDividers={true}
-            isInvalid={false}
-            isLoading={false}
-            onChange={[Function]}
-            options={
-              Array [
-                Object {
-                  "disabled": false,
-                  "dropdownDisplay": <EuiText>
-                    <strong>
-                      <FormattedMessage
-                        defaultMessage="Custom"
-                        id="xpack.security.management.editRole.spacePrivilegeForm.customPrivilegeDropdownDisplay"
-                        values={Object {}}
-                      />
-                    </strong>
-                    <p>
-                      <FormattedMessage
-                        defaultMessage="Customize access by feature in selected spaces."
-                        id="xpack.security.management.editRole.spacePrivilegeForm.customPrivilegeDetails"
-                        values={Object {}}
-                      />
-                    </p>
-                  </EuiText>,
-                  "inputDisplay": <EuiText>
-                    <FormattedMessage
-                      defaultMessage="Custom"
-                      id="xpack.security.management.editRole.spacePrivilegeForm.customPrivilegeDisplay"
-                      values={Object {}}
-                    />
-                  </EuiText>,
-                  "value": "basePrivilege_custom",
-                },
-                Object {
-                  "disabled": false,
-                  "dropdownDisplay": <EuiText>
-                    <strong>
-                      <FormattedMessage
-                        defaultMessage="Read"
-                        id="xpack.security.management.editRole.spacePrivilegeForm.readPrivilegeDropdownDisplay"
-                        values={Object {}}
-                      />
-                    </strong>
-                    <p>
-                      <FormattedMessage
-                        defaultMessage="Grant read-only access to all features in selected spaces."
-                        id="xpack.security.management.editRole.spacePrivilegeForm.readPrivilegeDetails"
-                        values={Object {}}
-                      />
-                    </p>
-                  </EuiText>,
-                  "inputDisplay": <EuiText>
-                    <FormattedMessage
-                      defaultMessage="Read"
-                      id="xpack.security.management.editRole.spacePrivilegeForm.readPrivilegeDisplay"
-                      values={Object {}}
-                    />
-                  </EuiText>,
-                  "value": "basePrivilege_read",
-                },
-                Object {
-                  "dropdownDisplay": <EuiText>
-                    <strong>
-                      <FormattedMessage
-                        defaultMessage="All"
-                        id="xpack.security.management.editRole.spacePrivilegeForm.allPrivilegeDropdownDisplay"
-                        values={Object {}}
-                      />
-                    </strong>
-                    <p>
-                      <FormattedMessage
-                        defaultMessage="Grant full access to all features in selected spaces."
-                        id="xpack.security.management.editRole.spacePrivilegeForm.allPrivilegeDetails"
-                        values={Object {}}
-                      />
-                    </p>
-                  </EuiText>,
-                  "inputDisplay": <EuiText>
-                    <FormattedMessage
-                      defaultMessage="All"
-                      id="xpack.security.management.editRole.spacePrivilegeForm.allPrivilegeDisplay"
-                      values={Object {}}
-                    />
-                  </EuiText>,
-                  "value": "basePrivilege_all",
-                },
-              ]
-            }
-            valueOfSelected="basePrivilege_custom"
-          />
-        </EuiFormRow>
-        <EuiSpacer
-          size="s"
-        />
-        <EuiTitle
-          size="xxs"
-        >
-          <h3>
-            Customize by feature
-          </h3>
-        </EuiTitle>
-        <EuiSpacer
-          size="xs"
-        />
-        <EuiText
-          size="s"
-        >
-          <p>
-            Increase privilege levels on a per feature basis. Some features might be hidden by the space or affected by a global space privilege.
-          </p>
-        </EuiText>
-        <EuiSpacer
-          size="l"
-        />
-        <FeatureTable
-          allowedPrivileges={
-            Object {
-              "base": Object {
-                "canUnassign": true,
-                "privileges": Array [
-                  "all",
-                  "read",
-                ],
-              },
-              "feature": Object {
-                "allPrivilegeExcludedFromBase": Object {
-                  "canUnassign": true,
-                  "privileges": Array [
-                    "all",
-                    "read",
-                  ],
-                },
-                "bothPrivilegesExcludedFromBase": Object {
-                  "canUnassign": true,
-                  "privileges": Array [
-                    "all",
-                    "read",
-                  ],
-                },
-                "normal": Object {
-                  "canUnassign": true,
-                  "privileges": Array [
-                    "all",
-                    "read",
-                  ],
-                },
-              },
-            }
-          }
-          calculatedPrivileges={
-            Object {
-              "base": Object {
-                "actualPrivilege": "none",
-                "actualPrivilegeSource": 40,
-                "isDirectlyAssigned": true,
-              },
-              "feature": Object {
-                "allPrivilegeExcludedFromBase": Object {
-                  "actualPrivilege": "none",
-                  "actualPrivilegeSource": 30,
-                  "isDirectlyAssigned": true,
-                },
-                "bothPrivilegesExcludedFromBase": Object {
-                  "actualPrivilege": "none",
-                  "actualPrivilegeSource": 30,
-                  "isDirectlyAssigned": true,
-                },
-                "normal": Object {
-                  "actualPrivilege": "none",
-                  "actualPrivilegeSource": 30,
-                  "isDirectlyAssigned": true,
-                },
-              },
-              "reserved": undefined,
-            }
-          }
-          disabled={true}
-          features={Array []}
-          kibanaPrivileges={
-            KibanaPrivileges {
-              "rawKibanaPrivileges": Object {
-                "features": Object {
-                  "allPrivilegeExcludedFromBase": Object {
-                    "all": Array [
-                      "all-privilege-excluded-from-base-all",
-                      "all-privilege-excluded-from-base-read",
-                    ],
-                    "read": Array [
-                      "all-privilege-excluded-from-base-read",
-                    ],
-                  },
-                  "bothPrivilegesExcludedFromBase": Object {
-                    "all": Array [
-                      "both-privileges-excluded-from-base-all",
-                      "both-privileges-excluded-from-base-read",
-                    ],
-                    "read": Array [
-                      "both-privileges-excluded-from-base-read",
-                    ],
-                  },
-                  "normal": Object {
-                    "all": Array [
-                      "normal-feature-all",
-                      "normal-feature-read",
-                    ],
-                    "read": Array [
-                      "normal-feature-read",
-                    ],
-                  },
-                },
-                "global": Object {
-                  "all": Array [
-                    "normal-feature-all",
-                    "normal-feature-read",
-                    "just-global-all",
-                    "all-privilege-excluded-from-base-read",
-                  ],
-                  "read": Array [
-                    "normal-feature-read",
-                    "all-privilege-excluded-from-base-read",
-                  ],
-                },
-                "reserved": Object {},
-                "space": Object {
-                  "all": Array [
-                    "normal-feature-all",
-                    "normal-feature-read",
-                    "all-privilege-excluded-from-base-read",
-                  ],
-                  "read": Array [
-                    "normal-feature-read",
-                    "all-privilege-excluded-from-base-read",
-                  ],
-                },
-              },
-            }
-          }
-          onChange={[Function]}
-          onChangeAll={[Function]}
-          rankedFeaturePrivileges={
-            Object {
-              "allPrivilegeExcludedFromBase": Array [
-                "all",
-                "read",
-              ],
-              "bothPrivilegesExcludedFromBase": Array [
-                "all",
-                "read",
-              ],
-              "normal": Array [
-                "all",
-                "read",
-              ],
-            }
-          }
-          role={
-            Object {
-              "elasticsearch": Object {
-                "cluster": Array [
-                  "all",
-                ],
-                "indices": Array [],
-                "run_as": Array [],
-              },
-              "kibana": Array [
-                Object {
-                  "base": Array [],
-                  "feature": Object {},
-                  "spaces": Array [],
-                },
-              ],
-              "name": "test role",
-            }
-          }
-          showLocks={true}
-          spacesIndex={0}
-        />
-      </EuiForm>
-    </EuiFlyoutBody>
-    <EuiFlyoutFooter>
-      <EuiFlexGroup
-        justifyContent="spaceBetween"
-      >
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButtonEmpty
-            data-test-subj="cancelSpacePrivilegeButton"
-            flush="left"
-            iconType="cross"
-            onClick={[Function]}
-          >
-            <FormattedMessage
-              defaultMessage="Cancel"
-              id="xpack.security.management.editRolespacePrivilegeForm.cancelButton"
-              values={Object {}}
-            />
-          </EuiButtonEmpty>
-        </EuiFlexItem>
-        <EuiFlexItem
-          grow={false}
-        >
-          <EuiButton
-            color="primary"
-            data-test-subj="createSpacePrivilegeButton"
-            disabled={true}
-            fill={true}
-            onClick={[Function]}
-          >
-            <FormattedMessage
-              defaultMessage="Update space privilege"
-              id="xpack.security.management.editRolespacePrivilegeForm.updatePrivilegeButton"
-              values={Object {}}
-            />
-          </EuiButton>
-        </EuiFlexItem>
-      </EuiFlexGroup>
-    </EuiFlyoutFooter>
-  </EuiFlyout>
-</EuiOverlayMask>
-`;
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_display.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_display.test.tsx
index c6268e19abfd1..155ccf98b9762 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_display.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_display.test.tsx
@@ -4,10 +4,9 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { EuiIconTip, EuiText, EuiToolTip } from '@elastic/eui';
+import { EuiText } from '@elastic/eui';
 import React from 'react';
-import { mountWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
-import { PRIVILEGE_SOURCE } from '../kibana_privilege_calculator';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { PrivilegeDisplay } from './privilege_display';
 
 describe('PrivilegeDisplay', () => {
@@ -23,41 +22,4 @@ describe('PrivilegeDisplay', () => {
       color: 'danger',
     });
   });
-
-  it('renders a privilege with tooltip, if provided', () => {
-    const wrapper = mountWithIntl(
-      <PrivilegeDisplay privilege={'all'} tooltipContent={<b>ahh</b>} />
-    );
-    expect(wrapper.text().trim()).toEqual('All');
-    expect(wrapper.find(EuiToolTip).props()).toMatchObject({
-      content: <b>ahh</b>,
-    });
-  });
-
-  it('renders a privilege with icon tooltip, if provided', () => {
-    const wrapper = mountWithIntl(
-      <PrivilegeDisplay privilege={'all'} iconTooltipContent={<b>ahh</b>} iconType={'asterisk'} />
-    );
-    expect(wrapper.text().trim()).toEqual('All');
-    expect(wrapper.find(EuiIconTip).props()).toMatchObject({
-      type: 'asterisk',
-      content: <b>ahh</b>,
-    });
-  });
-
-  it('renders a superceded privilege', () => {
-    const wrapper = shallowWithIntl(
-      <PrivilegeDisplay
-        privilege={'all'}
-        explanation={{
-          supersededPrivilege: 'read',
-          supersededPrivilegeSource: PRIVILEGE_SOURCE.SPACE_BASE,
-          actualPrivilege: 'all',
-          actualPrivilegeSource: PRIVILEGE_SOURCE.GLOBAL_BASE,
-          isDirectlyAssigned: false,
-        }}
-      />
-    );
-    expect(wrapper).toMatchSnapshot();
-  });
 });
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_display.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_display.tsx
index 55ac99da4c8c1..93f1d9bba460d 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_display.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_display.tsx
@@ -3,95 +3,28 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
-import { EuiIcon, EuiIconTip, EuiText, IconType, PropsOf, EuiToolTip } from '@elastic/eui';
-import { FormattedMessage } from '@kbn/i18n/react';
+import { EuiIcon, EuiText, PropsOf } from '@elastic/eui';
 import _ from 'lodash';
 import React, { ReactNode, FC } from 'react';
-import { PRIVILEGE_SOURCE, PrivilegeExplanation } from '../kibana_privilege_calculator';
 import { NO_PRIVILEGE_VALUE } from '../constants';
 
 interface Props extends PropsOf<typeof EuiText> {
   privilege: string | string[] | undefined;
-  explanation?: PrivilegeExplanation;
-  iconType?: IconType;
-  iconTooltipContent?: ReactNode;
-  tooltipContent?: ReactNode;
+  'data-test-subj'?: string;
 }
 
 export const PrivilegeDisplay: FC<Props> = (props: Props) => {
-  const { explanation } = props;
-
-  if (!explanation) {
-    return <SimplePrivilegeDisplay {...props} />;
-  }
-
-  if (explanation.supersededPrivilege) {
-    return <SupersededPrivilegeDisplay {...props} />;
-  }
-
-  if (!explanation.isDirectlyAssigned) {
-    return <EffectivePrivilegeDisplay {...props} />;
-  }
-
   return <SimplePrivilegeDisplay {...props} />;
 };
 
 const SimplePrivilegeDisplay: FC<Props> = (props: Props) => {
-  const { privilege, iconType, iconTooltipContent, explanation, tooltipContent, ...rest } = props;
-
-  const text = (
-    <EuiText {...rest}>
-      {getDisplayValue(privilege)} {getIconTip(iconType, iconTooltipContent)}
-    </EuiText>
-  );
+  const { privilege, ...rest } = props;
 
-  if (tooltipContent) {
-    return <EuiToolTip content={tooltipContent}>{text}</EuiToolTip>;
-  }
+  const text = <EuiText {...rest}>{getDisplayValue(privilege)}</EuiText>;
 
   return text;
 };
 
-export const SupersededPrivilegeDisplay: FC<Props> = (props: Props) => {
-  const { supersededPrivilege, actualPrivilegeSource } =
-    props.explanation || ({} as PrivilegeExplanation);
-
-  return (
-    <SimplePrivilegeDisplay
-      {...props}
-      iconType={'lock'}
-      iconTooltipContent={
-        <FormattedMessage
-          id="xpack.security.management.editRole.spaceAwarePrivilegeDisplay.privilegeSupercededMessage"
-          defaultMessage="Original privilege of {supersededPrivilege} has been overriden by {actualPrivilegeSource}"
-          values={{
-            supersededPrivilege: `'${supersededPrivilege}'`,
-            actualPrivilegeSource: getReadablePrivilegeSource(actualPrivilegeSource),
-          }}
-        />
-      }
-    />
-  );
-};
-
-export const EffectivePrivilegeDisplay: FC<Props> = (props: Props) => {
-  const { explanation, ...rest } = props;
-
-  const source = getReadablePrivilegeSource(explanation!.actualPrivilegeSource);
-
-  const iconTooltipContent = (
-    <FormattedMessage
-      id="xpack.security.management.editRole.spaceAwarePrivilegeDisplay.effectivePrivilegeMessage"
-      defaultMessage="Granted via {source}."
-      values={{ source }}
-    />
-  );
-
-  return (
-    <SimplePrivilegeDisplay {...rest} iconType={'lock'} iconTooltipContent={iconTooltipContent} />
-  );
-};
-
 PrivilegeDisplay.defaultProps = {
   privilege: [],
 };
@@ -113,24 +46,6 @@ function getDisplayValue(privilege: string | string[] | undefined) {
   return displayValue;
 }
 
-function getIconTip(iconType?: IconType, tooltipContent?: ReactNode) {
-  if (!iconType || !tooltipContent) {
-    return null;
-  }
-
-  return (
-    <EuiIconTip
-      iconProps={{
-        className: 'eui-alignTop',
-      }}
-      color="subdued"
-      type={iconType}
-      content={tooltipContent}
-      size={'s'}
-    />
-  );
-}
-
 function coerceToArray(privilege: string | string[] | undefined): string[] {
   if (privilege === undefined) {
     return [];
@@ -140,43 +55,3 @@ function coerceToArray(privilege: string | string[] | undefined): string[] {
   }
   return [privilege];
 }
-
-function getReadablePrivilegeSource(privilegeSource: PRIVILEGE_SOURCE) {
-  switch (privilegeSource) {
-    case PRIVILEGE_SOURCE.GLOBAL_BASE:
-      return (
-        <FormattedMessage
-          id="xpack.security.management.editRole.spaceAwarePrivilegeDisplay.globalBasePrivilegeSource"
-          defaultMessage="global base privilege"
-        />
-      );
-    case PRIVILEGE_SOURCE.GLOBAL_FEATURE:
-      return (
-        <FormattedMessage
-          id="xpack.security.management.editRole.spaceAwarePrivilegeDisplay.globalFeaturePrivilegeSource"
-          defaultMessage="global feature privilege"
-        />
-      );
-    case PRIVILEGE_SOURCE.SPACE_BASE:
-      return (
-        <FormattedMessage
-          id="xpack.security.management.editRole.spaceAwarePrivilegeDisplay.spaceBasePrivilegeSource"
-          defaultMessage="space base privilege"
-        />
-      );
-    case PRIVILEGE_SOURCE.SPACE_FEATURE:
-      return (
-        <FormattedMessage
-          id="xpack.security.management.editRole.spaceAwarePrivilegeDisplay.spaceFeaturePrivilegeSource"
-          defaultMessage="space feature privilege"
-        />
-      );
-    default:
-      return (
-        <FormattedMessage
-          id="xpack.security.management.editRole.spaceAwarePrivilegeDisplay.unknownPrivilegeSource"
-          defaultMessage="**UNKNOWN**"
-        />
-      );
-  }
-}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_matrix.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_matrix.test.tsx
deleted file mode 100644
index a01c026c1a5df..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_matrix.test.tsx
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { EuiButtonEmpty, EuiInMemoryTable } from '@elastic/eui';
-import React from 'react';
-import { mountWithIntl } from 'test_utils/enzyme_helpers';
-import { Space } from '../../../../../../../../spaces/public';
-import { Feature } from '../../../../../../../../features/public';
-import { KibanaPrivileges, Role } from '../../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from '../kibana_privilege_calculator';
-import { PrivilegeMatrix } from './privilege_matrix';
-
-describe('PrivilegeMatrix', () => {
-  it('can render a complex matrix', () => {
-    const spaces: Space[] = ['*', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k'].map(a => ({
-      id: a,
-      name: `${a} space`,
-      disabledFeatures: [],
-    }));
-
-    const features: Feature[] = [
-      {
-        id: 'feature1',
-        name: 'feature 1',
-        icon: 'apmApp',
-        app: [],
-        privileges: {},
-      },
-      {
-        id: 'feature2',
-        name: 'feature 2',
-        icon: 'apmApp',
-        app: [],
-        privileges: {},
-      },
-      {
-        id: 'feature3',
-        name: 'feature 3',
-        icon: 'apmApp',
-        app: [],
-        privileges: {},
-      },
-    ];
-
-    const role: Role = {
-      name: 'role',
-      elasticsearch: {
-        cluster: [],
-        indices: [],
-        run_as: [],
-      },
-      kibana: [
-        {
-          spaces: ['*'],
-          base: ['read'],
-          feature: {
-            feature1: ['all'],
-          },
-        },
-        {
-          spaces: ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j'],
-          base: [],
-          feature: {
-            feature2: ['read'],
-            feature3: ['all'],
-          },
-        },
-        {
-          spaces: ['k'],
-          base: ['all'],
-          feature: {
-            feature2: ['read'],
-            feature3: ['read'],
-          },
-        },
-      ],
-    };
-
-    const calculator = new KibanaPrivilegeCalculatorFactory(
-      new KibanaPrivileges({
-        global: {
-          all: [],
-          read: [],
-        },
-        features: {
-          feature1: {
-            all: [],
-            read: [],
-          },
-          feature2: {
-            all: [],
-            read: [],
-          },
-          feature3: {
-            all: [],
-            read: [],
-          },
-        },
-        space: {
-          all: [],
-          read: [],
-        },
-        reserved: {},
-      })
-    ).getInstance(role);
-
-    const wrapper = mountWithIntl(
-      <PrivilegeMatrix
-        role={role}
-        spaces={spaces}
-        features={features}
-        calculatedPrivileges={calculator.calculateEffectivePrivileges()}
-        intl={null as any}
-      />
-    );
-
-    wrapper.find(EuiButtonEmpty).simulate('click');
-    wrapper.update();
-
-    const { columns, items } = wrapper.find(EuiInMemoryTable).props() as any;
-
-    expect(columns).toHaveLength(4); // all spaces groups plus the "feature" column
-    expect(items).toHaveLength(features.length + 1); // all features plus the "base" row
-  });
-});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_matrix.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_matrix.tsx
deleted file mode 100644
index f0f425273e25d..0000000000000
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_matrix.tsx
+++ /dev/null
@@ -1,342 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-import {
-  EuiButton,
-  EuiButtonEmpty,
-  EuiIcon,
-  EuiIconTip,
-  EuiInMemoryTable,
-  EuiModal,
-  EuiModalBody,
-  EuiModalFooter,
-  EuiModalHeader,
-  EuiModalHeaderTitle,
-  EuiOverlayMask,
-  IconType,
-} from '@elastic/eui';
-import { FormattedMessage, InjectedIntl } from '@kbn/i18n/react';
-import React, { Component, Fragment } from 'react';
-import { Space, SpaceAvatar } from '../../../../../../../../spaces/public';
-import { Feature } from '../../../../../../../../features/public';
-import { FeaturesPrivileges, Role } from '../../../../../../../common/model';
-import { CalculatedPrivilege } from '../kibana_privilege_calculator';
-import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
-import { SpacesPopoverList } from '../../../spaces_popover_list';
-import { PrivilegeDisplay } from './privilege_display';
-
-const SPACES_DISPLAY_COUNT = 4;
-
-interface Props {
-  role: Role;
-  spaces: Space[];
-  features: Feature[];
-  calculatedPrivileges: CalculatedPrivilege[];
-  intl: InjectedIntl;
-}
-
-interface State {
-  showModal: boolean;
-}
-
-interface TableRow {
-  feature: Feature & { isBase: boolean };
-  tooltip?: string;
-  role: Role;
-}
-
-interface SpacesColumn {
-  isGlobal: boolean;
-  spacesIndex: number;
-  spaces: Space[];
-  privileges: {
-    base: string[];
-    feature: FeaturesPrivileges;
-  };
-}
-
-export class PrivilegeMatrix extends Component<Props, State> {
-  public state = {
-    showModal: false,
-  };
-  public render() {
-    let modal = null;
-    if (this.state.showModal) {
-      modal = (
-        <EuiOverlayMask>
-          <EuiModal className="secPrivilegeMatrix__modal" onClose={this.hideModal}>
-            <EuiModalHeader>
-              <EuiModalHeaderTitle>
-                <FormattedMessage
-                  id="xpack.security.management.editRole.spacePrivilegeMatrix.modalTitle"
-                  defaultMessage="Privilege summary"
-                />
-              </EuiModalHeaderTitle>
-            </EuiModalHeader>
-            <EuiModalBody>{this.renderTable()}</EuiModalBody>
-            <EuiModalFooter>
-              <EuiButton onClick={this.hideModal} fill>
-                <FormattedMessage
-                  id="xpack.security.management.editRole.spacePrivilegeMatrix.closeButton"
-                  defaultMessage="Close"
-                />
-              </EuiButton>
-            </EuiModalFooter>
-          </EuiModal>
-        </EuiOverlayMask>
-      );
-    }
-
-    return (
-      <Fragment>
-        <EuiButtonEmpty onClick={this.showModal}>
-          <FormattedMessage
-            id="xpack.security.management.editRole.spacePrivilegeMatrix.showSummaryText"
-            defaultMessage="View privilege summary"
-          />
-        </EuiButtonEmpty>
-        {modal}
-      </Fragment>
-    );
-  }
-
-  private renderTable = () => {
-    const { role, features, intl } = this.props;
-
-    const spacePrivileges = role.kibana;
-
-    const globalPrivilege = this.locateGlobalPrivilege();
-
-    const spacesColumns: SpacesColumn[] = [];
-
-    spacePrivileges.forEach((spacePrivs, spacesIndex) => {
-      spacesColumns.push({
-        isGlobal: isGlobalPrivilegeDefinition(spacePrivs),
-        spacesIndex,
-        spaces: spacePrivs.spaces
-          .map(spaceId => this.props.spaces.find(space => space.id === spaceId))
-          .filter(Boolean) as Space[],
-        privileges: {
-          base: spacePrivs.base,
-          feature: spacePrivs.feature,
-        },
-      });
-    });
-
-    const rows: TableRow[] = [
-      {
-        feature: {
-          id: '*base*',
-          isBase: true,
-          name: intl.formatMessage({
-            id: 'xpack.security.management.editRole.spacePrivilegeMatrix.basePrivilegeText',
-            defaultMessage: 'Base privilege',
-          }),
-          app: [],
-          privileges: {},
-        },
-        role,
-      },
-      ...features.map(feature => ({
-        feature: {
-          ...feature,
-          isBase: false,
-        },
-        role,
-      })),
-    ];
-
-    const columns = [
-      {
-        field: 'feature',
-        name: intl.formatMessage({
-          id: 'xpack.security.management.editRole.spacePrivilegeMatrix.featureColumnTitle',
-          defaultMessage: 'Feature',
-        }),
-        width: '230px',
-        render: (feature: Feature & { isBase: boolean }) => {
-          return feature.isBase ? (
-            <Fragment>
-              <strong>{feature.name}</strong>
-              <EuiIconTip
-                iconProps={{
-                  className: 'eui-alignTop',
-                }}
-                type="questionInCircle"
-                content={intl.formatMessage({
-                  id:
-                    'xpack.security.management.editRole.spacePrivilegeMatrix.basePrivilegeTooltip',
-                  defaultMessage: 'The base privilege is automatically granted to all features.',
-                })}
-                color="subdued"
-              />
-            </Fragment>
-          ) : (
-            <Fragment>
-              {feature.icon && (
-                <EuiIcon
-                  className="secPrivilegeFeatureIcon"
-                  size="m"
-                  type={feature.icon as IconType}
-                />
-              )}
-              {feature.name}
-            </Fragment>
-          );
-        },
-      },
-      ...spacesColumns.map(item => {
-        let columnWidth;
-        if (item.isGlobal) {
-          columnWidth = '100px';
-        } else if (item.spaces.length - SPACES_DISPLAY_COUNT) {
-          columnWidth = '90px';
-        } else {
-          columnWidth = '80px';
-        }
-
-        return {
-          // TODO: this is a hacky way to determine if we are looking at the global feature
-          // used for cellProps below...
-          field: item.isGlobal ? 'global' : 'feature',
-          width: columnWidth,
-          name: (
-            <div>
-              {item.spaces.slice(0, SPACES_DISPLAY_COUNT).map((space: Space) => (
-                <span key={space.id}>
-                  <SpaceAvatar size="s" space={space} />{' '}
-                  {item.isGlobal && (
-                    <span>
-                      <FormattedMessage
-                        id="xpack.security.management.editRole.spacePrivilegeMatrix.globalSpaceName"
-                        defaultMessage="Global"
-                      />
-                      <br />
-                      <SpacesPopoverList
-                        spaces={this.props.spaces.filter(s => s.id !== '*')}
-                        intl={this.props.intl}
-                        buttonText={this.props.intl.formatMessage({
-                          id:
-                            'xpack.security.management.editRole.spacePrivilegeMatrix.showAllSpacesLink',
-                          defaultMessage: '(all spaces)',
-                        })}
-                      />
-                    </span>
-                  )}
-                </span>
-              ))}
-              {item.spaces.length > SPACES_DISPLAY_COUNT && (
-                <Fragment>
-                  <br />
-                  <SpacesPopoverList
-                    spaces={item.spaces}
-                    intl={this.props.intl}
-                    buttonText={this.props.intl.formatMessage(
-                      {
-                        id:
-                          'xpack.security.management.editRole.spacePrivilegeMatrix.showNMoreSpacesLink',
-                        defaultMessage: '+{count} more',
-                      },
-                      { count: item.spaces.length - SPACES_DISPLAY_COUNT }
-                    )}
-                  />
-                </Fragment>
-              )}
-            </div>
-          ),
-          render: (feature: Feature & { isBase: boolean }, record: TableRow) => {
-            return this.renderPrivilegeDisplay(item, record, globalPrivilege.base);
-          },
-        };
-      }),
-    ];
-
-    return (
-      <EuiInMemoryTable
-        columns={columns}
-        items={rows}
-        rowProps={(item: TableRow) => {
-          return {
-            className: item.feature.isBase ? 'secPrivilegeMatrix__row--isBasePrivilege' : '',
-          };
-        }}
-        cellProps={(item: TableRow, column: Record<string, any>) => {
-          return {
-            className:
-              column.field === 'global' ? 'secPrivilegeMatrix__cell--isGlobalPrivilege' : '',
-          };
-        }}
-      />
-    );
-  };
-
-  private renderPrivilegeDisplay = (
-    column: SpacesColumn,
-    { feature }: TableRow,
-    globalBasePrivilege: string[]
-  ) => {
-    if (column.isGlobal) {
-      if (feature.isBase) {
-        return <PrivilegeDisplay privilege={globalBasePrivilege} />;
-      }
-
-      const featureCalculatedPrivilege = this.props.calculatedPrivileges[column.spacesIndex]
-        .feature[feature.id];
-
-      return (
-        <PrivilegeDisplay
-          privilege={featureCalculatedPrivilege && featureCalculatedPrivilege.actualPrivilege}
-        />
-      );
-    } else {
-      // not global
-
-      const calculatedPrivilege = this.props.calculatedPrivileges[column.spacesIndex];
-
-      if (feature.isBase) {
-        // Space base privilege
-        const actualBasePrivileges = calculatedPrivilege.base.actualPrivilege;
-
-        return (
-          <PrivilegeDisplay
-            explanation={calculatedPrivilege.base}
-            privilege={actualBasePrivileges}
-          />
-        );
-      }
-
-      const featurePrivilegeExplanation = calculatedPrivilege.feature[feature.id];
-
-      return (
-        <PrivilegeDisplay
-          explanation={featurePrivilegeExplanation}
-          privilege={featurePrivilegeExplanation && featurePrivilegeExplanation.actualPrivilege}
-        />
-      );
-    }
-  };
-
-  private locateGlobalPrivilege = () => {
-    return (
-      this.props.role.kibana.find(spacePriv => isGlobalPrivilegeDefinition(spacePriv)) || {
-        spaces: ['*'],
-        base: [],
-        feature: [],
-      }
-    );
-  };
-
-  private hideModal = () => {
-    this.setState({
-      showModal: false,
-    });
-  };
-
-  private showModal = () => {
-    this.setState({
-      showModal: true,
-    });
-  };
-}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_form.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_form.test.tsx
index 675f02a81f9e1..968730181fe10 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_form.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_form.test.tsx
@@ -4,123 +4,379 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import React from 'react';
-import { merge } from 'lodash';
-// @ts-ignore
-import { findTestSubject } from '@elastic/eui/lib/test';
-import { shallowWithIntl, mountWithIntl } from 'test_utils/enzyme_helpers';
-import { KibanaPrivileges } from '../../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from '../kibana_privilege_calculator';
+import { Role } from '../../../../../../../common/model';
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { kibanaFeatures } from '../../../../__fixtures__/kibana_features';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { PrivilegeSpaceForm } from './privilege_space_form';
-import { rawKibanaPrivileges } from './__fixtures__';
+import React from 'react';
+import { Space } from '../../../../../../../../spaces/public';
+import { EuiSuperSelect } from '@elastic/eui';
+import { FeatureTable } from '../feature_table';
+import { getDisplayedFeaturePrivileges } from '../feature_table/__fixtures__';
+import { findTestSubject } from 'test_utils/find_test_subject';
+import { SpaceSelector } from './space_selector';
 
-type RecursivePartial<T> = {
-  [P in keyof T]?: RecursivePartial<T[P]>;
+const createRole = (kibana: Role['kibana'] = []): Role => {
+  return {
+    name: 'my_role',
+    elasticsearch: { cluster: [], run_as: [], indices: [] },
+    kibana,
+  };
 };
 
-const buildProps = (
-  overrides?: RecursivePartial<PrivilegeSpaceForm['props']>
-): PrivilegeSpaceForm['props'] => {
-  const kibanaPrivileges = new KibanaPrivileges(rawKibanaPrivileges);
-  const defaultProps: PrivilegeSpaceForm['props'] = {
-    spaces: [
+const displaySpaces: Space[] = [
+  {
+    id: 'foo',
+    name: 'Foo Space',
+    disabledFeatures: [],
+  },
+  {
+    id: 'default',
+    name: 'Default Space',
+    disabledFeatures: [],
+  },
+  {
+    id: '*',
+    name: 'Global',
+    disabledFeatures: [],
+  },
+];
+
+describe('PrivilegeSpaceForm', () => {
+  it('renders an empty form when the role contains no Kibana privileges', () => {
+    const role = createRole();
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const wrapper = mountWithIntl(
+      <PrivilegeSpaceForm
+        role={role}
+        spaces={displaySpaces}
+        kibanaPrivileges={kibanaPrivileges}
+        canCustomizeSubFeaturePrivileges={true}
+        onChange={jest.fn()}
+        onCancel={jest.fn()}
+      />
+    );
+
+    expect(wrapper.find(EuiSuperSelect).props().valueOfSelected).toEqual(`basePrivilege_custom`);
+    expect(wrapper.find(FeatureTable).props().disabled).toEqual(true);
+    expect(getDisplayedFeaturePrivileges(wrapper)).toMatchInlineSnapshot(`
+      Object {
+        "excluded_from_base": Object {
+          "primaryFeaturePrivilege": "none",
+          "subFeaturePrivileges": Array [],
+        },
+        "no_sub_features": Object {
+          "primaryFeaturePrivilege": "none",
+        },
+        "with_excluded_sub_features": Object {
+          "primaryFeaturePrivilege": "none",
+          "subFeaturePrivileges": Array [],
+        },
+        "with_sub_features": Object {
+          "primaryFeaturePrivilege": "none",
+          "subFeaturePrivileges": Array [],
+        },
+      }
+    `);
+
+    expect(findTestSubject(wrapper, 'spaceFormGlobalPermissionsSupersedeWarning')).toHaveLength(0);
+  });
+
+  it('renders when a base privilege is selected', () => {
+    const role = createRole([
       {
-        id: 'default',
-        name: 'Default Space',
-        description: '',
-        disabledFeatures: [],
-        _reserved: true,
+        base: ['all'],
+        feature: {},
+        spaces: ['foo'],
       },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const wrapper = mountWithIntl(
+      <PrivilegeSpaceForm
+        role={role}
+        spaces={displaySpaces}
+        kibanaPrivileges={kibanaPrivileges}
+        canCustomizeSubFeaturePrivileges={true}
+        privilegeIndex={0}
+        onChange={jest.fn()}
+        onCancel={jest.fn()}
+      />
+    );
+
+    expect(wrapper.find(EuiSuperSelect).props().valueOfSelected).toEqual(`basePrivilege_all`);
+    expect(wrapper.find(FeatureTable).props().disabled).toEqual(true);
+    expect(getDisplayedFeaturePrivileges(wrapper)).toMatchInlineSnapshot(`
+      Object {
+        "excluded_from_base": Object {
+          "primaryFeaturePrivilege": "none",
+          "subFeaturePrivileges": Array [],
+        },
+        "no_sub_features": Object {
+          "primaryFeaturePrivilege": "all",
+        },
+        "with_excluded_sub_features": Object {
+          "primaryFeaturePrivilege": "all",
+          "subFeaturePrivileges": Array [],
+        },
+        "with_sub_features": Object {
+          "primaryFeaturePrivilege": "all",
+          "subFeaturePrivileges": Array [
+            "with_sub_features_cool_toggle_1",
+            "with_sub_features_cool_toggle_2",
+            "cool_all",
+          ],
+        },
+      }
+    `);
+
+    expect(findTestSubject(wrapper, 'spaceFormGlobalPermissionsSupersedeWarning')).toHaveLength(0);
+  });
+
+  it('renders when a feature privileges are selected', () => {
+    const role = createRole([
       {
-        id: 'marketing',
-        name: 'Marketing',
-        description: '',
-        disabledFeatures: [],
+        base: [],
+        feature: {
+          with_sub_features: ['read'],
+        },
+        spaces: ['foo'],
       },
-    ],
-    kibanaPrivileges,
-    privilegeCalculatorFactory: new KibanaPrivilegeCalculatorFactory(kibanaPrivileges),
-    features: [],
-    role: {
-      name: 'test role',
-      elasticsearch: {
-        cluster: ['all'],
-        indices: [] as any[],
-        run_as: [] as string[],
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const wrapper = mountWithIntl(
+      <PrivilegeSpaceForm
+        role={role}
+        spaces={displaySpaces}
+        kibanaPrivileges={kibanaPrivileges}
+        canCustomizeSubFeaturePrivileges={true}
+        privilegeIndex={0}
+        onChange={jest.fn()}
+        onCancel={jest.fn()}
+      />
+    );
+
+    expect(wrapper.find(EuiSuperSelect).props().valueOfSelected).toEqual(`basePrivilege_custom`);
+    expect(wrapper.find(FeatureTable).props().disabled).toEqual(false);
+    expect(getDisplayedFeaturePrivileges(wrapper)).toMatchInlineSnapshot(`
+      Object {
+        "excluded_from_base": Object {
+          "primaryFeaturePrivilege": "none",
+          "subFeaturePrivileges": Array [],
+        },
+        "no_sub_features": Object {
+          "primaryFeaturePrivilege": "none",
+        },
+        "with_excluded_sub_features": Object {
+          "primaryFeaturePrivilege": "none",
+          "subFeaturePrivileges": Array [],
+        },
+        "with_sub_features": Object {
+          "primaryFeaturePrivilege": "read",
+          "subFeaturePrivileges": Array [
+            "with_sub_features_cool_toggle_2",
+            "cool_read",
+          ],
+        },
+      }
+    `);
+
+    expect(findTestSubject(wrapper, 'spaceFormGlobalPermissionsSupersedeWarning')).toHaveLength(0);
+  });
+
+  it('renders a warning when configuring a global privilege after space privileges are already defined', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['read'],
+        },
+        spaces: ['foo'],
       },
-      kibana: [{ spaces: [], base: [], feature: {} }],
-    },
-    onChange: jest.fn(),
-    onCancel: jest.fn(),
-    intl: {} as any,
-    editingIndex: 0,
-  };
-  return merge(defaultProps, overrides || {});
-};
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['all'],
+        },
+        spaces: ['*'],
+      },
+    ]);
+
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const wrapper = mountWithIntl(
+      <PrivilegeSpaceForm
+        role={role}
+        spaces={displaySpaces}
+        kibanaPrivileges={kibanaPrivileges}
+        canCustomizeSubFeaturePrivileges={true}
+        onChange={jest.fn()}
+        onCancel={jest.fn()}
+      />
+    );
+
+    wrapper
+      .find(SpaceSelector)
+      .props()
+      .onChange(['*']);
+
+    wrapper.update();
 
-describe('<PrivilegeSpaceForm>', () => {
-  it('renders without crashing', () => {
-    expect(shallowWithIntl(<PrivilegeSpaceForm {...buildProps()} />)).toMatchSnapshot();
+    expect(findTestSubject(wrapper, 'globalPrivilegeWarning')).toHaveLength(1);
   });
 
-  it(`defaults to "Custom" for new global entries`, () => {
-    const props = buildProps({
-      role: {
-        kibana: [
-          {
-            spaces: ['*'],
-            base: [],
-            feature: {},
-          },
-        ],
+  it('renders a warning when space privileges are less permissive than configured global privileges', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['read'],
+        },
+        spaces: ['foo'],
+      },
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['all'],
+        },
+        spaces: ['*'],
       },
-      editingIndex: 0,
-    });
-    const component = mountWithIntl(<PrivilegeSpaceForm {...props} />);
-    const basePrivilegeComboBox = findTestSubject(component, `basePrivilegeComboBox`);
-    expect(basePrivilegeComboBox.text()).toBe('Custom');
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const wrapper = mountWithIntl(
+      <PrivilegeSpaceForm
+        role={role}
+        spaces={displaySpaces}
+        kibanaPrivileges={kibanaPrivileges}
+        canCustomizeSubFeaturePrivileges={true}
+        privilegeIndex={0}
+        onChange={jest.fn()}
+        onCancel={jest.fn()}
+      />
+    );
+
+    expect(wrapper.find(EuiSuperSelect).props().valueOfSelected).toEqual(`basePrivilege_custom`);
+    expect(wrapper.find(FeatureTable).props().disabled).toEqual(false);
+    expect(getDisplayedFeaturePrivileges(wrapper)).toMatchInlineSnapshot(`
+      Object {
+        "excluded_from_base": Object {
+          "primaryFeaturePrivilege": "none",
+          "subFeaturePrivileges": Array [],
+        },
+        "no_sub_features": Object {
+          "primaryFeaturePrivilege": "none",
+        },
+        "with_excluded_sub_features": Object {
+          "primaryFeaturePrivilege": "none",
+          "subFeaturePrivileges": Array [],
+        },
+        "with_sub_features": Object {
+          "primaryFeaturePrivilege": "read",
+          "subFeaturePrivileges": Array [
+            "with_sub_features_cool_toggle_2",
+            "cool_read",
+          ],
+        },
+      }
+    `);
+
+    expect(findTestSubject(wrapper, 'spaceFormGlobalPermissionsSupersedeWarning')).toHaveLength(1);
+    expect(findTestSubject(wrapper, 'globalPrivilegeWarning')).toHaveLength(0);
   });
 
-  it(`defaults to "Custom" for new space entries`, () => {
-    const props = buildProps({
-      role: {
-        kibana: [
-          {
-            spaces: ['space:default'],
-            base: [],
-            feature: {},
-          },
-        ],
+  it('allows all feature privileges to be changed via "change all"', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['all', 'with_sub_features_cool_toggle_2', 'cool_read'],
+        },
+        spaces: ['foo'],
+      },
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['all'],
+        },
+        spaces: ['bar'],
       },
-      editingIndex: 0,
-    });
-    const component = mountWithIntl(<PrivilegeSpaceForm {...props} />);
-    const basePrivilegeComboBox = findTestSubject(component, `basePrivilegeComboBox`);
-    expect(basePrivilegeComboBox.text()).toBe('Custom');
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const onChange = jest.fn();
+
+    const wrapper = mountWithIntl(
+      <PrivilegeSpaceForm
+        role={role}
+        spaces={displaySpaces}
+        kibanaPrivileges={kibanaPrivileges}
+        canCustomizeSubFeaturePrivileges={true}
+        privilegeIndex={0}
+        onChange={onChange}
+        onCancel={jest.fn()}
+      />
+    );
+
+    findTestSubject(wrapper, 'changeAllPrivilegesButton').simulate('click');
+    findTestSubject(wrapper, 'changeAllPrivileges-read').simulate('click');
+    findTestSubject(wrapper, 'createSpacePrivilegeButton').simulate('click');
+
+    expect(onChange).toHaveBeenCalledWith(
+      createRole([
+        {
+          base: [],
+          feature: {
+            excluded_from_base: ['read'],
+            with_excluded_sub_features: ['read'],
+            no_sub_features: ['read'],
+            with_sub_features: ['read'],
+          },
+          spaces: ['foo'],
+        },
+        // this set remains unchanged from the original
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['all'],
+          },
+          spaces: ['bar'],
+        },
+      ])
+    );
   });
 
-  describe('when an existing global all privilege', () => {
-    it(`defaults to "Custom" for new entries`, () => {
-      const props = buildProps({
-        role: {
-          kibana: [
-            {
-              spaces: ['*'],
-              base: ['all'],
-              feature: {},
-            },
-            {
-              spaces: ['default'],
-              base: [],
-              feature: {},
-            },
-          ],
+  it('passes the `canCustomizeSubFeaturePrivileges` prop to the FeatureTable', () => {
+    const role = createRole([
+      {
+        base: [],
+        feature: {
+          with_sub_features: ['all'],
         },
-        editingIndex: 1,
-      });
-      const component = mountWithIntl(<PrivilegeSpaceForm {...props} />);
-      const basePrivilegeComboBox = findTestSubject(component, `basePrivilegeComboBox`);
-      expect(basePrivilegeComboBox.text()).toBe('Custom');
-    });
+        spaces: ['foo'],
+      },
+    ]);
+    const kibanaPrivileges = createKibanaPrivileges(kibanaFeatures);
+
+    const onChange = jest.fn();
+
+    const canCustomize = (Symbol('can customize') as unknown) as boolean;
+
+    const wrapper = mountWithIntl(
+      <PrivilegeSpaceForm
+        role={role}
+        spaces={displaySpaces}
+        kibanaPrivileges={kibanaPrivileges}
+        canCustomizeSubFeaturePrivileges={canCustomize}
+        privilegeIndex={0}
+        onChange={onChange}
+        onCancel={jest.fn()}
+      />
+    );
+
+    expect(wrapper.find(FeatureTable).props().canCustomizeSubFeaturePrivileges).toBe(canCustomize);
   });
 });
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_form.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_form.tsx
index 6f841b5d14cb3..4e9e02bb531f1 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_form.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_form.tsx
@@ -21,46 +21,42 @@ import {
   EuiSuperSelect,
   EuiText,
   EuiTitle,
+  EuiErrorBoundary,
 } from '@elastic/eui';
-import { FormattedMessage, InjectedIntl } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
 import React, { Component, Fragment } from 'react';
 import { Space } from '../../../../../../../../spaces/public';
-import { Feature } from '../../../../../../../../features/public';
-import { KibanaPrivileges, Role, copyRole } from '../../../../../../../common/model';
-import {
-  AllowedPrivilege,
-  KibanaPrivilegeCalculatorFactory,
-  PrivilegeExplanation,
-} from '../kibana_privilege_calculator';
-import { hasAssignedFeaturePrivileges } from '../../../privilege_utils';
-import { CUSTOM_PRIVILEGE_VALUE } from '../constants';
-import { FeatureTable } from '../feature_table';
+import { Role, copyRole } from '../../../../../../../common/model';
 import { SpaceSelector } from './space_selector';
+import { FeatureTable } from '../feature_table';
+import { CUSTOM_PRIVILEGE_VALUE } from '../constants';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import { KibanaPrivileges } from '../../../../model';
 
 interface Props {
   role: Role;
-  privilegeCalculatorFactory: KibanaPrivilegeCalculatorFactory;
   kibanaPrivileges: KibanaPrivileges;
-  features: Feature[];
   spaces: Space[];
-  editingIndex: number;
+  privilegeIndex: number;
+  canCustomizeSubFeaturePrivileges: boolean;
   onChange: (role: Role) => void;
   onCancel: () => void;
-  intl: InjectedIntl;
 }
 
 interface State {
-  editingIndex: number;
+  privilegeIndex: number;
   selectedSpaceIds: string[];
   selectedBasePrivilege: string[];
   role: Role;
   mode: 'create' | 'update';
   isCustomizingFeaturePrivileges: boolean;
+  privilegeCalculator: PrivilegeFormCalculator;
 }
 
 export class PrivilegeSpaceForm extends Component<Props, State> {
   public static defaultProps = {
-    editingIndex: -1,
+    privilegeIndex: -1,
   };
 
   constructor(props: Props) {
@@ -68,10 +64,10 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
 
     const role = copyRole(props.role);
 
-    let editingIndex = props.editingIndex;
-    if (editingIndex < 0) {
+    let privilegeIndex = props.privilegeIndex;
+    if (privilegeIndex < 0) {
       // create new form
-      editingIndex =
+      privilegeIndex =
         role.kibana.push({
           spaces: [],
           base: [],
@@ -81,11 +77,12 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
 
     this.state = {
       role,
-      editingIndex,
-      selectedSpaceIds: [...role.kibana[editingIndex].spaces],
-      selectedBasePrivilege: [...(role.kibana[editingIndex].base || [])],
-      mode: props.editingIndex < 0 ? 'create' : 'update',
+      privilegeIndex,
+      selectedSpaceIds: [...role.kibana[privilegeIndex].spaces],
+      selectedBasePrivilege: [...(role.kibana[privilegeIndex].base || [])],
+      mode: props.privilegeIndex < 0 ? 'create' : 'update',
       isCustomizingFeaturePrivileges: false,
+      privilegeCalculator: new PrivilegeFormCalculator(props.kibanaPrivileges, role),
     };
   }
 
@@ -103,8 +100,33 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
               </h2>
             </EuiTitle>
           </EuiFlyoutHeader>
-          <EuiFlyoutBody>{this.getForm()}</EuiFlyoutBody>
+          <EuiFlyoutBody>
+            <EuiErrorBoundary>{this.getForm()}</EuiErrorBoundary>
+          </EuiFlyoutBody>
           <EuiFlyoutFooter>
+            {this.state.privilegeCalculator.hasSupersededInheritedPrivileges(
+              this.state.privilegeIndex
+            ) && (
+              <Fragment>
+                <EuiCallOut
+                  color="warning"
+                  iconType="alert"
+                  data-test-subj="spaceFormGlobalPermissionsSupersedeWarning"
+                  title={
+                    <FormattedMessage
+                      id="xpack.security.management.editRole.spacePrivilegeForm.supersededWarningTitle"
+                      defaultMessage="Superseded by global privileges"
+                    />
+                  }
+                >
+                  <FormattedMessage
+                    id="xpack.security.management.editRole.spacePrivilegeForm.supersededWarning"
+                    defaultMessage="Declared privileges are less permissive than configured global privileges. View the privilege summary to see effective privileges."
+                  />
+                </EuiCallOut>
+                <EuiSpacer size="s" />
+              </Fragment>
+            )}
             <EuiFlexGroup justifyContent="spaceBetween">
               <EuiFlexItem grow={false}>
                 <EuiButtonEmpty
@@ -114,7 +136,7 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
                   data-test-subj={'cancelSpacePrivilegeButton'}
                 >
                   <FormattedMessage
-                    id="xpack.security.management.editRolespacePrivilegeForm.cancelButton"
+                    id="xpack.security.management.editRole.spacePrivilegeForm.cancelButton"
                     defaultMessage="Cancel"
                   />
                 </EuiButtonEmpty>
@@ -128,18 +150,7 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
   }
 
   private getForm = () => {
-    const { intl, spaces, privilegeCalculatorFactory } = this.props;
-
-    const privilegeCalculator = privilegeCalculatorFactory.getInstance(this.state.role);
-
-    const calculatedPrivileges = privilegeCalculator.calculateEffectivePrivileges()[
-      this.state.editingIndex
-    ];
-    const allowedPrivileges = privilegeCalculator.calculateAllowedPrivileges()[
-      this.state.editingIndex
-    ];
-
-    const baseExplanation = calculatedPrivileges.base;
+    const { spaces } = this.props;
 
     const hasSelectedSpaces = this.state.selectedSpaceIds.length > 0;
 
@@ -147,16 +158,17 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
       <EuiForm>
         <EuiFormRow
           fullWidth
-          label={intl.formatMessage({
-            id: 'xpack.security.management.editRole.spacePrivilegeForm.spaceSelectorFormLabel',
-            defaultMessage: 'Spaces',
-          })}
+          label={i18n.translate(
+            'xpack.security.management.editRole.spacePrivilegeForm.spaceSelectorFormLabel',
+            {
+              defaultMessage: 'Spaces',
+            }
+          )}
         >
           <SpaceSelector
             selectedSpaceIds={this.state.selectedSpaceIds}
             onChange={this.onSelectedSpacesChange}
             spaces={spaces}
-            intl={this.props.intl}
           />
         </EuiFormRow>
 
@@ -164,10 +176,12 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
 
         <EuiFormRow
           fullWidth
-          label={intl.formatMessage({
-            id: 'xpack.security.management.editRole.spacePrivilegeForm.privilegeSelectorFormLabel',
-            defaultMessage: 'Privilege',
-          })}
+          label={i18n.translate(
+            'xpack.security.management.editRole.spacePrivilegeForm.privilegeSelectorFormLabel',
+            {
+              defaultMessage: 'Privilege',
+            }
+          )}
         >
           <EuiSuperSelect
             data-test-subj={'basePrivilegeComboBox'}
@@ -176,7 +190,6 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
             options={[
               {
                 value: 'basePrivilege_custom',
-                disabled: !this.canCustomizeFeaturePrivileges(baseExplanation, allowedPrivileges),
                 inputDisplay: (
                   <EuiText>
                     <FormattedMessage
@@ -204,7 +217,6 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
               },
               {
                 value: 'basePrivilege_read',
-                disabled: !allowedPrivileges.base.privileges.includes('read'),
                 inputDisplay: (
                   <EuiText>
                     <FormattedMessage
@@ -259,7 +271,7 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
               },
             ]}
             hasDividers
-            valueOfSelected={this.getDisplayedBasePrivilege(allowedPrivileges, baseExplanation)}
+            valueOfSelected={this.getDisplayedBasePrivilege()}
             disabled={!hasSelectedSpaces}
           />
         </EuiFormRow>
@@ -280,14 +292,12 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
 
         <FeatureTable
           role={this.state.role}
-          features={this.props.features}
-          calculatedPrivileges={calculatedPrivileges}
-          allowedPrivileges={allowedPrivileges}
-          rankedFeaturePrivileges={privilegeCalculator.rankedFeaturePrivileges}
+          privilegeCalculator={this.state.privilegeCalculator}
           onChange={this.onFeaturePrivilegesChange}
           onChangeAll={this.onChangeAllFeaturePrivileges}
           kibanaPrivileges={this.props.kibanaPrivileges}
-          spacesIndex={this.state.editingIndex}
+          privilegeIndex={this.state.privilegeIndex}
+          canCustomizeSubFeaturePrivileges={this.props.canCustomizeSubFeaturePrivileges}
           disabled={this.state.selectedBasePrivilege.length > 0 || !hasSelectedSpaces}
         />
 
@@ -297,6 +307,7 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
             <EuiCallOut
               color="warning"
               iconType="alert"
+              data-test-subj="globalPrivilegeWarning"
               title={
                 <FormattedMessage
                   id="xpack.security.management.editRole.spacePrivilegeForm.globalPrivilegeWarning"
@@ -373,33 +384,39 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
 
   private getFeatureListLabel = (disabled: boolean) => {
     if (disabled) {
-      return this.props.intl.formatMessage({
-        id: 'xpack.security.management.editRole.spacePrivilegeForm.summaryOfFeaturePrivileges',
-        defaultMessage: 'Summary of feature privileges',
-      });
+      return i18n.translate(
+        'xpack.security.management.editRole.spacePrivilegeForm.summaryOfFeaturePrivileges',
+        {
+          defaultMessage: 'Summary of feature privileges',
+        }
+      );
     } else {
-      return this.props.intl.formatMessage({
-        id: 'xpack.security.management.editRole.spacePrivilegeForm.customizeFeaturePrivileges',
-        defaultMessage: 'Customize by feature',
-      });
+      return i18n.translate(
+        'xpack.security.management.editRole.spacePrivilegeForm.customizeFeaturePrivileges',
+        {
+          defaultMessage: 'Customize by feature',
+        }
+      );
     }
   };
 
   private getFeatureListDescription = (disabled: boolean) => {
     if (disabled) {
-      return this.props.intl.formatMessage({
-        id:
-          'xpack.security.management.editRole.spacePrivilegeForm.featurePrivilegeSummaryDescription',
-        defaultMessage:
-          'Some features might be hidden by the space or affected by a global space privilege.',
-      });
+      return i18n.translate(
+        'xpack.security.management.editRole.spacePrivilegeForm.featurePrivilegeSummaryDescription',
+        {
+          defaultMessage:
+            'Some features might be hidden by the space or affected by a global space privilege.',
+        }
+      );
     } else {
-      return this.props.intl.formatMessage({
-        id:
-          'xpack.security.management.editRole.spacePrivilegeForm.customizeFeaturePrivilegeDescription',
-        defaultMessage:
-          'Increase privilege levels on a per feature basis. Some features might be hidden by the space or affected by a global space privilege.',
-      });
+      return i18n.translate(
+        'xpack.security.management.editRole.spacePrivilegeForm.customizeFeaturePrivilegeDescription',
+        {
+          defaultMessage:
+            'Increase privilege levels on a per feature basis. Some features might be hidden by the space or affected by a global space privilege.',
+        }
+      );
     }
   };
 
@@ -410,10 +427,12 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
           <EuiCallOut
             color="primary"
             iconType="iInCircle"
-            title={this.props.intl.formatMessage({
-              id: 'xpack.security.management.editRole.spacePrivilegeForm.globalPrivilegeNotice',
-              defaultMessage: 'These privileges will apply to all current and future spaces.',
-            })}
+            title={i18n.translate(
+              'xpack.security.management.editRole.spacePrivilegeForm.globalPrivilegeNotice',
+              {
+                defaultMessage: 'These privileges will apply to all current and future spaces.',
+              }
+            )}
           />
         </EuiFormRow>
       );
@@ -429,7 +448,7 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
   private onSaveClick = () => {
     const role = copyRole(this.state.role);
 
-    const form = role.kibana[this.state.editingIndex];
+    const form = role.kibana[this.state.privilegeIndex];
 
     // remove any spaces that no longer exist
     if (!this.isDefiningGlobalPrivilege()) {
@@ -444,18 +463,19 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
   private onSelectedSpacesChange = (selectedSpaceIds: string[]) => {
     const role = copyRole(this.state.role);
 
-    const form = role.kibana[this.state.editingIndex];
+    const form = role.kibana[this.state.privilegeIndex];
     form.spaces = [...selectedSpaceIds];
 
     this.setState({
       selectedSpaceIds,
       role,
+      privilegeCalculator: new PrivilegeFormCalculator(this.props.kibanaPrivileges, role),
     });
   };
 
   private onSpaceBasePrivilegeChange = (basePrivilege: string) => {
     const role = copyRole(this.state.role);
-    const form = role.kibana[this.state.editingIndex];
+    const form = role.kibana[this.state.privilegeIndex];
 
     const privilegeName = basePrivilege.split('basePrivilege_')[1];
 
@@ -473,47 +493,25 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
       selectedBasePrivilege: privilegeName === CUSTOM_PRIVILEGE_VALUE ? [] : [privilegeName],
       role,
       isCustomizingFeaturePrivileges,
+      privilegeCalculator: new PrivilegeFormCalculator(this.props.kibanaPrivileges, role),
     });
   };
 
-  private getDisplayedBasePrivilege = (
-    allowedPrivileges: AllowedPrivilege,
-    explanation: PrivilegeExplanation
-  ) => {
-    let displayedBasePrivilege = explanation.actualPrivilege;
-
-    if (this.canCustomizeFeaturePrivileges(explanation, allowedPrivileges)) {
-      const form = this.state.role.kibana[this.state.editingIndex];
-
-      if (
-        hasAssignedFeaturePrivileges(form) ||
-        form.base.length === 0 ||
-        this.state.isCustomizingFeaturePrivileges
-      ) {
-        displayedBasePrivilege = CUSTOM_PRIVILEGE_VALUE;
-      }
-    }
-
-    return displayedBasePrivilege ? `basePrivilege_${displayedBasePrivilege}` : undefined;
-  };
+  private getDisplayedBasePrivilege = () => {
+    const basePrivilege = this.state.privilegeCalculator.getBasePrivilege(
+      this.state.privilegeIndex
+    );
 
-  private canCustomizeFeaturePrivileges = (
-    basePrivilegeExplanation: PrivilegeExplanation,
-    allowedPrivileges: AllowedPrivilege
-  ) => {
-    if (basePrivilegeExplanation.isDirectlyAssigned) {
-      return true;
+    if (basePrivilege) {
+      return `basePrivilege_${basePrivilege.id}`;
     }
 
-    const featureEntries = Object.values(allowedPrivileges.feature);
-    return featureEntries.some(entry => {
-      return entry != null && (entry.canUnassign || entry.privileges.length > 1);
-    });
+    return `basePrivilege_${CUSTOM_PRIVILEGE_VALUE}`;
   };
 
   private onFeaturePrivilegesChange = (featureId: string, privileges: string[]) => {
     const role = copyRole(this.state.role);
-    const form = role.kibana[this.state.editingIndex];
+    const form = role.kibana[this.state.privilegeIndex];
 
     if (privileges.length === 0) {
       delete form.feature[featureId];
@@ -523,32 +521,29 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
 
     this.setState({
       role,
+      privilegeCalculator: new PrivilegeFormCalculator(this.props.kibanaPrivileges, role),
     });
   };
 
   private onChangeAllFeaturePrivileges = (privileges: string[]) => {
     const role = copyRole(this.state.role);
-    const form = role.kibana[this.state.editingIndex];
-
-    const calculator = this.props.privilegeCalculatorFactory.getInstance(role);
-    const allowedPrivs = calculator.calculateAllowedPrivileges();
+    const entry = role.kibana[this.state.privilegeIndex];
 
     if (privileges.length === 0) {
-      form.feature = {};
+      entry.feature = {};
     } else {
-      this.props.features.forEach(feature => {
-        const allowedPrivilegesFeature = allowedPrivs[this.state.editingIndex].feature[feature.id];
-        const canAssign =
-          allowedPrivilegesFeature && allowedPrivilegesFeature.privileges.includes(privileges[0]);
-
-        if (canAssign) {
-          form.feature[feature.id] = [...privileges];
+      this.props.kibanaPrivileges.getSecuredFeatures().forEach(feature => {
+        const nextFeaturePrivilege = feature
+          .getPrimaryFeaturePrivileges()
+          .find(pfp => privileges.includes(pfp.id));
+        if (nextFeaturePrivilege) {
+          entry.feature[feature.id] = [nextFeaturePrivilege.id];
         }
       });
     }
-
     this.setState({
       role,
+      privilegeCalculator: new PrivilegeFormCalculator(this.props.kibanaPrivileges, role),
     });
   };
 
@@ -557,7 +552,7 @@ export class PrivilegeSpaceForm extends Component<Props, State> {
       return false;
     }
 
-    const form = this.state.role.kibana[this.state.editingIndex];
+    const form = this.state.role.kibana[this.state.privilegeIndex];
     if (form.base.length === 0 && Object.keys(form.feature).length === 0) {
       return false;
     }
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_table.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_table.test.tsx
index f0a391c98c910..b1c7cb4b631e6 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_table.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_table.test.tsx
@@ -5,14 +5,16 @@
  */
 
 import React from 'react';
-import { EuiBadge, EuiInMemoryTable, EuiIconTip } from '@elastic/eui';
+import { EuiBadge, EuiInMemoryTable } from '@elastic/eui';
 import { mountWithIntl } from 'test_utils/enzyme_helpers';
 import { ReactWrapper } from 'enzyme';
 import { PrivilegeSpaceTable } from './privilege_space_table';
 import { PrivilegeDisplay } from './privilege_display';
-import { KibanaPrivileges, Role, RoleKibanaPrivilege } from '../../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from '../kibana_privilege_calculator';
-import { rawKibanaPrivileges } from './__fixtures__';
+import { Role, RoleKibanaPrivilege } from '../../../../../../../common/model';
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import { Feature } from '../../../../../../../../features/public';
+import { findTestSubject } from 'test_utils/find_test_subject';
 
 interface TableRow {
   spaces: string[];
@@ -21,20 +23,125 @@ interface TableRow {
   };
 }
 
-const buildProps = (roleKibanaPrivileges: RoleKibanaPrivilege[]): PrivilegeSpaceTable['props'] => {
-  const kibanaPrivileges = new KibanaPrivileges(rawKibanaPrivileges);
-  return {
-    role: {
-      name: 'test role',
-      elasticsearch: {
-        cluster: ['all'],
-        indices: [] as any[],
-        run_as: [] as string[],
+const features = [
+  new Feature({
+    id: 'normal',
+    name: 'normal feature',
+    app: [],
+    privileges: {
+      all: {
+        savedObject: { all: [], read: [] },
+        ui: ['normal-feature-all', 'normal-feature-read'],
+      },
+      read: {
+        savedObject: { all: [], read: [] },
+        ui: ['normal-feature-read'],
       },
-      kibana: roleKibanaPrivileges,
     },
-    privilegeCalculatorFactory: new KibanaPrivilegeCalculatorFactory(kibanaPrivileges),
-    onChange: (role: Role) => {},
+  }),
+  new Feature({
+    id: 'normal_with_sub',
+    name: 'normal feature with sub features',
+    app: [],
+    privileges: {
+      all: {
+        savedObject: { all: [], read: [] },
+        ui: ['normal-feature-all', 'normal-feature-read'],
+      },
+      read: {
+        savedObject: { all: [], read: [] },
+        ui: ['normal-feature-read'],
+      },
+    },
+    subFeatures: [
+      {
+        name: 'sub feature',
+        privilegeGroups: [
+          {
+            groupType: 'mutually_exclusive',
+            privileges: [
+              {
+                id: 'normal_sub_all',
+                name: 'normal sub feature privilege',
+                includeIn: 'all',
+                savedObject: { all: [], read: [] },
+                ui: ['normal-sub-all', 'normal-sub-read'],
+              },
+              {
+                id: 'normal_sub_read',
+                name: 'normal sub feature read privilege',
+                includeIn: 'read',
+                savedObject: { all: [], read: [] },
+                ui: ['normal-sub-read'],
+              },
+            ],
+          },
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'excluded_sub_priv',
+                name: 'excluded sub feature privilege',
+                includeIn: 'none',
+                savedObject: { all: [], read: [] },
+                ui: ['excluded-sub-priv'],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  }),
+  new Feature({
+    id: 'bothPrivilegesExcludedFromBase',
+    name: 'bothPrivilegesExcludedFromBase',
+    app: [],
+    privileges: {
+      all: {
+        excludeFromBasePrivileges: true,
+        savedObject: { all: [], read: [] },
+        ui: ['both-privileges-excluded-from-base-all', 'both-privileges-excluded-from-base-read'],
+      },
+      read: {
+        excludeFromBasePrivileges: true,
+        savedObject: { all: [], read: [] },
+        ui: ['both-privileges-excluded-from-base-read'],
+      },
+    },
+  }),
+  new Feature({
+    id: 'allPrivilegeExcludedFromBase',
+    name: 'allPrivilegeExcludedFromBase',
+    app: [],
+    privileges: {
+      all: {
+        excludeFromBasePrivileges: true,
+        savedObject: { all: [], read: [] },
+        ui: ['all-privilege-excluded-from-base-all', 'all-privilege-excluded-from-base-read'],
+      },
+      read: {
+        savedObject: { all: [], read: [] },
+        ui: ['all-privilege-excluded-from-base-read'],
+      },
+    },
+  }),
+];
+
+const buildProps = (roleKibanaPrivileges: RoleKibanaPrivilege[]): PrivilegeSpaceTable['props'] => {
+  const kibanaPrivileges = createKibanaPrivileges(features);
+  const role = {
+    name: 'test role',
+    elasticsearch: {
+      cluster: ['all'],
+      indices: [] as any[],
+      run_as: [] as string[],
+    },
+    kibana: roleKibanaPrivileges,
+  };
+  return {
+    role,
+    privilegeCalculator: new PrivilegeFormCalculator(kibanaPrivileges, role),
+    onChange: (r: Role) => {},
     onEdit: (spacesIndex: number) => {},
     displaySpaces: [
       {
@@ -51,7 +158,6 @@ const buildProps = (roleKibanaPrivileges: RoleKibanaPrivilege[]): PrivilegeSpace
         disabledFeatures: [],
       },
     ],
-    intl: {} as any,
   };
 };
 
@@ -73,7 +179,9 @@ const getTableFromComponent = (
         spaces: spacesBadge.map(badge => badge.text().trim()),
         privileges: {
           summary: privilegesDisplay.text().trim(),
-          overridden: privilegesDisplay.find(EuiIconTip).exists('[type="lock"]'),
+          overridden:
+            findTestSubject(row as ReactWrapper<any>, 'spaceTablePrivilegeSupersededWarning')
+              .length > 0,
         },
       },
     ];
@@ -117,6 +225,28 @@ describe('only global', () => {
     ]);
   });
 
+  it('normal feature privilege minimal_all', () => {
+    const props = buildProps([
+      { spaces: ['*'], base: [], feature: { normal_with_sub: ['minimal_all'] } },
+    ]);
+    const component = mountWithIntl(<PrivilegeSpaceTable {...props} />);
+    const actualTable = getTableFromComponent(component);
+    expect(actualTable).toEqual([
+      { spaces: ['*'], privileges: { summary: 'Custom', overridden: false } },
+    ]);
+  });
+
+  it('normal feature privilege minimal_all and normal_sub_read', () => {
+    const props = buildProps([
+      { spaces: ['*'], base: [], feature: { normal_with_sub: ['minimal_all', 'normal_sub_read'] } },
+    ]);
+    const component = mountWithIntl(<PrivilegeSpaceTable {...props} />);
+    const actualTable = getTableFromComponent(component);
+    expect(actualTable).toEqual([
+      { spaces: ['*'], privileges: { summary: 'Custom', overridden: false } },
+    ]);
+  });
+
   it('bothPrivilegesExcludedFromBase feature privilege all', () => {
     const props = buildProps([
       { spaces: ['*'], base: [], feature: { bothPrivilegesExcludedFromBase: ['read'] } },
@@ -203,6 +333,32 @@ describe('only default and marketing space', () => {
     ]);
   });
 
+  it('normal feature privilege minimal_all', () => {
+    const props = buildProps([
+      { spaces: ['default', 'marketing'], base: [], feature: { normal_with_sub: ['minimal_all'] } },
+    ]);
+    const component = mountWithIntl(<PrivilegeSpaceTable {...props} />);
+    const actualTable = getTableFromComponent(component);
+    expect(actualTable).toEqual([
+      { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
+    ]);
+  });
+
+  it('normal feature privilege minimal_all and normal_sub_read', () => {
+    const props = buildProps([
+      {
+        spaces: ['default', 'marketing'],
+        base: [],
+        feature: { normal_with_sub: ['minimal_all', 'normal_sub_read'] },
+      },
+    ]);
+    const component = mountWithIntl(<PrivilegeSpaceTable {...props} />);
+    const actualTable = getTableFromComponent(component);
+    expect(actualTable).toEqual([
+      { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
+    ]);
+  });
+
   it('bothPrivilegesExcludedFromBase feature privilege all', () => {
     const props = buildProps([
       {
@@ -275,7 +431,7 @@ describe('global base all', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'All', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'All', overridden: true } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'All', overridden: false } },
       ]);
     });
 
@@ -288,7 +444,7 @@ describe('global base all', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'All', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'All', overridden: true } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Read', overridden: true } },
       ]);
     });
 
@@ -301,7 +457,7 @@ describe('global base all', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'All', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'All', overridden: true } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
       ]);
     });
 
@@ -314,7 +470,41 @@ describe('global base all', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'All', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'All', overridden: true } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: true } },
+      ]);
+    });
+
+    it('normal feature privilege minimal_all', () => {
+      const props = buildProps([
+        { spaces: ['*'], base: ['all'], feature: {} },
+        {
+          spaces: ['default', 'marketing'],
+          base: [],
+          feature: { normal_with_sub: ['minimal_all'] },
+        },
+      ]);
+      const component = mountWithIntl(<PrivilegeSpaceTable {...props} />);
+      const actualTable = getTableFromComponent(component);
+      expect(actualTable).toEqual([
+        { spaces: ['*'], privileges: { summary: 'All', overridden: false } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: true } },
+      ]);
+    });
+
+    it('normal feature privilege minimal_all and normal_sub_read', () => {
+      const props = buildProps([
+        { spaces: ['*'], base: ['all'], feature: {} },
+        {
+          spaces: ['default', 'marketing'],
+          base: [],
+          feature: { normal_with_sub: ['minimal_all', 'normal_sub_read'] },
+        },
+      ]);
+      const component = mountWithIntl(<PrivilegeSpaceTable {...props} />);
+      const actualTable = getTableFromComponent(component);
+      expect(actualTable).toEqual([
+        { spaces: ['*'], privileges: { summary: 'All', overridden: false } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: true } },
       ]);
     });
 
@@ -382,7 +572,7 @@ describe('global base all', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'All', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'All', overridden: true } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
       ]);
     });
   });
@@ -412,7 +602,7 @@ describe('global base read', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'Read', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Read', overridden: true } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Read', overridden: false } },
       ]);
     });
 
@@ -438,7 +628,41 @@ describe('global base read', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'Read', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Read', overridden: true } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
+      ]);
+    });
+
+    it('normal feature privilege minimal_read', () => {
+      const props = buildProps([
+        { spaces: ['*'], base: ['read'], feature: {} },
+        {
+          spaces: ['default', 'marketing'],
+          base: [],
+          feature: { normal_with_sub: ['minimal_read'] },
+        },
+      ]);
+      const component = mountWithIntl(<PrivilegeSpaceTable {...props} />);
+      const actualTable = getTableFromComponent(component);
+      expect(actualTable).toEqual([
+        { spaces: ['*'], privileges: { summary: 'Read', overridden: false } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: true } },
+      ]);
+    });
+
+    it('normal feature privilege minimal_read and normal_sub_read', () => {
+      const props = buildProps([
+        { spaces: ['*'], base: ['read'], feature: {} },
+        {
+          spaces: ['default', 'marketing'],
+          base: [],
+          feature: { normal_with_sub: ['minimal_read', 'normal_sub_read'] },
+        },
+      ]);
+      const component = mountWithIntl(<PrivilegeSpaceTable {...props} />);
+      const actualTable = getTableFromComponent(component);
+      expect(actualTable).toEqual([
+        { spaces: ['*'], privileges: { summary: 'Read', overridden: false } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
       ]);
     });
 
@@ -506,7 +730,7 @@ describe('global base read', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'Read', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Read', overridden: true } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
       ]);
     });
   });
@@ -562,7 +786,7 @@ describe('global normal feature privilege all', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'Custom', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: true } },
       ]);
     });
 
@@ -844,7 +1068,7 @@ describe('global bothPrivilegesExcludedFromBase feature privilege all', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'Custom', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: true } },
       ]);
     });
 
@@ -1126,7 +1350,7 @@ describe('global allPrivilegeExcludedFromBase feature privilege all', () => {
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'Custom', overridden: false } },
-        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: false } },
+        { spaces: ['Default', 'Marketing'], privileges: { summary: 'Custom', overridden: true } },
       ]);
     });
   });
@@ -1213,6 +1437,7 @@ describe('global allPrivilegeExcludedFromBase feature privilege read', () => {
         },
       ]);
       const component = mountWithIntl(<PrivilegeSpaceTable {...props} />);
+
       const actualTable = getTableFromComponent(component);
       expect(actualTable).toEqual([
         { spaces: ['*'], privileges: { summary: 'Custom', overridden: false } },
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_table.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_table.tsx
index 1a43fb9e2683a..ccb5398a11b23 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_table.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/privilege_space_table.tsx
@@ -10,35 +10,32 @@ import {
   EuiButtonIcon,
   EuiInMemoryTable,
   EuiBasicTableColumn,
+  EuiIcon,
+  EuiIconTip,
+  EuiFlexGroup,
+  EuiFlexItem,
 } from '@elastic/eui';
-import { FormattedMessage, InjectedIntl } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
+import _ from 'lodash';
 import React, { Component } from 'react';
 import { Space, getSpaceColor } from '../../../../../../../../spaces/public';
-import {
-  FeaturesPrivileges,
-  Role,
-  RoleKibanaPrivilege,
-  copyRole,
-} from '../../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from '../kibana_privilege_calculator';
-import {
-  isGlobalPrivilegeDefinition,
-  hasAssignedFeaturePrivileges,
-} from '../../../privilege_utils';
-import { CUSTOM_PRIVILEGE_VALUE, NO_PRIVILEGE_VALUE } from '../constants';
+import { FeaturesPrivileges, Role, copyRole } from '../../../../../../../common/model';
 import { SpacesPopoverList } from '../../../spaces_popover_list';
 import { PrivilegeDisplay } from './privilege_display';
+import { isGlobalPrivilegeDefinition } from '../../../privilege_utils';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import { CUSTOM_PRIVILEGE_VALUE } from '../constants';
 
 const SPACES_DISPLAY_COUNT = 4;
 
 interface Props {
   role: Role;
-  privilegeCalculatorFactory: KibanaPrivilegeCalculatorFactory;
+  privilegeCalculator: PrivilegeFormCalculator;
   onChange: (role: Role) => void;
-  onEdit: (spacesIndex: number) => void;
+  onEdit: (privilegeIndex: number) => void;
   displaySpaces: Space[];
   disabled?: boolean;
-  intl: InjectedIntl;
 }
 
 interface State {
@@ -52,12 +49,13 @@ type TableSpace = Space &
 
 interface TableRow {
   spaces: TableSpace[];
-  spacesIndex: number;
+  privilegeIndex: number;
   isGlobal: boolean;
   privileges: {
     spaces: string[];
     base: string[];
     feature: FeaturesPrivileges;
+    reserved: string[];
   };
 }
 
@@ -71,15 +69,11 @@ export class PrivilegeSpaceTable extends Component<Props, State> {
   }
 
   private renderKibanaPrivileges = () => {
-    const { privilegeCalculatorFactory, displaySpaces, intl } = this.props;
+    const { privilegeCalculator, displaySpaces } = this.props;
 
     const spacePrivileges = this.getSortedPrivileges();
 
-    const privilegeCalculator = privilegeCalculatorFactory.getInstance(this.props.role);
-
-    const effectivePrivileges = privilegeCalculator.calculateEffectivePrivileges(false);
-
-    const rows: TableRow[] = spacePrivileges.map((spacePrivs, spacesIndex) => {
+    const rows: TableRow[] = spacePrivileges.map((spacePrivs, privilegeIndex) => {
       const spaces = spacePrivs.spaces.map(
         spaceId =>
           displaySpaces.find(space => space.id === spaceId) || {
@@ -92,12 +86,13 @@ export class PrivilegeSpaceTable extends Component<Props, State> {
 
       return {
         spaces,
-        spacesIndex,
+        privilegeIndex,
         isGlobal: isGlobalPrivilegeDefinition(spacePrivs),
         privileges: {
           spaces: spacePrivs.spaces,
           base: spacePrivs.base || [],
           feature: spacePrivs.feature || {},
+          reserved: spacePrivs._reserved || [],
         },
       };
     });
@@ -117,26 +112,27 @@ export class PrivilegeSpaceTable extends Component<Props, State> {
         name: 'Spaces',
         width: '60%',
         render: (spaces: TableSpace[], record: TableRow) => {
-          const isExpanded = this.state.expandedSpacesGroups.includes(record.spacesIndex);
+          const isExpanded = this.state.expandedSpacesGroups.includes(record.privilegeIndex);
           const displayedSpaces = isExpanded ? spaces : spaces.slice(0, SPACES_DISPLAY_COUNT);
 
           let button = null;
           if (record.isGlobal) {
             button = (
               <SpacesPopoverList
-                spaces={this.props.displaySpaces}
-                intl={this.props.intl}
-                buttonText={this.props.intl.formatMessage({
-                  id: 'xpack.security.management.editRole.spacePrivilegeTable.showAllSpacesLink',
-                  defaultMessage: 'show spaces',
-                })}
+                spaces={this.props.displaySpaces.filter(s => s.id !== '*')}
+                buttonText={i18n.translate(
+                  'xpack.security.management.editRole.spacePrivilegeTable.showAllSpacesLink',
+                  {
+                    defaultMessage: 'show spaces',
+                  }
+                )}
               />
             );
           } else if (spaces.length > displayedSpaces.length) {
             button = (
               <EuiButtonEmpty
                 size="xs"
-                onClick={() => this.toggleExpandSpacesGroup(record.spacesIndex)}
+                onClick={() => this.toggleExpandSpacesGroup(record.privilegeIndex)}
               >
                 <FormattedMessage
                   id="xpack.security.management.editRole.spacePrivilegeTable.showNMoreSpacesLink"
@@ -149,7 +145,7 @@ export class PrivilegeSpaceTable extends Component<Props, State> {
             button = (
               <EuiButtonEmpty
                 size="xs"
-                onClick={() => this.toggleExpandSpacesGroup(record.spacesIndex)}
+                onClick={() => this.toggleExpandSpacesGroup(record.privilegeIndex)}
               >
                 <FormattedMessage
                   id="xpack.security.management.editRole.spacePrivilegeTable.showLessSpacesLink"
@@ -161,15 +157,18 @@ export class PrivilegeSpaceTable extends Component<Props, State> {
 
           return (
             <div>
-              {displayedSpaces.map((space: TableSpace) => (
-                <EuiBadge
-                  key={space.id}
-                  {...getExtraBadgeProps(space)}
-                  color={getSpaceColor(space)}
-                >
-                  {space.name}
-                </EuiBadge>
-              ))}
+              <span data-test-subj="spacesColumn">
+                {displayedSpaces.map((space: TableSpace) => (
+                  <EuiBadge
+                    key={space.id}
+                    {...getExtraBadgeProps(space)}
+                    color={getSpaceColor(space)}
+                  >
+                    {space.name}
+                  </EuiBadge>
+                ))}
+              </span>
+
               {button}
             </div>
           );
@@ -178,45 +177,48 @@ export class PrivilegeSpaceTable extends Component<Props, State> {
       {
         field: 'privileges',
         name: 'Privileges',
-        render: (privileges: RoleKibanaPrivilege, record: TableRow) => {
-          const effectivePrivilege = effectivePrivileges[record.spacesIndex];
-          const basePrivilege = effectivePrivilege.base;
-
-          if (effectivePrivilege.reserved != null && effectivePrivilege.reserved.length > 0) {
-            return <PrivilegeDisplay privilege={effectivePrivilege.reserved} />;
-          } else if (record.isGlobal) {
+        render: (privileges: TableRow['privileges'], record: TableRow) => {
+          if (privileges.reserved.length > 0) {
             return (
               <PrivilegeDisplay
-                privilege={
-                  hasAssignedFeaturePrivileges(privileges)
-                    ? CUSTOM_PRIVILEGE_VALUE
-                    : basePrivilege.actualPrivilege
-                }
+                privilege={privileges.reserved}
+                data-test-subj={`privilegeColumn`}
               />
             );
-          } else {
-            const hasNonSupersededCustomizations = Object.keys(privileges.feature).some(
-              featureId => {
-                const featureEffectivePrivilege = effectivePrivilege.feature[featureId];
-                return (
-                  featureEffectivePrivilege &&
-                  featureEffectivePrivilege.directlyAssignedFeaturePrivilegeMorePermissiveThanBase
-                );
-              }
-            );
-
-            const showCustom =
-              hasNonSupersededCustomizations ||
-              (hasAssignedFeaturePrivileges(privileges) &&
-                effectivePrivilege.base.actualPrivilege === NO_PRIVILEGE_VALUE);
+          }
 
-            return (
-              <PrivilegeDisplay
-                explanation={hasNonSupersededCustomizations ? undefined : basePrivilege}
-                privilege={showCustom ? CUSTOM_PRIVILEGE_VALUE : basePrivilege.actualPrivilege}
-              />
+          let icon = <EuiIcon type="empty" size="s" />;
+          if (privilegeCalculator.hasSupersededInheritedPrivileges(record.privilegeIndex)) {
+            icon = (
+              <span data-test-subj="spaceTablePrivilegeSupersededWarning">
+                <EuiIconTip
+                  type="alert"
+                  size="s"
+                  content={
+                    <FormattedMessage
+                      id="xpack.security.management.editRole.spacePrivilegeTable.supersededPrivilegeWarning"
+                      defaultMessage="Privileges are superseded by configured global privilege. View the privilege summary to see effective privileges."
+                    />
+                  }
+                />
+              </span>
             );
           }
+
+          return (
+            <EuiFlexGroup gutterSize="xs" alignItems="center">
+              <EuiFlexItem grow={false}>{icon}</EuiFlexItem>
+              <EuiFlexItem>
+                <PrivilegeDisplay
+                  privilege={
+                    privilegeCalculator.getBasePrivilege(record.privilegeIndex)?.id ??
+                    CUSTOM_PRIVILEGE_VALUE
+                  }
+                  data-test-subj={`privilegeColumn`}
+                />
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          );
         },
       },
     ];
@@ -229,19 +231,16 @@ export class PrivilegeSpaceTable extends Component<Props, State> {
             render: (record: TableRow) => {
               return (
                 <EuiButtonIcon
-                  aria-label={intl.formatMessage(
+                  aria-label={i18n.translate(
+                    'xpack.security.management.editRole.spacePrivilegeTable.editPrivilegesLabel',
                     {
-                      id:
-                        'xpack.security.management.editRole.spacePrivilegeTable.editPrivilegesLabel',
                       defaultMessage: `Edit privileges for the following spaces: {spaceNames}.`,
-                    },
-                    {
-                      spaceNames: record.spaces.map(s => s.name).join(', '),
+                      values: { spaceNames: record.spaces.map(s => s.name).join(', ') },
                     }
                   )}
                   color={'primary'}
                   iconType={'pencil'}
-                  onClick={() => this.props.onEdit(record.spacesIndex)}
+                  onClick={() => this.props.onEdit(record.privilegeIndex)}
                 />
               );
             },
@@ -250,14 +249,11 @@ export class PrivilegeSpaceTable extends Component<Props, State> {
             render: (record: TableRow) => {
               return (
                 <EuiButtonIcon
-                  aria-label={intl.formatMessage(
+                  aria-label={i18n.translate(
+                    'xpack.security.management.editRole.spacePrivilegeTable.deletePrivilegesLabel',
                     {
-                      id:
-                        'xpack.security.management.editRole.spacePrivilegeTable.deletePrivilegesLabel',
                       defaultMessage: `Delete privileges for the following spaces: {spaceNames}.`,
-                    },
-                    {
-                      spaceNames: record.spaces.map(s => s.name).join(', '),
+                      values: { spaceNames: record.spaces.map(s => s.name).join(', ') },
                     }
                   )}
                   color={'danger'}
@@ -294,26 +290,26 @@ export class PrivilegeSpaceTable extends Component<Props, State> {
     });
   };
 
-  private toggleExpandSpacesGroup = (spacesIndex: number) => {
-    if (this.state.expandedSpacesGroups.includes(spacesIndex)) {
+  private toggleExpandSpacesGroup = (privilegeIndex: number) => {
+    if (this.state.expandedSpacesGroups.includes(privilegeIndex)) {
       this.setState({
-        expandedSpacesGroups: this.state.expandedSpacesGroups.filter(i => i !== spacesIndex),
+        expandedSpacesGroups: this.state.expandedSpacesGroups.filter(i => i !== privilegeIndex),
       });
     } else {
       this.setState({
-        expandedSpacesGroups: [...this.state.expandedSpacesGroups, spacesIndex],
+        expandedSpacesGroups: [...this.state.expandedSpacesGroups, privilegeIndex],
       });
     }
   };
 
   private onDeleteSpacePrivilege = (item: TableRow) => {
     const roleCopy = copyRole(this.props.role);
-    roleCopy.kibana.splice(item.spacesIndex, 1);
+    roleCopy.kibana.splice(item.privilegeIndex, 1);
 
     this.props.onChange(roleCopy);
 
     this.setState({
-      expandedSpacesGroups: this.state.expandedSpacesGroups.filter(i => i !== item.spacesIndex),
+      expandedSpacesGroups: this.state.expandedSpacesGroups.filter(i => i !== item.privilegeIndex),
     });
   };
 }
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_aware_privilege_section.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_aware_privilege_section.test.tsx
index e06d2a4f7dc33..a9bcb5433fcc7 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_aware_privilege_section.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_aware_privilege_section.test.tsx
@@ -6,13 +6,13 @@
 
 import React from 'react';
 import { mountWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
-import { KibanaPrivileges } from '../../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from '../kibana_privilege_calculator';
 import { RoleValidator } from '../../../validate_role';
-import { PrivilegeMatrix } from './privilege_matrix';
 import { PrivilegeSpaceForm } from './privilege_space_form';
 import { PrivilegeSpaceTable } from './privilege_space_table';
 import { SpaceAwarePrivilegeSection } from './space_aware_privilege_section';
+import { PrivilegeSummary } from '../privilege_summary';
+import { createKibanaPrivileges } from '../../../../__fixtures__/kibana_privileges';
+import { kibanaFeatures } from '../../../../__fixtures__/kibana_features';
 
 const buildProps = (customProps: any = {}) => {
   return {
@@ -42,23 +42,12 @@ const buildProps = (customProps: any = {}) => {
         manage: true,
       },
     },
-    features: [],
+    features: kibanaFeatures,
     editable: true,
     onChange: jest.fn(),
     validator: new RoleValidator(),
-    privilegeCalculatorFactory: new KibanaPrivilegeCalculatorFactory(
-      new KibanaPrivileges({
-        features: {
-          feature1: {
-            all: ['*'],
-            read: ['read'],
-          },
-        },
-        global: {},
-        space: {},
-        reserved: {},
-      })
-    ),
+    kibanaPrivileges: createKibanaPrivileges(kibanaFeatures),
+    canCustomizeSubFeaturePrivileges: true,
     ...customProps,
   };
 };
@@ -80,7 +69,7 @@ describe('<SpaceAwarePrivilegeSection>', () => {
       },
     });
 
-    const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection.WrappedComponent {...props} />);
+    const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection {...props} />);
 
     const table = wrapper.find(PrivilegeSpaceTable);
     expect(table).toHaveLength(1);
@@ -89,13 +78,13 @@ describe('<SpaceAwarePrivilegeSection>', () => {
   it('hides the space table if there are no existing space privileges', () => {
     const props = buildProps();
 
-    const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection.WrappedComponent {...props} />);
+    const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection {...props} />);
 
     const table = wrapper.find(PrivilegeSpaceTable);
     expect(table).toHaveLength(0);
   });
 
-  it('Renders flyout after clicking "Add a privilege" button', () => {
+  it('Renders flyout after clicking "Add space privilege" button', () => {
     const props = buildProps({
       role: {
         elasticsearch: {
@@ -111,7 +100,7 @@ describe('<SpaceAwarePrivilegeSection>', () => {
       },
     });
 
-    const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection.WrappedComponent {...props} />);
+    const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection {...props} />);
     expect(wrapper.find(PrivilegeSpaceForm)).toHaveLength(0);
 
     wrapper.find('button[data-test-subj="addSpacePrivilegeButton"]').simulate('click');
@@ -119,7 +108,7 @@ describe('<SpaceAwarePrivilegeSection>', () => {
     expect(wrapper.find(PrivilegeSpaceForm)).toHaveLength(1);
   });
 
-  it('hides privilege matrix when the role is reserved', () => {
+  it('hides privilege summary when the role is reserved', () => {
     const props = buildProps({
       role: {
         name: '',
@@ -135,8 +124,8 @@ describe('<SpaceAwarePrivilegeSection>', () => {
       },
     });
 
-    const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection.WrappedComponent {...props} />);
-    expect(wrapper.find(PrivilegeMatrix)).toHaveLength(0);
+    const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection {...props} />);
+    expect(wrapper.find(PrivilegeSummary)).toHaveLength(0);
   });
 
   describe('with base privilege set to "read"', () => {
@@ -156,7 +145,7 @@ describe('<SpaceAwarePrivilegeSection>', () => {
         },
       });
 
-      const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection.WrappedComponent {...props} />);
+      const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection {...props} />);
 
       const table = wrapper.find(PrivilegeSpaceTable);
       expect(table).toHaveLength(1);
@@ -183,7 +172,7 @@ describe('<SpaceAwarePrivilegeSection>', () => {
         },
       });
 
-      const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection.WrappedComponent {...props} />);
+      const wrapper = mountWithIntl(<SpaceAwarePrivilegeSection {...props} />);
 
       const table = wrapper.find(PrivilegeSpaceTable);
       expect(table).toHaveLength(1);
@@ -202,7 +191,7 @@ describe('<SpaceAwarePrivilegeSection>', () => {
         },
       });
 
-      const wrapper = shallowWithIntl(<SpaceAwarePrivilegeSection.WrappedComponent {...props} />);
+      const wrapper = shallowWithIntl(<SpaceAwarePrivilegeSection {...props} />);
       expect(wrapper).toMatchSnapshot();
     });
   });
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_aware_privilege_section.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_aware_privilege_section.tsx
index a847ccb677485..86b09e5332792 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_aware_privilege_section.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_aware_privilege_section.tsx
@@ -10,47 +10,49 @@ import {
   EuiFlexGroup,
   EuiFlexItem,
   EuiSpacer,
+  EuiErrorBoundary,
 } from '@elastic/eui';
-import { FormattedMessage, InjectedIntl, injectI18n } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n/react';
 import _ from 'lodash';
 import React, { Component, Fragment } from 'react';
 import { Capabilities } from 'src/core/public';
 import { Space } from '../../../../../../../../spaces/public';
-import { Feature } from '../../../../../../../../features/public';
-import { KibanaPrivileges, Role, isRoleReserved } from '../../../../../../../common/model';
-import { KibanaPrivilegeCalculatorFactory } from '../kibana_privilege_calculator';
+import { Role, isRoleReserved } from '../../../../../../../common/model';
 import { RoleValidator } from '../../../validate_role';
-import { PrivilegeMatrix } from './privilege_matrix';
-import { PrivilegeSpaceForm } from './privilege_space_form';
 import { PrivilegeSpaceTable } from './privilege_space_table';
+import { PrivilegeSpaceForm } from './privilege_space_form';
+import { PrivilegeFormCalculator } from '../privilege_form_calculator';
+import { PrivilegeSummary } from '../privilege_summary';
+import { KibanaPrivileges } from '../../../../model';
 
 interface Props {
   kibanaPrivileges: KibanaPrivileges;
   role: Role;
-  privilegeCalculatorFactory: KibanaPrivilegeCalculatorFactory;
   spaces: Space[];
   onChange: (role: Role) => void;
   editable: boolean;
+  canCustomizeSubFeaturePrivileges: boolean;
   validator: RoleValidator;
-  intl: InjectedIntl;
   uiCapabilities: Capabilities;
-  features: Feature[];
 }
 
 interface State {
   role: Role | null;
-  editingIndex: number;
+  privilegeIndex: number;
   showSpacePrivilegeEditor: boolean;
   showPrivilegeMatrix: boolean;
 }
 
-class SpaceAwarePrivilegeSectionUI extends Component<Props, State> {
+export class SpaceAwarePrivilegeSection extends Component<Props, State> {
   private globalSpaceEntry: Space = {
     id: '*',
-    name: this.props.intl.formatMessage({
-      id: 'xpack.security.management.editRole.spaceAwarePrivilegeForm.globalSpacesName',
-      defaultMessage: '* Global (all spaces)',
-    }),
+    name: i18n.translate(
+      'xpack.security.management.editRole.spaceAwarePrivilegeForm.globalSpacesName',
+      {
+        defaultMessage: '* Global (all spaces)',
+      }
+    ),
     color: '#D3DAE6',
     initials: '*',
     disabledFeatures: [],
@@ -63,12 +65,12 @@ class SpaceAwarePrivilegeSectionUI extends Component<Props, State> {
       showSpacePrivilegeEditor: false,
       showPrivilegeMatrix: false,
       role: null,
-      editingIndex: -1,
+      privilegeIndex: -1,
     };
   }
 
   public render() {
-    const { uiCapabilities, privilegeCalculatorFactory } = this.props;
+    const { uiCapabilities } = this.props;
 
     if (!uiCapabilities.spaces.manage) {
       return (
@@ -113,22 +115,22 @@ class SpaceAwarePrivilegeSectionUI extends Component<Props, State> {
     }
 
     return (
-      <Fragment>
-        {this.renderKibanaPrivileges()}
-        {this.state.showSpacePrivilegeEditor && (
-          <PrivilegeSpaceForm
-            role={this.props.role}
-            privilegeCalculatorFactory={privilegeCalculatorFactory}
-            kibanaPrivileges={this.props.kibanaPrivileges}
-            features={this.props.features}
-            intl={this.props.intl}
-            onChange={this.onSpacesPrivilegeChange}
-            onCancel={this.onCancelEditPrivileges}
-            spaces={this.getAvailableSpaces(this.state.editingIndex)}
-            editingIndex={this.state.editingIndex}
-          />
-        )}
-      </Fragment>
+      <EuiErrorBoundary>
+        <Fragment>
+          {this.renderKibanaPrivileges()}
+          {this.state.showSpacePrivilegeEditor && (
+            <PrivilegeSpaceForm
+              role={this.props.role}
+              kibanaPrivileges={this.props.kibanaPrivileges}
+              onChange={this.onSpacesPrivilegeChange}
+              onCancel={this.onCancelEditPrivileges}
+              spaces={this.getAvailableSpaces(this.state.privilegeIndex)}
+              privilegeIndex={this.state.privilegeIndex}
+              canCustomizeSubFeaturePrivileges={this.props.canCustomizeSubFeaturePrivileges}
+            />
+          )}
+        </Fragment>
+      </EuiErrorBoundary>
     );
   }
 
@@ -143,10 +145,11 @@ class SpaceAwarePrivilegeSectionUI extends Component<Props, State> {
         <PrivilegeSpaceTable
           role={this.props.role}
           displaySpaces={this.getDisplaySpaces()}
-          privilegeCalculatorFactory={this.props.privilegeCalculatorFactory}
+          privilegeCalculator={
+            new PrivilegeFormCalculator(this.props.kibanaPrivileges, this.props.role)
+          }
           onChange={this.props.onChange}
           onEdit={this.onEditSpacesPrivileges}
-          intl={this.props.intl}
           disabled={!this.props.editable}
         />
       );
@@ -205,14 +208,11 @@ class SpaceAwarePrivilegeSectionUI extends Component<Props, State> {
     }
 
     const viewMatrixButton = (
-      <PrivilegeMatrix
+      <PrivilegeSummary
         role={this.props.role}
-        calculatedPrivileges={this.props.privilegeCalculatorFactory
-          .getInstance(this.props.role)
-          .calculateEffectivePrivileges()}
-        features={this.props.features}
         spaces={this.getDisplaySpaces()}
-        intl={this.props.intl}
+        kibanaPrivileges={this.props.kibanaPrivileges}
+        canCustomizeSubFeaturePrivileges={this.props.canCustomizeSubFeaturePrivileges}
       />
     );
 
@@ -250,18 +250,18 @@ class SpaceAwarePrivilegeSectionUI extends Component<Props, State> {
   private addSpacePrivilege = () => {
     this.setState({
       showSpacePrivilegeEditor: true,
-      editingIndex: -1,
+      privilegeIndex: -1,
     });
   };
 
   private onSpacesPrivilegeChange = (role: Role) => {
-    this.setState({ showSpacePrivilegeEditor: false, editingIndex: -1 });
+    this.setState({ showSpacePrivilegeEditor: false, privilegeIndex: -1 });
     this.props.onChange(role);
   };
 
-  private onEditSpacesPrivileges = (spacesIndex: number) => {
+  private onEditSpacesPrivileges = (privilegeIndex: number) => {
     this.setState({
-      editingIndex: spacesIndex,
+      privilegeIndex,
       showSpacePrivilegeEditor: true,
     });
   };
@@ -270,5 +270,3 @@ class SpaceAwarePrivilegeSectionUI extends Component<Props, State> {
     this.setState({ showSpacePrivilegeEditor: false });
   };
 }
-
-export const SpaceAwarePrivilegeSection = injectI18n(SpaceAwarePrivilegeSectionUI);
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_selector.tsx b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_selector.tsx
index 1e42a926c51f7..70790f785ad58 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_selector.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/space_aware_privilege_section/space_selector.tsx
@@ -5,9 +5,10 @@
  */
 
 import { EuiComboBox, EuiComboBoxOptionOption, EuiHealth, EuiHighlight } from '@elastic/eui';
-import { InjectedIntl } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
 import React, { Component } from 'react';
-import { Space, getSpaceColor } from '../../../../../../../../spaces/public';
+import { getSpaceColor } from '../../../../../../../../spaces/public';
+import { Space } from '../../../../../../../../spaces/common/model/space';
 
 const spaceToOption = (space?: Space, currentSelection?: 'global' | 'spaces') => {
   if (!space) {
@@ -32,7 +33,6 @@ interface Props {
   selectedSpaceIds: string[];
   onChange: (spaceIds: string[]) => void;
   disabled?: boolean;
-  intl: InjectedIntl;
 }
 
 export class SpaceSelector extends Component<Props, {}> {
@@ -51,8 +51,7 @@ export class SpaceSelector extends Component<Props, {}> {
     return (
       <EuiComboBox
         data-test-subj={'spaceSelectorComboBox'}
-        aria-label={this.props.intl.formatMessage({
-          id: 'xpack.security.management.editRole.spaceSelectorLabel',
+        aria-label={i18n.translate('xpack.security.management.editRole.spaceSelectorLabel', {
           defaultMessage: 'Spaces',
         })}
         fullWidth
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/spaces_popover_list/spaces_popover_list.test.tsx b/x-pack/plugins/security/public/management/roles/edit_role/spaces_popover_list/spaces_popover_list.test.tsx
new file mode 100644
index 0000000000000..20882864645d3
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/edit_role/spaces_popover_list/spaces_popover_list.test.tsx
@@ -0,0 +1,112 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import React from 'react';
+import { mountWithIntl } from 'test_utils/enzyme_helpers';
+import { SpacesPopoverList } from '.';
+import {
+  EuiButtonEmpty,
+  EuiContextMenuPanel,
+  EuiContextMenuItem,
+  EuiFieldSearch,
+  EuiPopover,
+} from '@elastic/eui';
+import { SpaceAvatar } from '../../../../../../spaces/public';
+
+const spaces = [
+  {
+    id: 'default',
+    name: 'Default Space',
+    description: 'this is your default space',
+    disabledFeatures: [],
+  },
+  {
+    id: 'space-1',
+    name: 'Space 1',
+    disabledFeatures: [],
+  },
+  {
+    id: 'space-2',
+    name: 'Space 2',
+    disabledFeatures: [],
+  },
+];
+
+describe('SpacesPopoverList', () => {
+  it('renders a button with the provided text', () => {
+    const wrapper = mountWithIntl(<SpacesPopoverList spaces={spaces} buttonText="hello world" />);
+    expect(wrapper.find(EuiButtonEmpty).text()).toEqual('hello world');
+    expect(wrapper.find(EuiContextMenuPanel)).toHaveLength(0);
+  });
+
+  it('clicking the button renders a context menu with the provided spaces', () => {
+    const wrapper = mountWithIntl(<SpacesPopoverList spaces={spaces} buttonText="hello world" />);
+    wrapper.find(EuiButtonEmpty).simulate('click');
+    wrapper.update();
+
+    const menu = wrapper.find(EuiContextMenuPanel);
+    expect(menu).toHaveLength(1);
+
+    const items = menu.find(EuiContextMenuItem);
+    expect(items).toHaveLength(spaces.length);
+
+    spaces.forEach((space, index) => {
+      const spaceAvatar = items.at(index).find(SpaceAvatar);
+      expect(spaceAvatar.props().space).toEqual(space);
+    });
+
+    expect(wrapper.find(EuiFieldSearch)).toHaveLength(0);
+  });
+
+  it('renders a search box when there are 8 or more spaces', () => {
+    const lotsOfSpaces = [1, 2, 3, 4, 5, 6, 7, 8].map(num => ({
+      id: `space-${num}`,
+      name: `Space ${num}`,
+      disabledFeatures: [],
+    }));
+
+    const wrapper = mountWithIntl(
+      <SpacesPopoverList spaces={lotsOfSpaces} buttonText="hello world" />
+    );
+    wrapper.find(EuiButtonEmpty).simulate('click');
+    wrapper.update();
+
+    const menu = wrapper.find(EuiContextMenuPanel).first();
+    const items = menu.find(EuiContextMenuItem);
+    expect(items).toHaveLength(lotsOfSpaces.length);
+
+    const searchField = wrapper.find(EuiFieldSearch);
+    expect(searchField).toHaveLength(1);
+
+    searchField.props().onSearch!('Space 6');
+    wrapper.update();
+    expect(wrapper.find(SpaceAvatar)).toHaveLength(1);
+
+    searchField.props().onSearch!('this does not match');
+    wrapper.update();
+    expect(wrapper.find(SpaceAvatar)).toHaveLength(0);
+
+    const updatedMenu = wrapper.find(EuiContextMenuPanel).first();
+    expect(updatedMenu.text()).toMatchInlineSnapshot(`"Spaces no spaces found "`);
+  });
+
+  it('can close its popover', () => {
+    const wrapper = mountWithIntl(<SpacesPopoverList spaces={spaces} buttonText="hello world" />);
+    wrapper.find(EuiButtonEmpty).simulate('click');
+    wrapper.update();
+
+    expect(wrapper.find(EuiPopover).props().isOpen).toEqual(true);
+
+    wrapper
+      .find(EuiPopover)
+      .props()
+      .closePopover();
+
+    wrapper.update();
+
+    expect(wrapper.find(EuiPopover).props().isOpen).toEqual(false);
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/spaces_popover_list/spaces_popover_list.tsx b/x-pack/plugins/security/public/management/roles/edit_role/spaces_popover_list/spaces_popover_list.tsx
index f8b2991a844f7..92e42ec811afc 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/spaces_popover_list/spaces_popover_list.tsx
+++ b/x-pack/plugins/security/public/management/roles/edit_role/spaces_popover_list/spaces_popover_list.tsx
@@ -12,14 +12,14 @@ import {
   EuiPopover,
   EuiText,
 } from '@elastic/eui';
-import { FormattedMessage, InjectedIntl } from '@kbn/i18n/react';
+import { FormattedMessage } from '@kbn/i18n/react';
+import { i18n } from '@kbn/i18n';
 import React, { Component } from 'react';
 import { Space, SpaceAvatar } from '../../../../../../spaces/public';
 import { SPACE_SEARCH_COUNT_THRESHOLD } from '../../../../../../spaces/common';
 
 interface Props {
   spaces: Space[];
-  intl: InjectedIntl;
   buttonText: string;
 }
 
@@ -59,15 +59,13 @@ export class SpacesPopoverList extends Component<Props, State> {
   }
 
   private getMenuPanel = () => {
-    const { intl } = this.props;
     const { searchTerm } = this.state;
 
     const items = this.getVisibleSpaces(searchTerm).map(this.renderSpaceMenuItem);
 
     const panelProps = {
       className: 'spcMenu',
-      title: intl.formatMessage({
-        id: 'xpack.security.management.editRole.spacesPopoverList.popoverTitle',
+      title: i18n.translate('xpack.security.management.editRole.spacesPopoverList.popoverTitle', {
         defaultMessage: 'Spaces',
       }),
       watchedItemProps: ['data-search-term'],
@@ -141,15 +139,16 @@ export class SpacesPopoverList extends Component<Props, State> {
   };
 
   private renderSearchField = () => {
-    const { intl } = this.props;
     return (
       <div key="manageSpacesSearchField" className="spcMenu__searchFieldWrapper">
         {
           <EuiFieldSearch
-            placeholder={intl.formatMessage({
-              id: 'xpack.security.management.editRole.spacesPopoverList.findSpacePlaceholder',
-              defaultMessage: 'Find a space',
-            })}
+            placeholder={i18n.translate(
+              'xpack.security.management.editRole.spacesPopoverList.findSpacePlaceholder',
+              {
+                defaultMessage: 'Find a space',
+              }
+            )}
             incremental={true}
             onSearch={this.onSearch}
             onKeyDown={this.onSearchKeyDown}
diff --git a/x-pack/plugins/security/public/management/roles/model/index.ts b/x-pack/plugins/security/public/management/roles/model/index.ts
new file mode 100644
index 0000000000000..8000300f57e10
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { SecuredFeature } from './secured_feature';
+export { SecuredSubFeature } from './secured_sub_feature';
+export { SubFeaturePrivilegeGroup } from './sub_feature_privilege_group';
+export { SubFeaturePrivilege } from './sub_feature_privilege';
+export { PrimaryFeaturePrivilege } from './primary_feature_privilege';
+export { KibanaPrivileges } from './kibana_privileges';
+export { KibanaPrivilege } from './kibana_privilege';
+export { PrivilegeCollection } from './privilege_collection';
diff --git a/x-pack/plugins/security/public/management/roles/model/kibana_privilege.ts b/x-pack/plugins/security/public/management/roles/model/kibana_privilege.ts
new file mode 100644
index 0000000000000..7c21a4b5c0ee6
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/kibana_privilege.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import _ from 'lodash';
+
+export class KibanaPrivilege {
+  constructor(public readonly id: string, public readonly actions: string[] = []) {}
+
+  public get name() {
+    return _.capitalize(this.id);
+  }
+
+  public grantsPrivilege(candidatePrivilege: KibanaPrivilege) {
+    return this.checkActions(this.actions, candidatePrivilege.actions).hasAllRequested;
+  }
+
+  private checkActions(knownActions: string[], candidateActions: string[]) {
+    const missing = candidateActions.filter(action => !knownActions.includes(action));
+
+    const hasAllRequested =
+      knownActions.length > 0 && candidateActions.length > 0 && missing.length === 0;
+
+    return {
+      missing,
+      hasAllRequested,
+    };
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/model/kibana_privileges.test.ts b/x-pack/plugins/security/public/management/roles/model/kibana_privileges.test.ts
new file mode 100644
index 0000000000000..a1f1e36e8df86
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/kibana_privileges.test.ts
@@ -0,0 +1,144 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { createRawKibanaPrivileges } from '../__fixtures__/kibana_privileges';
+import { kibanaFeatures } from '../__fixtures__/kibana_features';
+import { KibanaPrivileges } from './kibana_privileges';
+import { RoleKibanaPrivilege } from '../../../../common/model';
+import { KibanaPrivilege } from './kibana_privilege';
+
+describe('KibanaPrivileges', () => {
+  describe('#getBasePrivileges', () => {
+    it('returns the space base privileges for a non-global entry', () => {
+      const rawPrivileges = createRawKibanaPrivileges(kibanaFeatures);
+      const kibanaPrivileges = new KibanaPrivileges(rawPrivileges, kibanaFeatures);
+
+      const entry: RoleKibanaPrivilege = {
+        base: [],
+        feature: {},
+        spaces: ['foo'],
+      };
+
+      const basePrivileges = kibanaPrivileges.getBasePrivileges(entry);
+
+      const expectedPrivileges = rawPrivileges.space;
+
+      expect(basePrivileges).toHaveLength(2);
+      expect(basePrivileges[0]).toMatchObject({
+        id: 'all',
+        actions: expectedPrivileges.all,
+      });
+      expect(basePrivileges[1]).toMatchObject({
+        id: 'read',
+        actions: expectedPrivileges.read,
+      });
+    });
+
+    it('returns the global base privileges for a global entry', () => {
+      const rawPrivileges = createRawKibanaPrivileges(kibanaFeatures);
+      const kibanaPrivileges = new KibanaPrivileges(rawPrivileges, kibanaFeatures);
+
+      const entry: RoleKibanaPrivilege = {
+        base: [],
+        feature: {},
+        spaces: ['*'],
+      };
+
+      const basePrivileges = kibanaPrivileges.getBasePrivileges(entry);
+
+      const expectedPrivileges = rawPrivileges.global;
+
+      expect(basePrivileges).toHaveLength(2);
+      expect(basePrivileges[0]).toMatchObject({
+        id: 'all',
+        actions: expectedPrivileges.all,
+      });
+      expect(basePrivileges[1]).toMatchObject({
+        id: 'read',
+        actions: expectedPrivileges.read,
+      });
+    });
+  });
+
+  describe('#createCollectionFromRoleKibanaPrivileges', () => {
+    it('creates a collection from a role with no privileges assigned', () => {
+      const rawPrivileges = createRawKibanaPrivileges(kibanaFeatures);
+      const kibanaPrivileges = new KibanaPrivileges(rawPrivileges, kibanaFeatures);
+
+      const assignedPrivileges: RoleKibanaPrivilege[] = [];
+      kibanaPrivileges.createCollectionFromRoleKibanaPrivileges(assignedPrivileges);
+    });
+
+    it('creates a collection ignoring unknown privileges', () => {
+      const rawPrivileges = createRawKibanaPrivileges(kibanaFeatures);
+      const kibanaPrivileges = new KibanaPrivileges(rawPrivileges, kibanaFeatures);
+
+      const assignedPrivileges: RoleKibanaPrivilege[] = [
+        {
+          base: ['read', 'some-unknown-base-privilege'],
+          feature: {},
+          spaces: ['*'],
+        },
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['read', 'cool_all', 'some-unknown-feature-privilege'],
+            some_unknown_feature: ['all'],
+          },
+          spaces: ['foo'],
+        },
+      ];
+      kibanaPrivileges.createCollectionFromRoleKibanaPrivileges(assignedPrivileges);
+    });
+
+    it('creates a collection using all assigned privileges, and only the assigned privileges', () => {
+      const rawPrivileges = createRawKibanaPrivileges(kibanaFeatures);
+      const kibanaPrivileges = new KibanaPrivileges(rawPrivileges, kibanaFeatures);
+
+      const assignedPrivileges: RoleKibanaPrivilege[] = [
+        {
+          base: ['read'],
+          feature: {},
+          spaces: ['*'],
+        },
+        {
+          base: [],
+          feature: {
+            with_sub_features: ['read', 'cool_all'],
+          },
+          spaces: ['foo'],
+        },
+      ];
+      const collection = kibanaPrivileges.createCollectionFromRoleKibanaPrivileges(
+        assignedPrivileges
+      );
+
+      expect(
+        collection.grantsPrivilege(
+          new KibanaPrivilege('test', [...rawPrivileges.features.with_excluded_sub_features.read])
+        )
+      ).toEqual(true);
+
+      expect(
+        collection.grantsPrivilege(
+          new KibanaPrivilege('test', [...rawPrivileges.features.with_excluded_sub_features.all])
+        )
+      ).toEqual(false);
+
+      expect(
+        collection.grantsPrivilege(
+          new KibanaPrivilege('test', [...rawPrivileges.features.with_sub_features.cool_all])
+        )
+      ).toEqual(true);
+
+      expect(
+        collection.grantsPrivilege(
+          new KibanaPrivilege('test', [...rawPrivileges.features.with_sub_features.cool_toggle_1])
+        )
+      ).toEqual(false);
+    });
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/model/kibana_privileges.ts b/x-pack/plugins/security/public/management/roles/model/kibana_privileges.ts
new file mode 100644
index 0000000000000..d8d75e90847e3
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/kibana_privileges.ts
@@ -0,0 +1,86 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RawKibanaPrivileges, RoleKibanaPrivilege } from '../../../../common/model';
+import { KibanaPrivilege } from './kibana_privilege';
+import { PrivilegeCollection } from './privilege_collection';
+import { SecuredFeature } from './secured_feature';
+import { Feature } from '../../../../../features/common';
+import { isGlobalPrivilegeDefinition } from '../edit_role/privilege_utils';
+
+function toBasePrivilege(entry: [string, string[]]): [string, KibanaPrivilege] {
+  const [privilegeId, actions] = entry;
+  return [privilegeId, new KibanaPrivilege(privilegeId, actions)];
+}
+
+function recordsToBasePrivilegeMap(
+  record: Record<string, string[]>
+): ReadonlyMap<string, KibanaPrivilege> {
+  return new Map(Object.entries(record).map(entry => toBasePrivilege(entry)));
+}
+
+export class KibanaPrivileges {
+  private global: ReadonlyMap<string, KibanaPrivilege>;
+
+  private spaces: ReadonlyMap<string, KibanaPrivilege>;
+
+  private feature: ReadonlyMap<string, SecuredFeature>;
+
+  constructor(rawKibanaPrivileges: RawKibanaPrivileges, features: Feature[]) {
+    this.global = recordsToBasePrivilegeMap(rawKibanaPrivileges.global);
+    this.spaces = recordsToBasePrivilegeMap(rawKibanaPrivileges.space);
+    this.feature = new Map(
+      features.map(feature => {
+        const rawPrivs = rawKibanaPrivileges.features[feature.id];
+        return [feature.id, new SecuredFeature(feature.toRaw(), rawPrivs)];
+      })
+    );
+  }
+
+  public getBasePrivileges(entry: RoleKibanaPrivilege) {
+    if (isGlobalPrivilegeDefinition(entry)) {
+      return Array.from(this.global.values());
+    }
+    return Array.from(this.spaces.values());
+  }
+
+  public getSecuredFeature(featureId: string) {
+    return this.feature.get(featureId)!;
+  }
+
+  public getSecuredFeatures() {
+    return Array.from(this.feature.values());
+  }
+
+  public createCollectionFromRoleKibanaPrivileges(roleKibanaPrivileges: RoleKibanaPrivilege[]) {
+    const filterAssigned = (assignedPrivileges: string[]) => (privilege: KibanaPrivilege) =>
+      assignedPrivileges.includes(privilege.id);
+
+    const privileges: KibanaPrivilege[] = roleKibanaPrivileges
+      .map(entry => {
+        const assignedBasePrivileges = this.getBasePrivileges(entry).filter(
+          filterAssigned(entry.base)
+        );
+
+        const assignedFeaturePrivileges: KibanaPrivilege[][] = Object.entries(entry.feature).map(
+          ([featureId, assignedFeaturePrivs]) => {
+            return this.getFeaturePrivileges(featureId).filter(
+              filterAssigned(assignedFeaturePrivs)
+            );
+          }
+        );
+
+        return [assignedBasePrivileges, assignedFeaturePrivileges].flat<KibanaPrivilege>(2);
+      })
+      .flat<KibanaPrivilege>();
+
+    return new PrivilegeCollection(privileges);
+  }
+
+  private getFeaturePrivileges(featureId: string) {
+    return this.getSecuredFeature(featureId)?.getAllPrivileges() ?? [];
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/model/primary_feature_privilege.ts b/x-pack/plugins/security/public/management/roles/model/primary_feature_privilege.ts
new file mode 100644
index 0000000000000..9ed460fe734ef
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/primary_feature_privilege.ts
@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { KibanaPrivilege } from './kibana_privilege';
+import { FeatureKibanaPrivileges } from '../../../../../features/public';
+
+export class PrimaryFeaturePrivilege extends KibanaPrivilege {
+  constructor(
+    id: string,
+    protected readonly config: FeatureKibanaPrivileges,
+    public readonly actions: string[] = []
+  ) {
+    super(id, actions);
+  }
+
+  public isMinimalFeaturePrivilege() {
+    return this.id.startsWith('minimal_');
+  }
+
+  public getMinimalPrivilegeId() {
+    if (this.isMinimalFeaturePrivilege()) {
+      return this.id;
+    }
+    return `minimal_${this.id}`;
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/model/privilege_collection.test.ts b/x-pack/plugins/security/public/management/roles/model/privilege_collection.test.ts
new file mode 100644
index 0000000000000..6b1c3785721b3
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/privilege_collection.test.ts
@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { KibanaPrivilege } from './kibana_privilege';
+import { PrivilegeCollection } from './privilege_collection';
+
+describe('PrivilegeCollection', () => {
+  describe('#grantsPrivilege', () => {
+    it('returns true when the collection contains the same privilege being tested', () => {
+      const privilege = new KibanaPrivilege('some-privilege', ['action:foo', 'action:bar']);
+      const collection = new PrivilegeCollection([privilege]);
+
+      expect(collection.grantsPrivilege(privilege)).toEqual(true);
+    });
+
+    it('returns false when a non-empty collection tests an empty privilege', () => {
+      const privilege = new KibanaPrivilege('some-privilege', ['action:foo', 'action:bar']);
+      const collection = new PrivilegeCollection([privilege]);
+
+      expect(collection.grantsPrivilege(new KibanaPrivilege('test', []))).toEqual(false);
+    });
+
+    it('returns true for collections comprised of multiple privileges, with actions spanning them', () => {
+      const collection = new PrivilegeCollection([
+        new KibanaPrivilege('privilege1', ['action:foo', 'action:bar']),
+        new KibanaPrivilege('privilege1', ['action:baz']),
+      ]);
+
+      expect(
+        collection.grantsPrivilege(
+          new KibanaPrivilege('test', ['action:foo', 'action:bar', 'action:baz'])
+        )
+      ).toEqual(true);
+    });
+
+    it('returns false for collections which do not contain all necessary actions', () => {
+      const collection = new PrivilegeCollection([
+        new KibanaPrivilege('privilege1', ['action:foo', 'action:bar']),
+        new KibanaPrivilege('privilege1', ['action:baz']),
+      ]);
+
+      expect(
+        collection.grantsPrivilege(
+          new KibanaPrivilege('test', ['action:foo', 'action:bar', 'action:baz', 'actions:secret'])
+        )
+      ).toEqual(false);
+    });
+
+    it('returns false for collections which contain no privileges', () => {
+      const collection = new PrivilegeCollection([]);
+
+      expect(collection.grantsPrivilege(new KibanaPrivilege('test', ['action:foo']))).toEqual(
+        false
+      );
+    });
+
+    it('returns false for collections which contain no privileges, even if the requested privilege has no actions', () => {
+      const collection = new PrivilegeCollection([]);
+
+      expect(collection.grantsPrivilege(new KibanaPrivilege('test', []))).toEqual(false);
+    });
+  });
+});
diff --git a/x-pack/plugins/security/public/management/roles/model/privilege_collection.ts b/x-pack/plugins/security/public/management/roles/model/privilege_collection.ts
new file mode 100644
index 0000000000000..cbbd22857666e
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/privilege_collection.ts
@@ -0,0 +1,33 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { KibanaPrivilege } from './kibana_privilege';
+
+export class PrivilegeCollection {
+  private actions: ReadonlySet<string>;
+
+  constructor(privileges: KibanaPrivilege[]) {
+    this.actions = new Set(
+      privileges.reduce((acc, priv) => [...acc, ...priv.actions], [] as string[])
+    );
+  }
+
+  public grantsPrivilege(privilege: KibanaPrivilege) {
+    return this.checkActions(this.actions, privilege.actions).hasAllRequested;
+  }
+
+  private checkActions(knownActions: ReadonlySet<string>, candidateActions: string[]) {
+    const missing = candidateActions.filter(action => !knownActions.has(action));
+
+    const hasAllRequested =
+      knownActions.size > 0 && candidateActions.length > 0 && missing.length === 0;
+
+    return {
+      missing,
+      hasAllRequested,
+    };
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/model/secured_feature.ts b/x-pack/plugins/security/public/management/roles/model/secured_feature.ts
new file mode 100644
index 0000000000000..7fc466a70b984
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/secured_feature.ts
@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Feature, FeatureConfig } from '../../../../../features/common';
+import { PrimaryFeaturePrivilege } from './primary_feature_privilege';
+import { SecuredSubFeature } from './secured_sub_feature';
+import { SubFeaturePrivilege } from './sub_feature_privilege';
+
+export class SecuredFeature extends Feature {
+  private readonly primaryFeaturePrivileges: PrimaryFeaturePrivilege[];
+
+  private readonly minimalPrimaryFeaturePrivileges: PrimaryFeaturePrivilege[];
+
+  private readonly subFeaturePrivileges: SubFeaturePrivilege[];
+
+  private readonly securedSubFeatures: SecuredSubFeature[];
+
+  constructor(config: FeatureConfig, actionMapping: { [privilegeId: string]: string[] } = {}) {
+    super(config);
+    this.primaryFeaturePrivileges = Object.entries(this.config.privileges || {}).map(
+      ([id, privilege]) => new PrimaryFeaturePrivilege(id, privilege, actionMapping[id])
+    );
+
+    if (this.config.subFeatures?.length ?? 0 > 0) {
+      this.minimalPrimaryFeaturePrivileges = Object.entries(this.config.privileges || {}).map(
+        ([id, privilege]) =>
+          new PrimaryFeaturePrivilege(`minimal_${id}`, privilege, actionMapping[`minimal_${id}`])
+      );
+    } else {
+      this.minimalPrimaryFeaturePrivileges = [];
+    }
+
+    this.securedSubFeatures =
+      this.config.subFeatures?.map(sf => new SecuredSubFeature(sf, actionMapping)) ?? [];
+
+    this.subFeaturePrivileges = this.securedSubFeatures.reduce((acc, subFeature) => {
+      return [...acc, ...subFeature.privilegeIterator()];
+    }, [] as SubFeaturePrivilege[]);
+  }
+
+  public getPrivilegesTooltip() {
+    return this.config.privilegesTooltip;
+  }
+
+  public getAllPrivileges() {
+    return [
+      ...this.primaryFeaturePrivileges,
+      ...this.minimalPrimaryFeaturePrivileges,
+      ...this.subFeaturePrivileges,
+    ];
+  }
+
+  public getPrimaryFeaturePrivileges(
+    { includeMinimalFeaturePrivileges }: { includeMinimalFeaturePrivileges: boolean } = {
+      includeMinimalFeaturePrivileges: false,
+    }
+  ) {
+    return includeMinimalFeaturePrivileges
+      ? [this.primaryFeaturePrivileges, this.minimalPrimaryFeaturePrivileges].flat()
+      : [...this.primaryFeaturePrivileges];
+  }
+
+  public getMinimalFeaturePrivileges() {
+    return [...this.minimalPrimaryFeaturePrivileges];
+  }
+
+  public getSubFeaturePrivileges() {
+    return [...this.subFeaturePrivileges];
+  }
+
+  public getSubFeatures() {
+    return [...this.securedSubFeatures];
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/model/secured_sub_feature.ts b/x-pack/plugins/security/public/management/roles/model/secured_sub_feature.ts
new file mode 100644
index 0000000000000..3d69e5e709bb0
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/secured_sub_feature.ts
@@ -0,0 +1,41 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SubFeature, SubFeatureConfig } from '../../../../../features/common';
+import { SubFeaturePrivilege } from './sub_feature_privilege';
+import { SubFeaturePrivilegeGroup } from './sub_feature_privilege_group';
+
+export class SecuredSubFeature extends SubFeature {
+  public readonly privileges: SubFeaturePrivilege[];
+
+  constructor(
+    config: SubFeatureConfig,
+    private readonly actionMapping: { [privilegeId: string]: string[] } = {}
+  ) {
+    super(config);
+
+    this.privileges = [];
+    for (const privilege of this.privilegeIterator()) {
+      this.privileges.push(privilege);
+    }
+  }
+
+  public getPrivilegeGroups() {
+    return this.privilegeGroups.map(pg => new SubFeaturePrivilegeGroup(pg, this.actionMapping));
+  }
+
+  public *privilegeIterator({
+    predicate = () => true,
+  }: {
+    predicate?: (privilege: SubFeaturePrivilege, feature: SecuredSubFeature) => boolean;
+  } = {}): IterableIterator<SubFeaturePrivilege> {
+    for (const group of this.privilegeGroups) {
+      yield* group.privileges
+        .map(gp => new SubFeaturePrivilege(gp, this.actionMapping[gp.id]))
+        .filter(privilege => predicate(privilege, this));
+    }
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/model/sub_feature_privilege.ts b/x-pack/plugins/security/public/management/roles/model/sub_feature_privilege.ts
new file mode 100644
index 0000000000000..e149a59e12edf
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/sub_feature_privilege.ts
@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SubFeaturePrivilegeConfig } from '../../../../../features/public';
+import { KibanaPrivilege } from './kibana_privilege';
+
+export class SubFeaturePrivilege extends KibanaPrivilege {
+  constructor(
+    protected readonly subPrivilegeConfig: SubFeaturePrivilegeConfig,
+    public readonly actions: string[] = []
+  ) {
+    super(subPrivilegeConfig.id, actions);
+  }
+
+  public get name() {
+    return this.subPrivilegeConfig.name;
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/model/sub_feature_privilege_group.ts b/x-pack/plugins/security/public/management/roles/model/sub_feature_privilege_group.ts
new file mode 100644
index 0000000000000..b437649236e27
--- /dev/null
+++ b/x-pack/plugins/security/public/management/roles/model/sub_feature_privilege_group.ts
@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SubFeaturePrivilegeGroupConfig } from '../../../../../features/common';
+import { SubFeaturePrivilege } from './sub_feature_privilege';
+
+export class SubFeaturePrivilegeGroup {
+  constructor(
+    private readonly config: SubFeaturePrivilegeGroupConfig,
+    private readonly actionMapping: { [privilegeId: string]: string[] } = {}
+  ) {}
+
+  public get groupType() {
+    return this.config.groupType;
+  }
+
+  public get privileges() {
+    return this.config.privileges.map(
+      p => new SubFeaturePrivilege(p, this.actionMapping[p.id] || [])
+    );
+  }
+}
diff --git a/x-pack/plugins/security/public/management/roles/roles_management_app.test.tsx b/x-pack/plugins/security/public/management/roles/roles_management_app.test.tsx
index 5936409eb6e8b..96051dbd7fa56 100644
--- a/x-pack/plugins/security/public/management/roles/roles_management_app.test.tsx
+++ b/x-pack/plugins/security/public/management/roles/roles_management_app.test.tsx
@@ -17,17 +17,22 @@ jest.mock('./edit_role', () => ({
 import { rolesManagementApp } from './roles_management_app';
 
 import { coreMock } from '../../../../../../src/core/public/mocks';
+import { featuresPluginMock } from '../../../../features/public/mocks';
 
 async function mountApp(basePath: string) {
   const { fatalErrors } = coreMock.createSetup();
   const container = document.createElement('div');
   const setBreadcrumbs = jest.fn();
 
+  const featuresStart = featuresPluginMock.createStart();
+
   const unmount = await rolesManagementApp
     .create({
       license: licenseMock.create(),
       fatalErrors,
-      getStartServices: jest.fn().mockResolvedValue([coreMock.createStart(), { data: {} }]),
+      getStartServices: jest
+        .fn()
+        .mockResolvedValue([coreMock.createStart(), { data: {}, features: featuresStart }]),
     })
     .mount({ basePath, element: container, setBreadcrumbs });
 
diff --git a/x-pack/plugins/security/public/management/roles/roles_management_app.tsx b/x-pack/plugins/security/public/management/roles/roles_management_app.tsx
index 4e8c95b61c2f1..e1a10fdc2b8c3 100644
--- a/x-pack/plugins/security/public/management/roles/roles_management_app.tsx
+++ b/x-pack/plugins/security/public/management/roles/roles_management_app.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { HashRouter as Router, Route, Switch, useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
-import { CoreSetup, FatalErrorsSetup } from 'src/core/public';
+import { StartServicesAccessor, FatalErrorsSetup } from 'src/core/public';
 import { RegisterManagementAppArgs } from '../../../../../../src/plugins/management/public';
 import { SecurityLicense } from '../../../common/licensing';
 import { PluginStartDependencies } from '../../plugin';
@@ -23,7 +23,7 @@ import { PrivilegesAPIClient } from './privileges_api_client';
 interface CreateParams {
   fatalErrors: FatalErrorsSetup;
   license: SecurityLicense;
-  getStartServices: CoreSetup<PluginStartDependencies>['getStartServices'];
+  getStartServices: StartServicesAccessor<PluginStartDependencies>;
 }
 
 export const rolesManagementApp = Object.freeze({
@@ -36,7 +36,7 @@ export const rolesManagementApp = Object.freeze({
       async mount({ basePath, element, setBreadcrumbs }) {
         const [
           { application, docLinks, http, i18n: i18nStart, injectedMetadata, notifications },
-          { data },
+          { data, features },
         ] = await getStartServices();
 
         const rolesBreadcrumbs = [
@@ -77,6 +77,7 @@ export const rolesManagementApp = Object.freeze({
               userAPIClient={new UserAPIClient(http)}
               indicesAPIClient={new IndicesAPIClient(http)}
               privilegesAPIClient={new PrivilegesAPIClient(http)}
+              getFeatures={features.getFeatures}
               http={http}
               notifications={notifications}
               fatalErrors={fatalErrors}
diff --git a/x-pack/plugins/security/public/management/users/users_management_app.tsx b/x-pack/plugins/security/public/management/users/users_management_app.tsx
index 7874b810676b5..82a2b8d2a98ad 100644
--- a/x-pack/plugins/security/public/management/users/users_management_app.tsx
+++ b/x-pack/plugins/security/public/management/users/users_management_app.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { HashRouter as Router, Route, Switch, useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
-import { CoreSetup } from 'src/core/public';
+import { StartServicesAccessor } from 'src/core/public';
 import { RegisterManagementAppArgs } from '../../../../../../src/plugins/management/public';
 import { AuthenticationServiceSetup } from '../../authentication';
 import { PluginStartDependencies } from '../../plugin';
@@ -19,7 +19,7 @@ import { EditUserPage } from './edit_user';
 
 interface CreateParams {
   authc: AuthenticationServiceSetup;
-  getStartServices: CoreSetup<PluginStartDependencies>['getStartServices'];
+  getStartServices: StartServicesAccessor<PluginStartDependencies>;
 }
 
 export const usersManagementApp = Object.freeze({
diff --git a/x-pack/plugins/security/public/plugin.test.tsx b/x-pack/plugins/security/public/plugin.test.tsx
index 3d0ef3b2cabc7..122b26378d22b 100644
--- a/x-pack/plugins/security/public/plugin.test.tsx
+++ b/x-pack/plugins/security/public/plugin.test.tsx
@@ -15,6 +15,7 @@ import { coreMock } from '../../../../src/core/public/mocks';
 import { managementPluginMock } from '../../../../src/plugins/management/public/mocks';
 import { licensingMock } from '../../licensing/public/mocks';
 import { ManagementService } from './management';
+import { FeaturesPluginStart } from '../../features/public';
 
 describe('Security Plugin', () => {
   beforeAll(() => {
@@ -86,6 +87,7 @@ describe('Security Plugin', () => {
       expect(
         plugin.start(coreMock.createStart({ basePath: '/some-base-path' }), {
           data: {} as DataPublicPluginStart,
+          features: {} as FeaturesPluginStart,
         })
       ).toBeUndefined();
     });
@@ -110,6 +112,7 @@ describe('Security Plugin', () => {
 
       plugin.start(coreMock.createStart({ basePath: '/some-base-path' }), {
         data: {} as DataPublicPluginStart,
+        features: {} as FeaturesPluginStart,
         management: managementStartMock,
       });
 
@@ -139,6 +142,7 @@ describe('Security Plugin', () => {
 
       plugin.start(coreMock.createStart({ basePath: '/some-base-path' }), {
         data: {} as DataPublicPluginStart,
+        features: {} as FeaturesPluginStart,
       });
 
       expect(() => plugin.stop()).not.toThrow();
diff --git a/x-pack/plugins/security/public/plugin.tsx b/x-pack/plugins/security/public/plugin.tsx
index dcd90b1738f10..38ef552e75a9e 100644
--- a/x-pack/plugins/security/public/plugin.tsx
+++ b/x-pack/plugins/security/public/plugin.tsx
@@ -11,6 +11,7 @@ import {
   Plugin,
   PluginInitializerContext,
 } from '../../../../src/core/public';
+import { FeaturesPluginStart } from '../../features/public';
 import { DataPublicPluginStart } from '../../../../src/plugins/data/public';
 import {
   FeatureCatalogueCategory,
@@ -40,6 +41,7 @@ export interface PluginSetupDependencies {
 
 export interface PluginStartDependencies {
   data: DataPublicPluginStart;
+  features: FeaturesPluginStart;
   management?: ManagementStart;
 }
 
diff --git a/x-pack/plugins/security/server/authentication/api_keys.test.ts b/x-pack/plugins/security/server/authentication/api_keys.test.ts
index bcb212e7bbf94..836740d0a547f 100644
--- a/x-pack/plugins/security/server/authentication/api_keys.test.ts
+++ b/x-pack/plugins/security/server/authentication/api_keys.test.ts
@@ -15,6 +15,8 @@ import {
 } from '../../../../../src/core/server/mocks';
 import { licenseMock } from '../../common/licensing/index.mock';
 
+const encodeToBase64 = (str: string) => Buffer.from(str).toString('base64');
+
 describe('API Keys', () => {
   let apiKeys: APIKeys;
   let mockClusterClient: jest.Mocked<IClusterClient>;
@@ -81,6 +83,87 @@ describe('API Keys', () => {
     });
   });
 
+  describe('grantAsInternalUser()', () => {
+    it('returns null when security feature is disabled', async () => {
+      mockLicense.isEnabled.mockReturnValue(false);
+      const result = await apiKeys.grantAsInternalUser(httpServerMock.createKibanaRequest());
+      expect(result).toBeNull();
+
+      expect(mockClusterClient.callAsInternalUser).not.toHaveBeenCalled();
+    });
+
+    it('calls callAsInternalUser with proper parameters for the Basic scheme', async () => {
+      mockLicense.isEnabled.mockReturnValue(true);
+      mockClusterClient.callAsInternalUser.mockResolvedValueOnce({
+        id: '123',
+        name: 'key-name',
+        api_key: 'abc123',
+      });
+      const result = await apiKeys.grantAsInternalUser(
+        httpServerMock.createKibanaRequest({
+          headers: {
+            authorization: `Basic ${encodeToBase64('foo:bar')}`,
+          },
+        })
+      );
+      expect(result).toEqual({
+        api_key: 'abc123',
+        id: '123',
+        name: 'key-name',
+      });
+      expect(mockClusterClient.callAsInternalUser).toHaveBeenCalledWith('shield.grantAPIKey', {
+        body: {
+          grant_type: 'password',
+          username: 'foo',
+          password: 'bar',
+        },
+      });
+    });
+
+    it('calls callAsInternalUser with proper parameters for the Bearer scheme', async () => {
+      mockLicense.isEnabled.mockReturnValue(true);
+      mockClusterClient.callAsInternalUser.mockResolvedValueOnce({
+        id: '123',
+        name: 'key-name',
+        api_key: 'abc123',
+      });
+      const result = await apiKeys.grantAsInternalUser(
+        httpServerMock.createKibanaRequest({
+          headers: {
+            authorization: `Bearer foo-access-token`,
+          },
+        })
+      );
+      expect(result).toEqual({
+        api_key: 'abc123',
+        id: '123',
+        name: 'key-name',
+      });
+      expect(mockClusterClient.callAsInternalUser).toHaveBeenCalledWith('shield.grantAPIKey', {
+        body: {
+          grant_type: 'access_token',
+          access_token: 'foo-access-token',
+        },
+      });
+    });
+
+    it('throw error for other schemes', async () => {
+      mockLicense.isEnabled.mockReturnValue(true);
+      await expect(
+        apiKeys.grantAsInternalUser(
+          httpServerMock.createKibanaRequest({
+            headers: {
+              authorization: `Digest username="foo"`,
+            },
+          })
+        )
+      ).rejects.toThrowErrorMatchingInlineSnapshot(
+        `"Unsupported scheme \\"Digest\\" for granting API Key"`
+      );
+      expect(mockClusterClient.callAsInternalUser).not.toHaveBeenCalled();
+    });
+  });
+
   describe('invalidate()', () => {
     it('returns null when security feature is disabled', async () => {
       mockLicense.isEnabled.mockReturnValue(false);
@@ -142,4 +225,56 @@ describe('API Keys', () => {
       );
     });
   });
+
+  describe('invalidateAsInternalUser()', () => {
+    it('returns null when security feature is disabled', async () => {
+      mockLicense.isEnabled.mockReturnValue(false);
+      const result = await apiKeys.invalidateAsInternalUser({ id: '123' });
+      expect(result).toBeNull();
+      expect(mockClusterClient.callAsInternalUser).not.toHaveBeenCalled();
+    });
+
+    it('calls callCluster with proper parameters', async () => {
+      mockLicense.isEnabled.mockReturnValue(true);
+      mockClusterClient.callAsInternalUser.mockResolvedValueOnce({
+        invalidated_api_keys: ['api-key-id-1'],
+        previously_invalidated_api_keys: [],
+        error_count: 0,
+      });
+      const result = await apiKeys.invalidateAsInternalUser({ id: '123' });
+      expect(result).toEqual({
+        invalidated_api_keys: ['api-key-id-1'],
+        previously_invalidated_api_keys: [],
+        error_count: 0,
+      });
+      expect(mockClusterClient.callAsInternalUser).toHaveBeenCalledWith('shield.invalidateAPIKey', {
+        body: {
+          id: '123',
+        },
+      });
+    });
+
+    it('Only passes id as a parameter', async () => {
+      mockLicense.isEnabled.mockReturnValue(true);
+      mockClusterClient.callAsInternalUser.mockResolvedValueOnce({
+        invalidated_api_keys: ['api-key-id-1'],
+        previously_invalidated_api_keys: [],
+        error_count: 0,
+      });
+      const result = await apiKeys.invalidateAsInternalUser({
+        id: '123',
+        name: 'abc',
+      } as any);
+      expect(result).toEqual({
+        invalidated_api_keys: ['api-key-id-1'],
+        previously_invalidated_api_keys: [],
+        error_count: 0,
+      });
+      expect(mockClusterClient.callAsInternalUser).toHaveBeenCalledWith('shield.invalidateAPIKey', {
+        body: {
+          id: '123',
+        },
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security/server/authentication/api_keys.ts b/x-pack/plugins/security/server/authentication/api_keys.ts
index 2b1a93d907471..9df7219cec334 100644
--- a/x-pack/plugins/security/server/authentication/api_keys.ts
+++ b/x-pack/plugins/security/server/authentication/api_keys.ts
@@ -6,6 +6,8 @@
 
 import { IClusterClient, KibanaRequest, Logger } from '../../../../../src/core/server';
 import { SecurityLicense } from '../../common/licensing';
+import { HTTPAuthorizationHeader } from './http_authentication';
+import { BasicHTTPAuthorizationHeaderCredentials } from './http_authentication';
 
 /**
  * Represents the options to create an APIKey class instance that will be
@@ -26,6 +28,13 @@ export interface CreateAPIKeyParams {
   expiration?: string;
 }
 
+interface GrantAPIKeyParams {
+  grant_type: 'password' | 'access_token';
+  username?: string;
+  password?: string;
+  access_token?: string;
+}
+
 /**
  * Represents the params for invalidating an API key
  */
@@ -58,6 +67,21 @@ export interface CreateAPIKeyResult {
   api_key: string;
 }
 
+export interface GrantAPIKeyResult {
+  /**
+   * Unique id for this API key
+   */
+  id: string;
+  /**
+   * Name for this API key
+   */
+  name: string;
+  /**
+   * Generated API key
+   */
+  api_key: string;
+}
+
 /**
  * The return value when invalidating an API key in Elasticsearch.
  */
@@ -131,31 +155,89 @@ export class APIKeys {
     return result;
   }
 
+  /**
+   * Tries to grant an API key for the current user.
+   * @param request Request instance.
+   */
+  async grantAsInternalUser(request: KibanaRequest) {
+    if (!this.license.isEnabled()) {
+      return null;
+    }
+
+    this.logger.debug('Trying to grant an API key');
+    const authorizationHeader = HTTPAuthorizationHeader.parseFromRequest(request);
+    if (authorizationHeader == null) {
+      throw new Error(
+        `Unable to grant an API Key, request does not contain an authorization header`
+      );
+    }
+    const params = this.getGrantParams(authorizationHeader);
+
+    // User needs `manage_api_key` or `grant_api_key` privilege to use this API
+    let result: GrantAPIKeyResult;
+    try {
+      result = (await this.clusterClient.callAsInternalUser('shield.grantAPIKey', {
+        body: params,
+      })) as GrantAPIKeyResult;
+      this.logger.debug('API key was granted successfully');
+    } catch (e) {
+      this.logger.error(`Failed to grant API key: ${e.message}`);
+      throw e;
+    }
+
+    return result;
+  }
+
   /**
    * Tries to invalidate an API key.
    * @param request Request instance.
    * @param params The params to invalidate an API key.
    */
-  async invalidate(
-    request: KibanaRequest,
-    params: InvalidateAPIKeyParams
-  ): Promise<InvalidateAPIKeyResult | null> {
+  async invalidate(request: KibanaRequest, params: InvalidateAPIKeyParams) {
     if (!this.license.isEnabled()) {
       return null;
     }
 
-    this.logger.debug('Trying to invalidate an API key');
+    this.logger.debug('Trying to invalidate an API key as current user');
 
-    // User needs `manage_api_key` privilege to use this API
     let result: InvalidateAPIKeyResult;
     try {
-      result = (await this.clusterClient
+      // User needs `manage_api_key` privilege to use this API
+      result = await this.clusterClient
         .asScoped(request)
         .callAsCurrentUser('shield.invalidateAPIKey', {
           body: {
             id: params.id,
           },
-        })) as InvalidateAPIKeyResult;
+        });
+      this.logger.debug('API key was invalidated successfully as current user');
+    } catch (e) {
+      this.logger.error(`Failed to invalidate API key as current user: ${e.message}`);
+      throw e;
+    }
+
+    return result;
+  }
+
+  /**
+   * Tries to invalidate an API key by using the internal user.
+   * @param params The params to invalidate an API key.
+   */
+  async invalidateAsInternalUser(params: InvalidateAPIKeyParams) {
+    if (!this.license.isEnabled()) {
+      return null;
+    }
+
+    this.logger.debug('Trying to invalidate an API key');
+
+    let result: InvalidateAPIKeyResult;
+    try {
+      // Internal user needs `cluster:admin/xpack/security/api_key/invalidate` privilege to use this API
+      result = await this.clusterClient.callAsInternalUser('shield.invalidateAPIKey', {
+        body: {
+          id: params.id,
+        },
+      });
       this.logger.debug('API key was invalidated successfully');
     } catch (e) {
       this.logger.error(`Failed to invalidate API key: ${e.message}`);
@@ -164,4 +246,26 @@ export class APIKeys {
 
     return result;
   }
+
+  private getGrantParams(authorizationHeader: HTTPAuthorizationHeader): GrantAPIKeyParams {
+    if (authorizationHeader.scheme.toLowerCase() === 'bearer') {
+      return {
+        grant_type: 'access_token',
+        access_token: authorizationHeader.credentials,
+      };
+    }
+
+    if (authorizationHeader.scheme.toLowerCase() === 'basic') {
+      const basicCredentials = BasicHTTPAuthorizationHeaderCredentials.parseFromCredentials(
+        authorizationHeader.credentials
+      );
+      return {
+        grant_type: 'password',
+        username: basicCredentials.username,
+        password: basicCredentials.password,
+      };
+    }
+
+    throw new Error(`Unsupported scheme "${authorizationHeader.scheme}" for granting API Key`);
+  }
 }
diff --git a/x-pack/plugins/security/server/authentication/authenticator.test.ts b/x-pack/plugins/security/server/authentication/authenticator.test.ts
index 36cc5b12268d7..b93cfaa33783e 100644
--- a/x-pack/plugins/security/server/authentication/authenticator.test.ts
+++ b/x-pack/plugins/security/server/authentication/authenticator.test.ts
@@ -5,6 +5,7 @@
  */
 
 jest.mock('./providers/basic');
+jest.mock('./providers/token');
 jest.mock('./providers/saml');
 jest.mock('./providers/http');
 
@@ -20,34 +21,33 @@ import {
   sessionStorageMock,
 } from '../../../../../src/core/server/mocks';
 import { mockAuthenticatedUser } from '../../common/model/authenticated_user.mock';
+import { ConfigSchema, createConfig } from '../config';
 import { AuthenticationResult } from './authentication_result';
 import { Authenticator, AuthenticatorOptions, ProviderSession } from './authenticator';
 import { DeauthenticationResult } from './deauthentication_result';
-import { BasicAuthenticationProvider } from './providers';
+import { BasicAuthenticationProvider, SAMLAuthenticationProvider } from './providers';
 
 function getMockOptions({
   session,
   providers,
   http = {},
+  selector,
 }: {
   session?: AuthenticatorOptions['config']['session'];
-  providers?: string[];
+  providers?: Record<string, unknown> | string[];
   http?: Partial<AuthenticatorOptions['config']['authc']['http']>;
+  selector?: AuthenticatorOptions['config']['authc']['selector'];
 } = {}) {
   return {
     clusterClient: elasticsearchServiceMock.createClusterClient(),
     basePath: httpServiceMock.createSetupContract().basePath,
     loggers: loggingServiceMock.create(),
     getServerBaseURL: jest.fn(),
-    config: {
-      session: { idleTimeout: null, lifespan: null, ...(session || {}) },
-      authc: {
-        providers: providers || [],
-        oidc: {},
-        saml: {},
-        http: { enabled: true, autoSchemesEnabled: true, schemes: ['apikey'], ...http },
-      },
-    },
+    config: createConfig(
+      ConfigSchema.validate({ session, authc: { selector, providers, http } }),
+      loggingServiceMock.create().get(),
+      { isTLSEnabled: false }
+    ),
     sessionStorageFactory: sessionStorageMock.createFactory<ProviderSession>(),
   };
 }
@@ -57,26 +57,36 @@ describe('Authenticator', () => {
   beforeEach(() => {
     mockBasicAuthenticationProvider = {
       login: jest.fn(),
-      authenticate: jest.fn(),
-      logout: jest.fn(),
+      authenticate: jest.fn().mockResolvedValue(AuthenticationResult.notHandled()),
+      logout: jest.fn().mockResolvedValue(DeauthenticationResult.notHandled()),
       getHTTPAuthenticationScheme: jest.fn(),
     };
 
     jest.requireMock('./providers/http').HTTPAuthenticationProvider.mockImplementation(() => ({
+      type: 'http',
       authenticate: jest.fn().mockResolvedValue(AuthenticationResult.notHandled()),
+      logout: jest.fn().mockResolvedValue(DeauthenticationResult.notHandled()),
+    }));
+
+    jest.requireMock('./providers/basic').BasicAuthenticationProvider.mockImplementation(() => ({
+      type: 'basic',
+      ...mockBasicAuthenticationProvider,
     }));
 
-    jest
-      .requireMock('./providers/basic')
-      .BasicAuthenticationProvider.mockImplementation(() => mockBasicAuthenticationProvider);
+    jest.requireMock('./providers/saml').SAMLAuthenticationProvider.mockImplementation(() => ({
+      type: 'saml',
+      getHTTPAuthenticationScheme: jest.fn(),
+    }));
   });
 
   afterEach(() => jest.clearAllMocks());
 
   describe('initialization', () => {
     it('fails if authentication providers are not configured.', () => {
-      expect(() => new Authenticator(getMockOptions())).toThrowError(
-        'No authentication provider is configured. Verify `xpack.security.authc.providers` config value.'
+      expect(
+        () => new Authenticator(getMockOptions({ providers: {}, http: { enabled: false } }))
+      ).toThrowError(
+        'No authentication provider is configured. Verify `xpack.security.authc.*` config value.'
       );
     });
 
@@ -86,11 +96,19 @@ describe('Authenticator', () => {
       );
     });
 
+    it('fails if any of the user specified provider uses reserved __http__ name.', () => {
+      expect(
+        () =>
+          new Authenticator(getMockOptions({ providers: { basic: { __http__: { order: 0 } } } }))
+      ).toThrowError('Provider name "__http__" is reserved.');
+    });
+
     describe('HTTP authentication provider', () => {
       beforeEach(() => {
         jest
           .requireMock('./providers/basic')
           .BasicAuthenticationProvider.mockImplementation(() => ({
+            type: 'basic',
             getHTTPAuthenticationScheme: jest.fn().mockReturnValue('basic'),
           }));
       });
@@ -98,9 +116,9 @@ describe('Authenticator', () => {
       afterEach(() => jest.resetAllMocks());
 
       it('enabled by default', () => {
-        const authenticator = new Authenticator(getMockOptions({ providers: ['basic'] }));
-        expect(authenticator.isProviderEnabled('basic')).toBe(true);
-        expect(authenticator.isProviderEnabled('http')).toBe(true);
+        const authenticator = new Authenticator(getMockOptions());
+        expect(authenticator.isProviderTypeEnabled('basic')).toBe(true);
+        expect(authenticator.isProviderTypeEnabled('http')).toBe(true);
 
         expect(
           jest.requireMock('./providers/http').HTTPAuthenticationProvider
@@ -111,11 +129,13 @@ describe('Authenticator', () => {
 
       it('includes all required schemes if `autoSchemesEnabled` is enabled', () => {
         const authenticator = new Authenticator(
-          getMockOptions({ providers: ['basic', 'kerberos'] })
+          getMockOptions({
+            providers: { basic: { basic1: { order: 0 } }, kerberos: { kerberos1: { order: 1 } } },
+          })
         );
-        expect(authenticator.isProviderEnabled('basic')).toBe(true);
-        expect(authenticator.isProviderEnabled('kerberos')).toBe(true);
-        expect(authenticator.isProviderEnabled('http')).toBe(true);
+        expect(authenticator.isProviderTypeEnabled('basic')).toBe(true);
+        expect(authenticator.isProviderTypeEnabled('kerberos')).toBe(true);
+        expect(authenticator.isProviderTypeEnabled('http')).toBe(true);
 
         expect(
           jest.requireMock('./providers/http').HTTPAuthenticationProvider
@@ -126,11 +146,14 @@ describe('Authenticator', () => {
 
       it('does not include additional schemes if `autoSchemesEnabled` is disabled', () => {
         const authenticator = new Authenticator(
-          getMockOptions({ providers: ['basic', 'kerberos'], http: { autoSchemesEnabled: false } })
+          getMockOptions({
+            providers: { basic: { basic1: { order: 0 } }, kerberos: { kerberos1: { order: 1 } } },
+            http: { autoSchemesEnabled: false },
+          })
         );
-        expect(authenticator.isProviderEnabled('basic')).toBe(true);
-        expect(authenticator.isProviderEnabled('kerberos')).toBe(true);
-        expect(authenticator.isProviderEnabled('http')).toBe(true);
+        expect(authenticator.isProviderTypeEnabled('basic')).toBe(true);
+        expect(authenticator.isProviderTypeEnabled('kerberos')).toBe(true);
+        expect(authenticator.isProviderTypeEnabled('http')).toBe(true);
 
         expect(
           jest.requireMock('./providers/http').HTTPAuthenticationProvider
@@ -139,10 +162,13 @@ describe('Authenticator', () => {
 
       it('disabled if explicitly disabled', () => {
         const authenticator = new Authenticator(
-          getMockOptions({ providers: ['basic'], http: { enabled: false } })
+          getMockOptions({
+            providers: { basic: { basic1: { order: 0 } } },
+            http: { enabled: false },
+          })
         );
-        expect(authenticator.isProviderEnabled('basic')).toBe(true);
-        expect(authenticator.isProviderEnabled('http')).toBe(false);
+        expect(authenticator.isProviderTypeEnabled('basic')).toBe(true);
+        expect(authenticator.isProviderTypeEnabled('http')).toBe(false);
 
         expect(
           jest.requireMock('./providers/http').HTTPAuthenticationProvider
@@ -157,14 +183,15 @@ describe('Authenticator', () => {
     let mockSessionStorage: jest.Mocked<SessionStorage<ProviderSession>>;
     let mockSessVal: any;
     beforeEach(() => {
-      mockOptions = getMockOptions({ providers: ['basic'] });
+      mockOptions = getMockOptions({ providers: { basic: { basic1: { order: 0 } } } });
       mockSessionStorage = sessionStorageMock.create();
+      mockSessionStorage.get.mockResolvedValue(null);
       mockOptions.sessionStorageFactory.asScoped.mockReturnValue(mockSessionStorage);
       mockSessVal = {
         idleTimeoutExpiration: null,
         lifespanExpiration: null,
         state: { authorization: 'Basic xxx' },
-        provider: 'basic',
+        provider: { type: 'basic', name: 'basic1' },
         path: mockOptions.basePath.serverBasePath,
       };
 
@@ -177,17 +204,26 @@ describe('Authenticator', () => {
       );
     });
 
-    it('fails if login attempt is not provided.', async () => {
+    it('fails if login attempt is not provided or invalid.', async () => {
       await expect(
         authenticator.login(httpServerMock.createKibanaRequest(), undefined as any)
       ).rejects.toThrowError(
-        'Login attempt should be an object with non-empty "provider" property.'
+        'Login attempt should be an object with non-empty "provider.type" or "provider.name" property.'
       );
 
       await expect(
         authenticator.login(httpServerMock.createKibanaRequest(), {} as any)
       ).rejects.toThrowError(
-        'Login attempt should be an object with non-empty "provider" property.'
+        'Login attempt should be an object with non-empty "provider.type" or "provider.name" property.'
+      );
+
+      await expect(
+        authenticator.login(httpServerMock.createKibanaRequest(), {
+          provider: 'basic',
+          value: {},
+        } as any)
+      ).rejects.toThrowError(
+        'Login attempt should be an object with non-empty "provider.type" or "provider.name" property.'
       );
     });
 
@@ -199,9 +235,9 @@ describe('Authenticator', () => {
         AuthenticationResult.failed(failureReason)
       );
 
-      await expect(authenticator.login(request, { provider: 'basic', value: {} })).resolves.toEqual(
-        AuthenticationResult.failed(failureReason)
-      );
+      await expect(
+        authenticator.login(request, { provider: { type: 'basic' }, value: {} })
+      ).resolves.toEqual(AuthenticationResult.failed(failureReason));
     });
 
     it('returns user that authentication provider returns.', async () => {
@@ -212,7 +248,9 @@ describe('Authenticator', () => {
         AuthenticationResult.succeeded(user, { authHeaders: { authorization: 'Basic .....' } })
       );
 
-      await expect(authenticator.login(request, { provider: 'basic', value: {} })).resolves.toEqual(
+      await expect(
+        authenticator.login(request, { provider: { type: 'basic' }, value: {} })
+      ).resolves.toEqual(
         AuthenticationResult.succeeded(user, { authHeaders: { authorization: 'Basic .....' } })
       );
     });
@@ -226,9 +264,9 @@ describe('Authenticator', () => {
         AuthenticationResult.succeeded(user, { state: { authorization } })
       );
 
-      await expect(authenticator.login(request, { provider: 'basic', value: {} })).resolves.toEqual(
-        AuthenticationResult.succeeded(user, { state: { authorization } })
-      );
+      await expect(
+        authenticator.login(request, { provider: { type: 'basic' }, value: {} })
+      ).resolves.toEqual(AuthenticationResult.succeeded(user, { state: { authorization } }));
 
       expect(mockSessionStorage.set).toHaveBeenCalledTimes(1);
       expect(mockSessionStorage.set).toHaveBeenCalledWith({
@@ -239,9 +277,171 @@ describe('Authenticator', () => {
 
     it('returns `notHandled` if login attempt is targeted to not configured provider.', async () => {
       const request = httpServerMock.createKibanaRequest();
-      await expect(authenticator.login(request, { provider: 'token', value: {} })).resolves.toEqual(
-        AuthenticationResult.notHandled()
-      );
+      await expect(
+        authenticator.login(request, { provider: { type: 'token' }, value: {} })
+      ).resolves.toEqual(AuthenticationResult.notHandled());
+
+      await expect(
+        authenticator.login(request, { provider: { name: 'basic2' }, value: {} })
+      ).resolves.toEqual(AuthenticationResult.notHandled());
+    });
+
+    describe('multi-provider scenarios', () => {
+      let mockSAMLAuthenticationProvider1: jest.Mocked<PublicMethodsOf<SAMLAuthenticationProvider>>;
+      let mockSAMLAuthenticationProvider2: jest.Mocked<PublicMethodsOf<SAMLAuthenticationProvider>>;
+
+      beforeEach(() => {
+        mockSAMLAuthenticationProvider1 = {
+          login: jest.fn().mockResolvedValue(AuthenticationResult.notHandled()),
+          authenticate: jest.fn(),
+          logout: jest.fn(),
+          getHTTPAuthenticationScheme: jest.fn(),
+        };
+
+        mockSAMLAuthenticationProvider2 = {
+          login: jest.fn().mockResolvedValue(AuthenticationResult.notHandled()),
+          authenticate: jest.fn(),
+          logout: jest.fn(),
+          getHTTPAuthenticationScheme: jest.fn(),
+        };
+
+        jest
+          .requireMock('./providers/saml')
+          .SAMLAuthenticationProvider.mockImplementationOnce(() => ({
+            type: 'saml',
+            ...mockSAMLAuthenticationProvider1,
+          }))
+          .mockImplementationOnce(() => ({
+            type: 'saml',
+            ...mockSAMLAuthenticationProvider2,
+          }));
+
+        mockOptions = getMockOptions({
+          providers: {
+            basic: { basic1: { order: 0 } },
+            saml: {
+              saml1: { realm: 'saml1-realm', order: 1 },
+              saml2: { realm: 'saml2-realm', order: 2 },
+            },
+          },
+        });
+        mockSessionStorage = sessionStorageMock.create();
+        mockSessionStorage.get.mockResolvedValue(null);
+        mockOptions.sessionStorageFactory.asScoped.mockReturnValue(mockSessionStorage);
+
+        authenticator = new Authenticator(mockOptions);
+      });
+
+      it('tries to login only with the provider that has specified name', async () => {
+        const user = mockAuthenticatedUser();
+        const request = httpServerMock.createKibanaRequest();
+
+        mockSAMLAuthenticationProvider2.login.mockResolvedValue(
+          AuthenticationResult.succeeded(user, { state: { token: 'access-token' } })
+        );
+
+        await expect(
+          authenticator.login(request, { provider: { name: 'saml2' }, value: {} })
+        ).resolves.toEqual(
+          AuthenticationResult.succeeded(user, { state: { token: 'access-token' } })
+        );
+
+        expect(mockSessionStorage.set).toHaveBeenCalledTimes(1);
+        expect(mockSessionStorage.set).toHaveBeenCalledWith({
+          ...mockSessVal,
+          provider: { type: 'saml', name: 'saml2' },
+          state: { token: 'access-token' },
+        });
+
+        expect(mockBasicAuthenticationProvider.login).not.toHaveBeenCalled();
+        expect(mockSAMLAuthenticationProvider1.login).not.toHaveBeenCalled();
+      });
+
+      it('tries to login only with the provider that has specified type', async () => {
+        const request = httpServerMock.createKibanaRequest();
+
+        await expect(
+          authenticator.login(request, { provider: { type: 'saml' }, value: {} })
+        ).resolves.toEqual(AuthenticationResult.notHandled());
+
+        expect(mockSessionStorage.set).not.toHaveBeenCalled();
+
+        expect(mockBasicAuthenticationProvider.login).not.toHaveBeenCalled();
+        expect(mockSAMLAuthenticationProvider1.login).toHaveBeenCalledTimes(1);
+        expect(mockSAMLAuthenticationProvider2.login).toHaveBeenCalledTimes(1);
+        expect(mockSAMLAuthenticationProvider1.login.mock.invocationCallOrder[0]).toBeLessThan(
+          mockSAMLAuthenticationProvider2.login.mock.invocationCallOrder[0]
+        );
+      });
+
+      it('returns as soon as provider handles request', async () => {
+        const request = httpServerMock.createKibanaRequest();
+
+        const authenticationResults = [
+          AuthenticationResult.failed(new Error('Fail')),
+          AuthenticationResult.succeeded(mockAuthenticatedUser(), { state: { result: '200' } }),
+          AuthenticationResult.redirectTo('/some/url', { state: { result: '302' } }),
+        ];
+
+        for (const result of authenticationResults) {
+          mockSAMLAuthenticationProvider1.login.mockResolvedValue(result);
+
+          await expect(
+            authenticator.login(request, { provider: { type: 'saml' }, value: {} })
+          ).resolves.toEqual(result);
+        }
+
+        expect(mockSessionStorage.set).toHaveBeenCalledTimes(2);
+        expect(mockSessionStorage.set).toHaveBeenCalledWith({
+          ...mockSessVal,
+          provider: { type: 'saml', name: 'saml1' },
+          state: { result: '200' },
+        });
+        expect(mockSessionStorage.set).toHaveBeenCalledWith({
+          ...mockSessVal,
+          provider: { type: 'saml', name: 'saml1' },
+          state: { result: '302' },
+        });
+
+        expect(mockBasicAuthenticationProvider.login).not.toHaveBeenCalled();
+        expect(mockSAMLAuthenticationProvider2.login).not.toHaveBeenCalled();
+        expect(mockSAMLAuthenticationProvider1.login).toHaveBeenCalledTimes(3);
+      });
+
+      it('provides session only if provider name matches', async () => {
+        const request = httpServerMock.createKibanaRequest();
+
+        mockSessionStorage.get.mockResolvedValue({
+          ...mockSessVal,
+          provider: { type: 'saml', name: 'saml2' },
+        });
+
+        const loginAttemptValue = Symbol('attempt');
+        await expect(
+          authenticator.login(request, { provider: { type: 'saml' }, value: loginAttemptValue })
+        ).resolves.toEqual(AuthenticationResult.notHandled());
+
+        expect(mockBasicAuthenticationProvider.login).not.toHaveBeenCalled();
+
+        expect(mockSAMLAuthenticationProvider1.login).toHaveBeenCalledTimes(1);
+        expect(mockSAMLAuthenticationProvider1.login).toHaveBeenCalledWith(
+          request,
+          loginAttemptValue,
+          null
+        );
+
+        expect(mockSAMLAuthenticationProvider2.login).toHaveBeenCalledTimes(1);
+        expect(mockSAMLAuthenticationProvider2.login).toHaveBeenCalledWith(
+          request,
+          loginAttemptValue,
+          mockSessVal.state
+        );
+
+        // Presence of the session has precedence over order.
+        expect(mockSAMLAuthenticationProvider2.login.mock.invocationCallOrder[0]).toBeLessThan(
+          mockSAMLAuthenticationProvider1.login.mock.invocationCallOrder[0]
+        );
+      });
     });
 
     it('clears session if it belongs to a different provider.', async () => {
@@ -250,10 +450,13 @@ describe('Authenticator', () => {
       const request = httpServerMock.createKibanaRequest();
 
       mockBasicAuthenticationProvider.login.mockResolvedValue(AuthenticationResult.succeeded(user));
-      mockSessionStorage.get.mockResolvedValue({ ...mockSessVal, provider: 'token' });
+      mockSessionStorage.get.mockResolvedValue({
+        ...mockSessVal,
+        provider: { type: 'token', name: 'token1' },
+      });
 
       await expect(
-        authenticator.login(request, { provider: 'basic', value: credentials })
+        authenticator.login(request, { provider: { type: 'basic' }, value: credentials })
       ).resolves.toEqual(AuthenticationResult.succeeded(user));
 
       expect(mockBasicAuthenticationProvider.login).toHaveBeenCalledWith(
@@ -266,17 +469,67 @@ describe('Authenticator', () => {
       expect(mockSessionStorage.clear).toHaveBeenCalled();
     });
 
+    it('clears session if it belongs to a provider with the name that is registered but has different type.', async () => {
+      const user = mockAuthenticatedUser();
+      const credentials = { username: 'user', password: 'password' };
+      const request = httpServerMock.createKibanaRequest();
+
+      // Re-configure authenticator with `token` provider that uses the name of `basic`.
+      const loginMock = jest.fn().mockResolvedValue(AuthenticationResult.succeeded(user));
+      jest.requireMock('./providers/token').TokenAuthenticationProvider.mockImplementation(() => ({
+        type: 'token',
+        login: loginMock,
+        getHTTPAuthenticationScheme: jest.fn(),
+      }));
+      mockOptions = getMockOptions({ providers: { token: { basic1: { order: 0 } } } });
+      mockOptions.sessionStorageFactory.asScoped.mockReturnValue(mockSessionStorage);
+      authenticator = new Authenticator(mockOptions);
+
+      mockBasicAuthenticationProvider.login.mockResolvedValue(AuthenticationResult.succeeded(user));
+      mockSessionStorage.get.mockResolvedValue(mockSessVal);
+
+      await expect(
+        authenticator.login(request, { provider: { name: 'basic1' }, value: credentials })
+      ).resolves.toEqual(AuthenticationResult.succeeded(user));
+
+      expect(loginMock).toHaveBeenCalledWith(request, credentials, null);
+
+      expect(mockSessionStorage.set).not.toHaveBeenCalled();
+      expect(mockSessionStorage.clear).toHaveBeenCalled();
+    });
+
     it('clears session if provider asked to do so.', async () => {
       const user = mockAuthenticatedUser();
       const request = httpServerMock.createKibanaRequest();
+      mockSessionStorage.get.mockResolvedValue(mockSessVal);
 
       mockBasicAuthenticationProvider.login.mockResolvedValue(
         AuthenticationResult.succeeded(user, { state: null })
       );
 
-      await expect(authenticator.login(request, { provider: 'basic', value: {} })).resolves.toEqual(
-        AuthenticationResult.succeeded(user, { state: null })
-      );
+      await expect(
+        authenticator.login(request, { provider: { type: 'basic' }, value: {} })
+      ).resolves.toEqual(AuthenticationResult.succeeded(user, { state: null }));
+
+      expect(mockSessionStorage.set).not.toHaveBeenCalled();
+      expect(mockSessionStorage.clear).toHaveBeenCalled();
+    });
+
+    it('clears legacy session.', async () => {
+      const user = mockAuthenticatedUser();
+      const request = httpServerMock.createKibanaRequest();
+
+      // Use string format for the `provider` session value field to emulate legacy session.
+      mockSessionStorage.get.mockResolvedValue({ ...mockSessVal, provider: 'basic' });
+
+      mockBasicAuthenticationProvider.login.mockResolvedValue(AuthenticationResult.succeeded(user));
+
+      await expect(
+        authenticator.login(request, { provider: { type: 'basic' }, value: {} })
+      ).resolves.toEqual(AuthenticationResult.succeeded(user));
+
+      expect(mockBasicAuthenticationProvider.login).toHaveBeenCalledTimes(1);
+      expect(mockBasicAuthenticationProvider.login).toHaveBeenCalledWith(request, {}, null);
 
       expect(mockSessionStorage.set).not.toHaveBeenCalled();
       expect(mockSessionStorage.clear).toHaveBeenCalled();
@@ -289,14 +542,15 @@ describe('Authenticator', () => {
     let mockSessionStorage: jest.Mocked<SessionStorage<ProviderSession>>;
     let mockSessVal: any;
     beforeEach(() => {
-      mockOptions = getMockOptions({ providers: ['basic'] });
+      mockOptions = getMockOptions({ providers: { basic: { basic1: { order: 0 } } } });
       mockSessionStorage = sessionStorageMock.create<ProviderSession>();
+      mockSessionStorage.get.mockResolvedValue(null);
       mockOptions.sessionStorageFactory.asScoped.mockReturnValue(mockSessionStorage);
       mockSessVal = {
         idleTimeoutExpiration: null,
         lifespanExpiration: null,
         state: { authorization: 'Basic xxx' },
-        provider: 'basic',
+        provider: { type: 'basic', name: 'basic1' },
         path: mockOptions.basePath.serverBasePath,
       };
 
@@ -431,7 +685,7 @@ describe('Authenticator', () => {
           idleTimeout: duration(3600 * 24),
           lifespan: null,
         },
-        providers: ['basic'],
+        providers: { basic: { basic1: { order: 0 } } },
       });
 
       mockSessionStorage = sessionStorageMock.create();
@@ -470,7 +724,7 @@ describe('Authenticator', () => {
           idleTimeout: duration(hr * 2),
           lifespan: duration(hr * 8),
         },
-        providers: ['basic'],
+        providers: { basic: { basic1: { order: 0 } } },
       });
 
       mockSessionStorage = sessionStorageMock.create();
@@ -522,7 +776,7 @@ describe('Authenticator', () => {
             idleTimeout: null,
             lifespan,
           },
-          providers: ['basic'],
+          providers: { basic: { basic1: { order: 0 } } },
         });
 
         mockSessionStorage = sessionStorageMock.create();
@@ -704,14 +958,33 @@ describe('Authenticator', () => {
       expect(mockSessionStorage.clear).toHaveBeenCalled();
     });
 
+    it('clears legacy session.', async () => {
+      const user = mockAuthenticatedUser();
+      const request = httpServerMock.createKibanaRequest();
+
+      // Use string format for the `provider` session value field to emulate legacy session.
+      mockSessionStorage.get.mockResolvedValue({ ...mockSessVal, provider: 'basic' });
+
+      mockBasicAuthenticationProvider.authenticate.mockResolvedValue(
+        AuthenticationResult.succeeded(user)
+      );
+
+      await expect(authenticator.authenticate(request)).resolves.toEqual(
+        AuthenticationResult.succeeded(user)
+      );
+
+      expect(mockBasicAuthenticationProvider.authenticate).toHaveBeenCalledTimes(1);
+      expect(mockBasicAuthenticationProvider.authenticate).toHaveBeenCalledWith(request, null);
+
+      expect(mockSessionStorage.set).not.toHaveBeenCalled();
+      expect(mockSessionStorage.clear).toHaveBeenCalled();
+    });
+
     it('does not clear session if provider can not handle system API request authentication with active session.', async () => {
       const request = httpServerMock.createKibanaRequest({
         headers: { 'kbn-system-request': 'true' },
       });
 
-      mockBasicAuthenticationProvider.authenticate.mockResolvedValue(
-        AuthenticationResult.notHandled()
-      );
       mockSessionStorage.get.mockResolvedValue(mockSessVal);
 
       await expect(authenticator.authenticate(request)).resolves.toEqual(
@@ -727,9 +1000,6 @@ describe('Authenticator', () => {
         headers: { 'kbn-system-request': 'false' },
       });
 
-      mockBasicAuthenticationProvider.authenticate.mockResolvedValue(
-        AuthenticationResult.notHandled()
-      );
       mockSessionStorage.get.mockResolvedValue(mockSessVal);
 
       await expect(authenticator.authenticate(request)).resolves.toEqual(
@@ -745,10 +1015,10 @@ describe('Authenticator', () => {
         headers: { 'kbn-system-request': 'true' },
       });
 
-      mockBasicAuthenticationProvider.authenticate.mockResolvedValue(
-        AuthenticationResult.notHandled()
-      );
-      mockSessionStorage.get.mockResolvedValue({ ...mockSessVal, provider: 'token' });
+      mockSessionStorage.get.mockResolvedValue({
+        ...mockSessVal,
+        provider: { type: 'token', name: 'token1' },
+      });
 
       await expect(authenticator.authenticate(request)).resolves.toEqual(
         AuthenticationResult.notHandled()
@@ -763,10 +1033,10 @@ describe('Authenticator', () => {
         headers: { 'kbn-system-request': 'false' },
       });
 
-      mockBasicAuthenticationProvider.authenticate.mockResolvedValue(
-        AuthenticationResult.notHandled()
-      );
-      mockSessionStorage.get.mockResolvedValue({ ...mockSessVal, provider: 'token' });
+      mockSessionStorage.get.mockResolvedValue({
+        ...mockSessVal,
+        provider: { type: 'token', name: 'token1' },
+      });
 
       await expect(authenticator.authenticate(request)).resolves.toEqual(
         AuthenticationResult.notHandled()
@@ -775,6 +1045,70 @@ describe('Authenticator', () => {
       expect(mockSessionStorage.set).not.toHaveBeenCalled();
       expect(mockSessionStorage.clear).toHaveBeenCalled();
     });
+
+    describe('with Login Selector', () => {
+      beforeEach(() => {
+        mockOptions = getMockOptions({
+          selector: { enabled: true },
+          providers: { basic: { basic1: { order: 0 } } },
+        });
+        mockOptions.sessionStorageFactory.asScoped.mockReturnValue(mockSessionStorage);
+
+        authenticator = new Authenticator(mockOptions);
+      });
+
+      it('does not redirect to Login Selector if there is an active session', async () => {
+        const request = httpServerMock.createKibanaRequest();
+        mockSessionStorage.get.mockResolvedValue(mockSessVal);
+
+        await expect(authenticator.authenticate(request)).resolves.toEqual(
+          AuthenticationResult.notHandled()
+        );
+        expect(mockBasicAuthenticationProvider.authenticate).toHaveBeenCalled();
+      });
+
+      it('does not redirect AJAX requests to Login Selector', async () => {
+        const request = httpServerMock.createKibanaRequest({ headers: { 'kbn-xsrf': 'xsrf' } });
+
+        await expect(authenticator.authenticate(request)).resolves.toEqual(
+          AuthenticationResult.notHandled()
+        );
+        expect(mockBasicAuthenticationProvider.authenticate).toHaveBeenCalled();
+      });
+
+      it('does not redirect to Login Selector if request has `Authorization` header', async () => {
+        const request = httpServerMock.createKibanaRequest({
+          headers: { authorization: 'Basic ***' },
+        });
+
+        await expect(authenticator.authenticate(request)).resolves.toEqual(
+          AuthenticationResult.notHandled()
+        );
+        expect(mockBasicAuthenticationProvider.authenticate).toHaveBeenCalled();
+      });
+
+      it('does not redirect to Login Selector if it is not enabled', async () => {
+        mockOptions = getMockOptions({ providers: { basic: { basic1: { order: 0 } } } });
+        mockOptions.sessionStorageFactory.asScoped.mockReturnValue(mockSessionStorage);
+        authenticator = new Authenticator(mockOptions);
+
+        const request = httpServerMock.createKibanaRequest();
+        await expect(authenticator.authenticate(request)).resolves.toEqual(
+          AuthenticationResult.notHandled()
+        );
+        expect(mockBasicAuthenticationProvider.authenticate).toHaveBeenCalled();
+      });
+
+      it('redirects to the Login Selector when needed.', async () => {
+        const request = httpServerMock.createKibanaRequest();
+        await expect(authenticator.authenticate(request)).resolves.toEqual(
+          AuthenticationResult.redirectTo(
+            '/mock-server-basepath/login?next=%2Fmock-server-basepath%2Fpath'
+          )
+        );
+        expect(mockBasicAuthenticationProvider.authenticate).not.toHaveBeenCalled();
+      });
+    });
   });
 
   describe('`logout` method', () => {
@@ -783,14 +1117,14 @@ describe('Authenticator', () => {
     let mockSessionStorage: jest.Mocked<SessionStorage<ProviderSession>>;
     let mockSessVal: any;
     beforeEach(() => {
-      mockOptions = getMockOptions({ providers: ['basic'] });
+      mockOptions = getMockOptions({ providers: { basic: { basic1: { order: 0 } } } });
       mockSessionStorage = sessionStorageMock.create();
       mockOptions.sessionStorageFactory.asScoped.mockReturnValue(mockSessionStorage);
       mockSessVal = {
         idleTimeoutExpiration: null,
         lifespanExpiration: null,
         state: { authorization: 'Basic xxx' },
-        provider: 'basic',
+        provider: { type: 'basic', name: 'basic1' },
         path: mockOptions.basePath.serverBasePath,
       };
 
@@ -806,6 +1140,7 @@ describe('Authenticator', () => {
     it('returns `notHandled` if session does not exist.', async () => {
       const request = httpServerMock.createKibanaRequest();
       mockSessionStorage.get.mockResolvedValue(null);
+      mockBasicAuthenticationProvider.logout.mockResolvedValue(DeauthenticationResult.notHandled());
 
       await expect(authenticator.logout(request)).resolves.toEqual(
         DeauthenticationResult.notHandled()
@@ -830,7 +1165,7 @@ describe('Authenticator', () => {
     });
 
     it('if session does not exist but provider name is valid, returns whatever authentication provider returns.', async () => {
-      const request = httpServerMock.createKibanaRequest({ query: { provider: 'basic' } });
+      const request = httpServerMock.createKibanaRequest({ query: { provider: 'basic1' } });
       mockSessionStorage.get.mockResolvedValue(null);
 
       mockBasicAuthenticationProvider.logout.mockResolvedValue(
@@ -856,16 +1191,20 @@ describe('Authenticator', () => {
       expect(mockSessionStorage.clear).not.toHaveBeenCalled();
     });
 
-    it('only clears session if it belongs to not configured provider.', async () => {
+    it('clears session if it belongs to not configured provider.', async () => {
       const request = httpServerMock.createKibanaRequest();
       const state = { authorization: 'Bearer xxx' };
-      mockSessionStorage.get.mockResolvedValue({ ...mockSessVal, state, provider: 'token' });
+      mockSessionStorage.get.mockResolvedValue({
+        ...mockSessVal,
+        state,
+        provider: { type: 'token', name: 'token1' },
+      });
 
       await expect(authenticator.logout(request)).resolves.toEqual(
         DeauthenticationResult.notHandled()
       );
 
-      expect(mockBasicAuthenticationProvider.logout).not.toHaveBeenCalled();
+      expect(mockBasicAuthenticationProvider.logout).toHaveBeenCalledTimes(1);
       expect(mockSessionStorage.clear).toHaveBeenCalled();
     });
   });
@@ -875,7 +1214,7 @@ describe('Authenticator', () => {
     let mockOptions: ReturnType<typeof getMockOptions>;
     let mockSessionStorage: jest.Mocked<SessionStorage<ProviderSession>>;
     beforeEach(() => {
-      mockOptions = getMockOptions({ providers: ['basic'] });
+      mockOptions = getMockOptions({ providers: { basic: { basic1: { order: 0 } } } });
       mockSessionStorage = sessionStorageMock.create();
       mockOptions.sessionStorageFactory.asScoped.mockReturnValue(mockSessionStorage);
 
@@ -890,13 +1229,13 @@ describe('Authenticator', () => {
         now: currentDate,
         idleTimeoutExpiration: currentDate + 60000,
         lifespanExpiration: currentDate + 120000,
-        provider: 'basic',
+        provider: 'basic1',
       };
       mockSessionStorage.get.mockResolvedValue({
         idleTimeoutExpiration: mockInfo.idleTimeoutExpiration,
         lifespanExpiration: mockInfo.lifespanExpiration,
         state,
-        provider: mockInfo.provider,
+        provider: { type: 'basic', name: mockInfo.provider },
         path: mockOptions.basePath.serverBasePath,
       });
       jest.spyOn(Date, 'now').mockImplementation(() => currentDate);
@@ -918,13 +1257,22 @@ describe('Authenticator', () => {
 
   describe('`isProviderEnabled` method', () => {
     it('returns `true` only if specified provider is enabled', () => {
-      let authenticator = new Authenticator(getMockOptions({ providers: ['basic'] }));
-      expect(authenticator.isProviderEnabled('basic')).toBe(true);
-      expect(authenticator.isProviderEnabled('saml')).toBe(false);
-
-      authenticator = new Authenticator(getMockOptions({ providers: ['basic', 'saml'] }));
-      expect(authenticator.isProviderEnabled('basic')).toBe(true);
-      expect(authenticator.isProviderEnabled('saml')).toBe(true);
+      let authenticator = new Authenticator(
+        getMockOptions({ providers: { basic: { basic1: { order: 0 } } } })
+      );
+      expect(authenticator.isProviderTypeEnabled('basic')).toBe(true);
+      expect(authenticator.isProviderTypeEnabled('saml')).toBe(false);
+
+      authenticator = new Authenticator(
+        getMockOptions({
+          providers: {
+            basic: { basic1: { order: 0 } },
+            saml: { saml1: { order: 1, realm: 'test' } },
+          },
+        })
+      );
+      expect(authenticator.isProviderTypeEnabled('basic')).toBe(true);
+      expect(authenticator.isProviderTypeEnabled('saml')).toBe(true);
     });
   });
 });
diff --git a/x-pack/plugins/security/server/authentication/authenticator.ts b/x-pack/plugins/security/server/authentication/authenticator.ts
index 42e428c8db6e8..096d5daaab095 100644
--- a/x-pack/plugins/security/server/authentication/authenticator.ts
+++ b/x-pack/plugins/security/server/authentication/authenticator.ts
@@ -28,21 +28,22 @@ import {
   OIDCAuthenticationProvider,
   PKIAuthenticationProvider,
   HTTPAuthenticationProvider,
-  isSAMLRequestQuery,
 } from './providers';
 import { AuthenticationResult } from './authentication_result';
 import { DeauthenticationResult } from './deauthentication_result';
 import { Tokens } from './tokens';
 import { SessionInfo } from '../../public';
+import { canRedirectRequest } from './can_redirect_request';
+import { HTTPAuthorizationHeader } from './http_authentication';
 
 /**
  * The shape of the session that is actually stored in the cookie.
  */
 export interface ProviderSession {
   /**
-   * Name/type of the provider this session belongs to.
+   * Name and type of the provider this session belongs to.
    */
-  provider: string;
+  provider: { type: string; name: string };
 
   /**
    * The Unix time in ms when the session should be considered expired. If `null`, session will stay
@@ -73,9 +74,9 @@ export interface ProviderSession {
  */
 export interface ProviderLoginAttempt {
   /**
-   * Name/type of the provider this login attempt is targeted for.
+   * Name or type of the provider this login attempt is targeted for.
    */
-  provider: string;
+  provider: { name: string } | { type: string };
 
   /**
    * Login attempt can have any form and defined by the specific provider.
@@ -116,11 +117,42 @@ function assertRequest(request: KibanaRequest) {
 }
 
 function assertLoginAttempt(attempt: ProviderLoginAttempt) {
-  if (!attempt || !attempt.provider || typeof attempt.provider !== 'string') {
-    throw new Error('Login attempt should be an object with non-empty "provider" property.');
+  if (!isLoginAttemptWithProviderType(attempt) && !isLoginAttemptWithProviderName(attempt)) {
+    throw new Error(
+      'Login attempt should be an object with non-empty "provider.type" or "provider.name" property.'
+    );
   }
 }
 
+function isLoginAttemptWithProviderName(
+  attempt: unknown
+): attempt is { value: unknown; provider: { name: string } } {
+  return (
+    typeof attempt === 'object' &&
+    (attempt as any)?.provider?.name &&
+    typeof (attempt as any)?.provider?.name === 'string'
+  );
+}
+
+function isLoginAttemptWithProviderType(
+  attempt: unknown
+): attempt is { value: unknown; provider: { type: string } } {
+  return (
+    typeof attempt === 'object' &&
+    (attempt as any)?.provider?.type &&
+    typeof (attempt as any)?.provider?.type === 'string'
+  );
+}
+
+/**
+ * Determines if session value was created by the previous Kibana versions which had a different
+ * session value format.
+ * @param sessionValue The session value to check.
+ */
+function isLegacyProviderSession(sessionValue: any) {
+  return typeof sessionValue?.provider === 'string';
+}
+
 /**
  * Instantiates authentication provider based on the provider key from config.
  * @param providerType Provider type key.
@@ -196,29 +228,22 @@ export class Authenticator {
       getServerBaseURL: this.options.getServerBaseURL,
     };
 
-    const authProviders = this.options.config.authc.providers;
-    if (authProviders.length === 0) {
-      throw new Error(
-        'No authentication provider is configured. Verify `xpack.security.authc.providers` config value.'
-      );
-    }
-
     this.providers = new Map(
-      authProviders.map(providerType => {
-        const providerSpecificOptions = this.options.config.authc.hasOwnProperty(providerType)
-          ? (this.options.config.authc as Record<string, any>)[providerType]
-          : undefined;
-
-        this.logger.debug(`Enabling "${providerType}" authentication provider.`);
+      this.options.config.authc.sortedProviders.map(({ type, name }) => {
+        this.logger.debug(`Enabling "${name}" (${type}) authentication provider.`);
 
         return [
-          providerType,
+          name,
           instantiateProvider(
-            providerType,
-            Object.freeze({ ...providerCommonOptions, logger: options.loggers.get(providerType) }),
-            providerSpecificOptions
+            type,
+            Object.freeze({
+              ...providerCommonOptions,
+              name,
+              logger: options.loggers.get(type, name),
+            }),
+            this.options.config.authc.providers[type]?.[name]
           ),
-        ] as [string, BaseAuthenticationProvider];
+        ];
       })
     );
 
@@ -227,11 +252,18 @@ export class Authenticator {
       this.setupHTTPAuthenticationProvider(
         Object.freeze({
           ...providerCommonOptions,
+          name: '__http__',
           logger: options.loggers.get(HTTPAuthenticationProvider.type),
         })
       );
     }
 
+    if (this.providers.size === 0) {
+      throw new Error(
+        'No authentication provider is configured. Verify `xpack.security.authc.*` config value.'
+      );
+    }
+
     this.serverBasePath = this.options.basePath.serverBasePath || '/';
 
     this.idleTimeout = this.options.config.session.idleTimeout;
@@ -247,60 +279,58 @@ export class Authenticator {
     assertRequest(request);
     assertLoginAttempt(attempt);
 
-    // If there is an attempt to login with a provider that isn't enabled, we should fail.
-    const provider = this.providers.get(attempt.provider);
-    if (provider === undefined) {
+    const sessionStorage = this.options.sessionStorageFactory.asScoped(request);
+    const existingSession = await this.getSessionValue(sessionStorage);
+
+    // Login attempt can target specific provider by its name (e.g. chosen at the Login Selector UI)
+    // or a group of providers with the specified type (e.g. in case of 3rd-party initiated login
+    // attempts we may not know what provider exactly can handle that attempt and we have to try
+    // every enabled provider of the specified type).
+    const providers: Array<[string, BaseAuthenticationProvider]> =
+      isLoginAttemptWithProviderName(attempt) && this.providers.has(attempt.provider.name)
+        ? [[attempt.provider.name, this.providers.get(attempt.provider.name)!]]
+        : isLoginAttemptWithProviderType(attempt)
+        ? [...this.providerIterator(existingSession)].filter(
+            ([, { type }]) => type === attempt.provider.type
+          )
+        : [];
+
+    if (providers.length === 0) {
       this.logger.debug(
-        `Login attempt for provider "${attempt.provider}" is detected, but it isn't enabled.`
+        `Login attempt for provider with ${
+          isLoginAttemptWithProviderName(attempt)
+            ? `name ${attempt.provider.name}`
+            : `type "${(attempt.provider as Record<string, string>).type}"`
+        } is detected, but it isn't enabled.`
       );
       return AuthenticationResult.notHandled();
     }
 
-    this.logger.debug(`Performing login using "${attempt.provider}" provider.`);
-
-    const sessionStorage = this.options.sessionStorageFactory.asScoped(request);
+    for (const [providerName, provider] of providers) {
+      // Check if current session has been set by this provider.
+      const ownsSession =
+        existingSession?.provider.name === providerName &&
+        existingSession?.provider.type === provider.type;
 
-    // If we detect an existing session that belongs to a different provider than the one requested
-    // to perform a login we should clear such session.
-    let existingSession = await this.getSessionValue(sessionStorage);
-    if (existingSession && existingSession.provider !== attempt.provider) {
-      this.logger.debug(
-        `Clearing existing session of another ("${existingSession.provider}") provider.`
+      const authenticationResult = await provider.login(
+        request,
+        attempt.value,
+        ownsSession ? existingSession!.state : null
       );
-      sessionStorage.clear();
-      existingSession = null;
-    }
-
-    const authenticationResult = await provider.login(
-      request,
-      attempt.value,
-      existingSession && existingSession.state
-    );
 
-    // There are two possible cases when we'd want to clear existing state:
-    // 1. If provider owned the state (e.g. intermediate state used for multi step login), but failed
-    // to login, that likely means that state is not valid anymore and we should clear it.
-    // 2. Also provider can specifically ask to clear state by setting it to `null` even if
-    // authentication attempt didn't fail (e.g. custom realm could "pin" client/request identity to
-    // a server-side only session established during multi step login that relied on intermediate
-    // client-side state which isn't needed anymore).
-    const shouldClearSession =
-      authenticationResult.shouldClearState() ||
-      (authenticationResult.failed() && getErrorStatusCode(authenticationResult.error) === 401);
-    if (existingSession && shouldClearSession) {
-      sessionStorage.clear();
-    } else if (authenticationResult.shouldUpdateState()) {
-      const { idleTimeoutExpiration, lifespanExpiration } = this.calculateExpiry(existingSession);
-      sessionStorage.set({
-        state: authenticationResult.state,
-        provider: attempt.provider,
-        idleTimeoutExpiration,
-        lifespanExpiration,
-        path: this.serverBasePath,
+      this.updateSessionValue(sessionStorage, {
+        provider: { type: provider.type, name: providerName },
+        isSystemRequest: request.isSystemRequest,
+        authenticationResult,
+        existingSession: ownsSession ? existingSession : null,
       });
+
+      if (!authenticationResult.notHandled()) {
+        return authenticationResult;
+      }
     }
 
-    return authenticationResult;
+    return AuthenticationResult.notHandled();
   }
 
   /**
@@ -313,33 +343,46 @@ export class Authenticator {
     const sessionStorage = this.options.sessionStorageFactory.asScoped(request);
     const existingSession = await this.getSessionValue(sessionStorage);
 
-    let authenticationResult = AuthenticationResult.notHandled();
-    for (const [providerType, provider] of this.providerIterator(existingSession)) {
+    // If request doesn't have any session information, isn't attributed with HTTP Authorization
+    // header and Login Selector is enabled, we must redirect user to the login selector.
+    const useLoginSelector =
+      !existingSession &&
+      this.options.config.authc.selector.enabled &&
+      canRedirectRequest(request) &&
+      HTTPAuthorizationHeader.parseFromRequest(request) == null;
+    if (useLoginSelector) {
+      this.logger.debug('Redirecting request to Login Selector.');
+      return AuthenticationResult.redirectTo(
+        `${this.options.basePath.serverBasePath}/login?next=${encodeURIComponent(
+          `${this.options.basePath.get(request)}${request.url.path}`
+        )}`
+      );
+    }
+
+    for (const [providerName, provider] of this.providerIterator(existingSession)) {
       // Check if current session has been set by this provider.
-      const ownsSession = existingSession && existingSession.provider === providerType;
+      const ownsSession =
+        existingSession?.provider.name === providerName &&
+        existingSession?.provider.type === provider.type;
 
-      authenticationResult = await provider.authenticate(
+      const authenticationResult = await provider.authenticate(
         request,
         ownsSession ? existingSession!.state : null
       );
 
       this.updateSessionValue(sessionStorage, {
-        providerType,
+        provider: { type: provider.type, name: providerName },
         isSystemRequest: request.isSystemRequest,
         authenticationResult,
         existingSession: ownsSession ? existingSession : null,
       });
 
-      if (
-        authenticationResult.failed() ||
-        authenticationResult.succeeded() ||
-        authenticationResult.redirected()
-      ) {
+      if (!authenticationResult.notHandled()) {
         return authenticationResult;
       }
     }
 
-    return authenticationResult;
+    return AuthenticationResult.notHandled();
   }
 
   /**
@@ -351,28 +394,33 @@ export class Authenticator {
 
     const sessionStorage = this.options.sessionStorageFactory.asScoped(request);
     const sessionValue = await this.getSessionValue(sessionStorage);
-    const providerName = this.getProviderName(request.query);
     if (sessionValue) {
       sessionStorage.clear();
 
-      return this.providers.get(sessionValue.provider)!.logout(request, sessionValue.state);
-    } else if (providerName) {
+      return this.providers.get(sessionValue.provider.name)!.logout(request, sessionValue.state);
+    }
+
+    const providerName = this.getProviderName(request.query);
+    if (providerName) {
       // provider name is passed in a query param and sourced from the browser's local storage;
       // hence, we can't assume that this provider exists, so we have to check it
       const provider = this.providers.get(providerName);
       if (provider) {
         return provider.logout(request, null);
       }
-    }
-
-    // Normally when there is no active session in Kibana, `logout` method shouldn't do anything
-    // and user will eventually be redirected to the home page to log in. But if SAML is supported there
-    // is a special case when logout is initiated by the IdP or another SP, then IdP will request _every_
-    // SP associated with the current user session to do the logout. So if Kibana (without active session)
-    // receives such a request it shouldn't redirect user to the home page, but rather redirect back to IdP
-    // with correct logout response and only Elasticsearch knows how to do that.
-    if (isSAMLRequestQuery(request.query) && this.providers.has('saml')) {
-      return this.providers.get('saml')!.logout(request);
+    } else {
+      // In case logout is called and we cannot figure out what provider is supposed to handle it,
+      // we should iterate through all providers and let them decide if they can perform a logout.
+      // This can be necessary if some 3rd-party initiates logout. And even if user doesn't have an
+      // active session already some providers can still properly respond to the 3rd-party logout
+      // request. For example SAML provider can process logout request encoded in `SAMLRequest`
+      // query string parameter.
+      for (const [, provider] of this.providerIterator(null)) {
+        const deauthenticationResult = await provider.logout(request);
+        if (!deauthenticationResult.notHandled()) {
+          return deauthenticationResult;
+        }
+      }
     }
 
     return DeauthenticationResult.notHandled();
@@ -395,7 +443,7 @@ export class Authenticator {
         now: Date.now(),
         idleTimeoutExpiration: sessionValue.idleTimeoutExpiration,
         lifespanExpiration: sessionValue.lifespanExpiration,
-        provider: sessionValue.provider,
+        provider: sessionValue.provider.name,
       };
     }
     return null;
@@ -405,8 +453,8 @@ export class Authenticator {
    * Checks whether specified provider type is currently enabled.
    * @param providerType Type of the provider (`basic`, `saml`, `pki` etc.).
    */
-  isProviderEnabled(providerType: string) {
-    return this.providers.has(providerType);
+  isProviderTypeEnabled(providerType: string) {
+    return [...this.providers.values()].some(provider => provider.type === providerType);
   }
 
   /**
@@ -430,10 +478,11 @@ export class Authenticator {
       }
     }
 
-    this.providers.set(
-      HTTPAuthenticationProvider.type,
-      new HTTPAuthenticationProvider(options, { supportedSchemes })
-    );
+    if (this.providers.has(options.name)) {
+      throw new Error(`Provider name "${options.name}" is reserved.`);
+    }
+
+    this.providers.set(options.name, new HTTPAuthenticationProvider(options, { supportedSchemes }));
   }
 
   /**
@@ -449,11 +498,11 @@ export class Authenticator {
     if (!sessionValue) {
       yield* this.providers;
     } else {
-      yield [sessionValue.provider, this.providers.get(sessionValue.provider)!];
+      yield [sessionValue.provider.name, this.providers.get(sessionValue.provider.name)!];
 
-      for (const [providerType, provider] of this.providers) {
-        if (providerType !== sessionValue.provider) {
-          yield [providerType, provider];
+      for (const [providerName, provider] of this.providers) {
+        if (providerName !== sessionValue.provider.name) {
+          yield [providerName, provider];
         }
       }
     }
@@ -465,14 +514,19 @@ export class Authenticator {
    * @param sessionStorage Session storage instance.
    */
   private async getSessionValue(sessionStorage: SessionStorage<ProviderSession>) {
-    let sessionValue = await sessionStorage.get();
+    const sessionValue = await sessionStorage.get();
 
-    // If for some reason we have a session stored for the provider that is not available
-    // (e.g. when user was logged in with one provider, but then configuration has changed
-    // and that provider is no longer available), then we should clear session entirely.
-    if (sessionValue && !this.providers.has(sessionValue.provider)) {
+    // If we detect that session is in incompatible format or for some reason we have a session
+    // stored for the provider that is not available anymore (e.g. when user was logged in with one
+    // provider, but then configuration has changed and that provider is no longer available), then
+    // we should clear session entirely.
+    if (
+      sessionValue &&
+      (isLegacyProviderSession(sessionValue) ||
+        this.providers.get(sessionValue.provider.name)?.type !== sessionValue.provider.type)
+    ) {
       sessionStorage.clear();
-      sessionValue = null;
+      return null;
     }
 
     return sessionValue;
@@ -481,12 +535,12 @@ export class Authenticator {
   private updateSessionValue(
     sessionStorage: SessionStorage<ProviderSession>,
     {
-      providerType,
+      provider,
       authenticationResult,
       existingSession,
       isSystemRequest,
     }: {
-      providerType: string;
+      provider: { type: string; name: string };
       authenticationResult: AuthenticationResult;
       existingSession: ProviderSession | null;
       isSystemRequest: boolean;
@@ -517,7 +571,7 @@ export class Authenticator {
         state: authenticationResult.shouldUpdateState()
           ? authenticationResult.state
           : existingSession!.state,
-        provider: providerType,
+        provider,
         idleTimeoutExpiration,
         lifespanExpiration,
         path: this.serverBasePath,
diff --git a/x-pack/plugins/security/server/authentication/get_http_authentication_scheme.test.ts b/x-pack/plugins/security/server/authentication/get_http_authentication_scheme.test.ts
deleted file mode 100644
index 6a63634394ec0..0000000000000
--- a/x-pack/plugins/security/server/authentication/get_http_authentication_scheme.test.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { httpServerMock } from '../../../../../src/core/server/http/http_server.mocks';
-
-import { getHTTPAuthenticationScheme } from './get_http_authentication_scheme';
-
-describe('getHTTPAuthenticationScheme', () => {
-  it('returns `null` if request does not have authorization header', () => {
-    expect(getHTTPAuthenticationScheme(httpServerMock.createKibanaRequest())).toBeNull();
-  });
-
-  it('returns `null` if authorization header value isn not a string', () => {
-    expect(
-      getHTTPAuthenticationScheme(
-        httpServerMock.createKibanaRequest({
-          headers: { authorization: ['Basic xxx', 'Bearer xxx'] as any },
-        })
-      )
-    ).toBeNull();
-  });
-
-  it('returns `null` if authorization header value is an empty string', () => {
-    expect(
-      getHTTPAuthenticationScheme(
-        httpServerMock.createKibanaRequest({ headers: { authorization: '' } })
-      )
-    ).toBeNull();
-  });
-
-  it('returns only scheme portion of the authorization header value in lower case', () => {
-    const headerValueAndSchemeMap = [
-      ['Basic xxx', 'basic'],
-      ['Basic xxx yyy', 'basic'],
-      ['basic xxx', 'basic'],
-      ['basic', 'basic'],
-      // We don't trim leading whitespaces in scheme.
-      [' Basic xxx', ''],
-      ['Negotiate xxx', 'negotiate'],
-      ['negotiate xxx', 'negotiate'],
-      ['negotiate', 'negotiate'],
-      ['ApiKey xxx', 'apikey'],
-      ['apikey xxx', 'apikey'],
-      ['Api Key xxx', 'api'],
-    ];
-
-    for (const [authorization, scheme] of headerValueAndSchemeMap) {
-      expect(
-        getHTTPAuthenticationScheme(
-          httpServerMock.createKibanaRequest({ headers: { authorization } })
-        )
-      ).toBe(scheme);
-    }
-  });
-});
diff --git a/x-pack/plugins/security/server/authentication/get_http_authentication_scheme.ts b/x-pack/plugins/security/server/authentication/get_http_authentication_scheme.ts
deleted file mode 100644
index b9c53f34dbcab..0000000000000
--- a/x-pack/plugins/security/server/authentication/get_http_authentication_scheme.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the Elastic License;
- * you may not use this file except in compliance with the Elastic License.
- */
-
-import { KibanaRequest } from '../../../../../src/core/server';
-
-/**
- * Parses request's `Authorization` HTTP header if present and extracts authentication scheme.
- * https://www.iana.org/assignments/http-authschemes/http-authschemes.xhtml#authschemes
- * @param request Request instance to extract authentication scheme for.
- */
-export function getHTTPAuthenticationScheme(request: KibanaRequest) {
-  const authorizationHeaderValue = request.headers.authorization;
-  if (!authorizationHeaderValue || typeof authorizationHeaderValue !== 'string') {
-    return null;
-  }
-
-  return authorizationHeaderValue.split(/\s+/)[0].toLowerCase();
-}
diff --git a/x-pack/plugins/security/server/authentication/http_authentication/basic_http_authorization_header_credentials.test.ts b/x-pack/plugins/security/server/authentication/http_authentication/basic_http_authorization_header_credentials.test.ts
new file mode 100644
index 0000000000000..bd3c7047e77e7
--- /dev/null
+++ b/x-pack/plugins/security/server/authentication/http_authentication/basic_http_authorization_header_credentials.test.ts
@@ -0,0 +1,56 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { BasicHTTPAuthorizationHeaderCredentials } from './basic_http_authorization_header_credentials';
+
+const encodeToBase64 = (str: string) => Buffer.from(str).toString('base64');
+
+describe('BasicHTTPAuthorizationHeaderCredentials.parseFromRequest()', () => {
+  it('parses username from the left-side of the single colon', () => {
+    const basicCredentials = BasicHTTPAuthorizationHeaderCredentials.parseFromCredentials(
+      encodeToBase64('fOo:bAr')
+    );
+    expect(basicCredentials.username).toBe('fOo');
+  });
+
+  it('parses username from the left-side of the first colon', () => {
+    const basicCredentials = BasicHTTPAuthorizationHeaderCredentials.parseFromCredentials(
+      encodeToBase64('fOo:bAr:bAz')
+    );
+    expect(basicCredentials.username).toBe('fOo');
+  });
+
+  it('parses password from the right-side of the single colon', () => {
+    const basicCredentials = BasicHTTPAuthorizationHeaderCredentials.parseFromCredentials(
+      encodeToBase64('fOo:bAr')
+    );
+    expect(basicCredentials.password).toBe('bAr');
+  });
+
+  it('parses password from the right-side of the first colon', () => {
+    const basicCredentials = BasicHTTPAuthorizationHeaderCredentials.parseFromCredentials(
+      encodeToBase64('fOo:bAr:bAz')
+    );
+    expect(basicCredentials.password).toBe('bAr:bAz');
+  });
+
+  it('throws error if there is no colon', () => {
+    expect(() => {
+      BasicHTTPAuthorizationHeaderCredentials.parseFromCredentials(encodeToBase64('fOobArbAz'));
+    }).toThrowErrorMatchingInlineSnapshot(
+      `"Unable to parse basic authentication credentials without a colon"`
+    );
+  });
+});
+
+describe(`toString()`, () => {
+  it('concatenates username and password using a colon and then base64 encodes the string', () => {
+    const basicCredentials = new BasicHTTPAuthorizationHeaderCredentials('elastic', 'changeme');
+
+    expect(basicCredentials.toString()).toEqual(Buffer.from(`elastic:changeme`).toString('base64')); // I don't like that this so closely mirror the actual implementation
+    expect(basicCredentials.toString()).toEqual('ZWxhc3RpYzpjaGFuZ2VtZQ=='); // and I don't like that this is so opaque. Both together seem reasonable...
+  });
+});
diff --git a/x-pack/plugins/security/server/authentication/http_authentication/basic_http_authorization_header_credentials.ts b/x-pack/plugins/security/server/authentication/http_authentication/basic_http_authorization_header_credentials.ts
new file mode 100644
index 0000000000000..b8c3f1dadf1b2
--- /dev/null
+++ b/x-pack/plugins/security/server/authentication/http_authentication/basic_http_authorization_header_credentials.ts
@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export class BasicHTTPAuthorizationHeaderCredentials {
+  /**
+   * Username, referred to as the `user-id` in https://tools.ietf.org/html/rfc7617.
+   */
+  readonly username: string;
+
+  /**
+   * Password used to authenticate
+   */
+  readonly password: string;
+
+  constructor(username: string, password: string) {
+    this.username = username;
+    this.password = password;
+  }
+
+  /**
+   * Parses the username and password from the credentials included in a HTTP Authorization header
+   * for the Basic scheme https://tools.ietf.org/html/rfc7617
+   * @param credentials The credentials extracted from the HTTP Authorization header
+   */
+  static parseFromCredentials(credentials: string) {
+    const decoded = Buffer.from(credentials, 'base64').toString();
+    if (decoded.indexOf(':') === -1) {
+      throw new Error('Unable to parse basic authentication credentials without a colon');
+    }
+
+    const [username] = decoded.split(':');
+    // according to https://tools.ietf.org/html/rfc7617, everything
+    // after the first colon is considered to be part of the password
+    const password = decoded.substring(username.length + 1);
+    return new BasicHTTPAuthorizationHeaderCredentials(username, password);
+  }
+
+  toString() {
+    return Buffer.from(`${this.username}:${this.password}`).toString('base64');
+  }
+}
diff --git a/x-pack/plugins/security/server/authentication/http_authentication/http_authorization_header.test.ts b/x-pack/plugins/security/server/authentication/http_authentication/http_authorization_header.test.ts
new file mode 100644
index 0000000000000..d47a0c70f608a
--- /dev/null
+++ b/x-pack/plugins/security/server/authentication/http_authentication/http_authorization_header.test.ts
@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { httpServerMock } from '../../../../../../src/core/server/mocks';
+
+import { HTTPAuthorizationHeader } from './http_authorization_header';
+
+describe('HTTPAuthorizationHeader.parseFromRequest()', () => {
+  it('returns `null` if request does not have authorization header', () => {
+    expect(
+      HTTPAuthorizationHeader.parseFromRequest(httpServerMock.createKibanaRequest())
+    ).toBeNull();
+  });
+
+  it('returns `null` if authorization header value is not a string', () => {
+    expect(
+      HTTPAuthorizationHeader.parseFromRequest(
+        httpServerMock.createKibanaRequest({
+          headers: { authorization: ['Basic xxx', 'Bearer xxx'] as any },
+        })
+      )
+    ).toBeNull();
+  });
+
+  it('returns `null` if authorization header value is an empty string', () => {
+    expect(
+      HTTPAuthorizationHeader.parseFromRequest(
+        httpServerMock.createKibanaRequest({ headers: { authorization: '' } })
+      )
+    ).toBeNull();
+  });
+
+  it('parses scheme portion of the authorization header value', () => {
+    const headerValueAndSchemeMap = [
+      ['Basic xxx', 'Basic'],
+      ['Basic xxx yyy', 'Basic'],
+      ['basic xxx', 'basic'],
+      ['basic', 'basic'],
+      // We don't trim leading whitespaces in scheme.
+      [' Basic xxx', ''],
+      ['Negotiate xxx', 'Negotiate'],
+      ['negotiate xxx', 'negotiate'],
+      ['negotiate', 'negotiate'],
+      ['ApiKey xxx', 'ApiKey'],
+      ['apikey xxx', 'apikey'],
+      ['Api Key xxx', 'Api'],
+    ];
+
+    for (const [authorization, scheme] of headerValueAndSchemeMap) {
+      const header = HTTPAuthorizationHeader.parseFromRequest(
+        httpServerMock.createKibanaRequest({ headers: { authorization } })
+      );
+      expect(header).not.toBeNull();
+      expect(header!.scheme).toBe(scheme);
+    }
+  });
+
+  it('parses credentials portion of the authorization header value', () => {
+    const headerValueAndCredentialsMap = [
+      ['xxx fOo', 'fOo'],
+      ['xxx fOo bAr', 'fOo bAr'],
+      // We don't trim leading whitespaces in scheme.
+      [' xxx fOo', 'xxx fOo'],
+    ];
+
+    for (const [authorization, credentials] of headerValueAndCredentialsMap) {
+      const header = HTTPAuthorizationHeader.parseFromRequest(
+        httpServerMock.createKibanaRequest({ headers: { authorization } })
+      );
+      expect(header).not.toBeNull();
+      expect(header!.credentials).toBe(credentials);
+    }
+  });
+});
+
+describe('toString()', () => {
+  it('concatenates scheme and credentials using a space', () => {
+    const header = new HTTPAuthorizationHeader('Bearer', 'some-access-token');
+
+    expect(header.toString()).toEqual('Bearer some-access-token');
+  });
+});
diff --git a/x-pack/plugins/security/server/authentication/http_authentication/http_authorization_header.ts b/x-pack/plugins/security/server/authentication/http_authentication/http_authorization_header.ts
new file mode 100644
index 0000000000000..bfc757734ec72
--- /dev/null
+++ b/x-pack/plugins/security/server/authentication/http_authentication/http_authorization_header.ts
@@ -0,0 +1,45 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { KibanaRequest } from '../../../../../../src/core/server';
+
+export class HTTPAuthorizationHeader {
+  /**
+   * The authentication scheme. Should be consumed in a case-insensitive manner.
+   * https://www.iana.org/assignments/http-authschemes/http-authschemes.xhtml#authschemes
+   */
+  readonly scheme: string;
+
+  /**
+   * The authentication credentials for the scheme.
+   */
+  readonly credentials: string;
+
+  constructor(scheme: string, credentials: string) {
+    this.scheme = scheme;
+    this.credentials = credentials;
+  }
+
+  /**
+   * Parses request's `Authorization` HTTP header if present.
+   * @param request Request instance to extract the authorization header from.
+   */
+  static parseFromRequest(request: KibanaRequest) {
+    const authorizationHeaderValue = request.headers.authorization;
+    if (!authorizationHeaderValue || typeof authorizationHeaderValue !== 'string') {
+      return null;
+    }
+
+    const [scheme] = authorizationHeaderValue.split(/\s+/);
+    const credentials = authorizationHeaderValue.substring(scheme.length + 1);
+
+    return new HTTPAuthorizationHeader(scheme, credentials);
+  }
+
+  toString() {
+    return `${this.scheme} ${this.credentials}`;
+  }
+}
diff --git a/x-pack/plugins/security/server/authentication/http_authentication/index.ts b/x-pack/plugins/security/server/authentication/http_authentication/index.ts
new file mode 100644
index 0000000000000..94eb8762ecaf0
--- /dev/null
+++ b/x-pack/plugins/security/server/authentication/http_authentication/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { BasicHTTPAuthorizationHeaderCredentials } from './basic_http_authorization_header_credentials';
+export { HTTPAuthorizationHeader } from './http_authorization_header';
diff --git a/x-pack/plugins/security/server/authentication/index.mock.ts b/x-pack/plugins/security/server/authentication/index.mock.ts
index c634e2c80c299..8092c1c81017b 100644
--- a/x-pack/plugins/security/server/authentication/index.mock.ts
+++ b/x-pack/plugins/security/server/authentication/index.mock.ts
@@ -10,10 +10,12 @@ export const authenticationMock = {
   create: (): jest.Mocked<Authentication> => ({
     login: jest.fn(),
     logout: jest.fn(),
-    isProviderEnabled: jest.fn(),
+    isProviderTypeEnabled: jest.fn(),
     createAPIKey: jest.fn(),
     getCurrentUser: jest.fn(),
+    grantAPIKeyAsInternalUser: jest.fn(),
     invalidateAPIKey: jest.fn(),
+    invalidateAPIKeyAsInternalUser: jest.fn(),
     isAuthenticated: jest.fn(),
     getSessionInfo: jest.fn(),
   }),
diff --git a/x-pack/plugins/security/server/authentication/index.test.ts b/x-pack/plugins/security/server/authentication/index.test.ts
index 973c322285db1..6694cf63e9988 100644
--- a/x-pack/plugins/security/server/authentication/index.test.ts
+++ b/x-pack/plugins/security/server/authentication/index.test.ts
@@ -10,7 +10,6 @@ jest.mock('./api_keys');
 jest.mock('./authenticator');
 
 import Boom from 'boom';
-import { first } from 'rxjs/operators';
 
 import {
   loggingServiceMock,
@@ -31,9 +30,9 @@ import {
   ScopedClusterClient,
 } from '../../../../../src/core/server';
 import { AuthenticatedUser } from '../../common/model';
-import { ConfigType, createConfig$ } from '../config';
+import { ConfigSchema, ConfigType, createConfig } from '../config';
 import { AuthenticationResult } from './authentication_result';
-import { setupAuthentication } from '.';
+import { Authentication, setupAuthentication } from '.';
 import {
   CreateAPIKeyResult,
   CreateAPIKeyParams,
@@ -51,24 +50,18 @@ describe('setupAuthentication()', () => {
     license: jest.Mocked<SecurityLicense>;
   };
   let mockScopedClusterClient: jest.Mocked<PublicMethodsOf<ScopedClusterClient>>;
-  beforeEach(async () => {
-    const mockConfig$ = createConfig$(
-      coreMock.createPluginInitializerContext({
-        encryptionKey: 'ab'.repeat(16),
-        secureCookies: true,
-        session: {
-          idleTimeout: null,
-          lifespan: null,
-        },
-        cookieName: 'my-sid-cookie',
-        authc: { providers: ['basic'], http: { enabled: true } },
-        public: {},
-      }),
-      true
-    );
+  beforeEach(() => {
     mockSetupAuthenticationParams = {
       http: coreMock.createSetup().http,
-      config: await mockConfig$.pipe(first()).toPromise(),
+      config: createConfig(
+        ConfigSchema.validate({
+          encryptionKey: 'ab'.repeat(16),
+          secureCookies: true,
+          cookieName: 'my-sid-cookie',
+        }),
+        loggingServiceMock.create().get(),
+        { isTLSEnabled: false }
+      ),
       clusterClient: elasticsearchServiceMock.createClusterClient(),
       license: licenseMock.create(),
       loggers: loggingServiceMock.create(),
@@ -415,6 +408,24 @@ describe('setupAuthentication()', () => {
     });
   });
 
+  describe('grantAPIKeyAsInternalUser()', () => {
+    let grantAPIKeyAsInternalUser: (request: KibanaRequest) => Promise<CreateAPIKeyResult | null>;
+    beforeEach(async () => {
+      grantAPIKeyAsInternalUser = (await setupAuthentication(mockSetupAuthenticationParams))
+        .grantAPIKeyAsInternalUser;
+    });
+
+    it('calls grantAsInternalUser', async () => {
+      const request = httpServerMock.createKibanaRequest();
+      const apiKeysInstance = jest.requireMock('./api_keys').APIKeys.mock.instances[0];
+      apiKeysInstance.grantAsInternalUser.mockResolvedValueOnce({ api_key: 'foo' });
+      await expect(grantAPIKeyAsInternalUser(request)).resolves.toEqual({
+        api_key: 'foo',
+      });
+      expect(apiKeysInstance.grantAsInternalUser).toHaveBeenCalledWith(request);
+    });
+  });
+
   describe('invalidateAPIKey()', () => {
     let invalidateAPIKey: (
       request: KibanaRequest,
@@ -438,4 +449,25 @@ describe('setupAuthentication()', () => {
       expect(apiKeysInstance.invalidate).toHaveBeenCalledWith(request, params);
     });
   });
+
+  describe('invalidateAPIKeyAsInternalUser()', () => {
+    let invalidateAPIKeyAsInternalUser: Authentication['invalidateAPIKeyAsInternalUser'];
+
+    beforeEach(async () => {
+      invalidateAPIKeyAsInternalUser = (await setupAuthentication(mockSetupAuthenticationParams))
+        .invalidateAPIKeyAsInternalUser;
+    });
+
+    it('calls invalidateAPIKeyAsInternalUser with given arguments', async () => {
+      const apiKeysInstance = jest.requireMock('./api_keys').APIKeys.mock.instances[0];
+      const params = {
+        id: '123',
+      };
+      apiKeysInstance.invalidateAsInternalUser.mockResolvedValueOnce({ success: true });
+      await expect(invalidateAPIKeyAsInternalUser(params)).resolves.toEqual({
+        success: true,
+      });
+      expect(apiKeysInstance.invalidateAsInternalUser).toHaveBeenCalledWith(params);
+    });
+  });
 });
diff --git a/x-pack/plugins/security/server/authentication/index.ts b/x-pack/plugins/security/server/authentication/index.ts
index 5109c174344d8..775e7f1b32488 100644
--- a/x-pack/plugins/security/server/authentication/index.ts
+++ b/x-pack/plugins/security/server/authentication/index.ts
@@ -21,13 +21,17 @@ export { canRedirectRequest } from './can_redirect_request';
 export { Authenticator, ProviderLoginAttempt } from './authenticator';
 export { AuthenticationResult } from './authentication_result';
 export { DeauthenticationResult } from './deauthentication_result';
-export { OIDCAuthenticationFlow, SAMLLoginStep } from './providers';
+export { OIDCLogin, SAMLLogin } from './providers';
 export {
   CreateAPIKeyResult,
   InvalidateAPIKeyResult,
   CreateAPIKeyParams,
   InvalidateAPIKeyParams,
 } from './api_keys';
+export {
+  BasicHTTPAuthorizationHeaderCredentials,
+  HTTPAuthorizationHeader,
+} from './http_authentication';
 
 interface SetupAuthenticationParams {
   http: CoreSetup['http'];
@@ -177,12 +181,15 @@ export async function setupAuthentication({
     login: authenticator.login.bind(authenticator),
     logout: authenticator.logout.bind(authenticator),
     getSessionInfo: authenticator.getSessionInfo.bind(authenticator),
-    isProviderEnabled: authenticator.isProviderEnabled.bind(authenticator),
+    isProviderTypeEnabled: authenticator.isProviderTypeEnabled.bind(authenticator),
     getCurrentUser,
     createAPIKey: (request: KibanaRequest, params: CreateAPIKeyParams) =>
       apiKeys.create(request, params),
+    grantAPIKeyAsInternalUser: (request: KibanaRequest) => apiKeys.grantAsInternalUser(request),
     invalidateAPIKey: (request: KibanaRequest, params: InvalidateAPIKeyParams) =>
       apiKeys.invalidate(request, params),
+    invalidateAPIKeyAsInternalUser: (params: InvalidateAPIKeyParams) =>
+      apiKeys.invalidateAsInternalUser(params),
     isAuthenticated: (request: KibanaRequest) => http.auth.isAuthenticated(request),
   };
 }
diff --git a/x-pack/plugins/security/server/authentication/providers/base.mock.ts b/x-pack/plugins/security/server/authentication/providers/base.mock.ts
index 296dd0ae96438..8127cfe256db5 100644
--- a/x-pack/plugins/security/server/authentication/providers/base.mock.ts
+++ b/x-pack/plugins/security/server/authentication/providers/base.mock.ts
@@ -14,7 +14,7 @@ export type MockAuthenticationProviderOptions = ReturnType<
   typeof mockAuthenticationProviderOptions
 >;
 
-export function mockAuthenticationProviderOptions() {
+export function mockAuthenticationProviderOptions(options?: { name: string }) {
   const basePath = httpServiceMock.createSetupContract().basePath;
   basePath.get.mockReturnValue('/base-path');
 
@@ -24,5 +24,6 @@ export function mockAuthenticationProviderOptions() {
     logger: loggingServiceMock.create().get(),
     basePath,
     tokens: { refresh: jest.fn(), invalidate: jest.fn() },
+    name: options?.name ?? 'basic1',
   };
 }
diff --git a/x-pack/plugins/security/server/authentication/providers/base.ts b/x-pack/plugins/security/server/authentication/providers/base.ts
index b09f6ed0fc258..08a5905017ec5 100644
--- a/x-pack/plugins/security/server/authentication/providers/base.ts
+++ b/x-pack/plugins/security/server/authentication/providers/base.ts
@@ -21,6 +21,7 @@ import { Tokens } from '../tokens';
  * Represents available provider options.
  */
 export interface AuthenticationProviderOptions {
+  name: string;
   getServerBaseURL: () => string;
   basePath: HttpServiceSetup['basePath'];
   client: IClusterClient;
@@ -42,6 +43,12 @@ export abstract class BaseAuthenticationProvider {
    */
   static readonly type: string;
 
+  /**
+   * Type of the provider. We use `this.constructor` trick to get access to the static `type` field
+   * of the specific `BaseAuthenticationProvider` subclass.
+   */
+  public readonly type = (this.constructor as any).type as string;
+
   /**
    * Logger instance bound to a specific provider context.
    */
@@ -103,9 +110,7 @@ export abstract class BaseAuthenticationProvider {
       ...(await this.options.client
         .asScoped({ headers: { ...request.headers, ...authHeaders } })
         .callAsCurrentUser('shield.authenticate')),
-      // We use `this.constructor` trick to get access to the static `type` field of the specific
-      // `BaseAuthenticationProvider` subclass.
-      authentication_provider: (this.constructor as any).type,
+      authentication_provider: this.options.name,
     } as AuthenticatedUser);
   }
 }
diff --git a/x-pack/plugins/security/server/authentication/providers/basic.test.ts b/x-pack/plugins/security/server/authentication/providers/basic.test.ts
index b7bdff0531fc2..97ca4e46d3eb5 100644
--- a/x-pack/plugins/security/server/authentication/providers/basic.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/basic.test.ts
@@ -91,6 +91,12 @@ describe('BasicAuthenticationProvider', () => {
       ).resolves.toEqual(AuthenticationResult.notHandled());
     });
 
+    it('does not redirect requests that do not require authentication to the login page.', async () => {
+      await expect(
+        provider.authenticate(httpServerMock.createKibanaRequest({ routeAuthRequired: false }))
+      ).resolves.toEqual(AuthenticationResult.notHandled());
+    });
+
     it('redirects non-AJAX requests that can not be authenticated to the login page.', async () => {
       await expect(
         provider.authenticate(
@@ -172,8 +178,14 @@ describe('BasicAuthenticationProvider', () => {
   });
 
   describe('`logout` method', () => {
-    it('always redirects to the login page.', async () => {
+    it('does not handle logout if state is not present', async () => {
       await expect(provider.logout(httpServerMock.createKibanaRequest())).resolves.toEqual(
+        DeauthenticationResult.notHandled()
+      );
+    });
+
+    it('always redirects to the login page.', async () => {
+      await expect(provider.logout(httpServerMock.createKibanaRequest(), {})).resolves.toEqual(
         DeauthenticationResult.redirectTo('/base-path/login?msg=LOGGED_OUT')
       );
     });
@@ -181,7 +193,10 @@ describe('BasicAuthenticationProvider', () => {
     it('passes query string parameters to the login page.', async () => {
       await expect(
         provider.logout(
-          httpServerMock.createKibanaRequest({ query: { next: '/app/ml', msg: 'SESSION_EXPIRED' } })
+          httpServerMock.createKibanaRequest({
+            query: { next: '/app/ml', msg: 'SESSION_EXPIRED' },
+          }),
+          {}
         )
       ).resolves.toEqual(
         DeauthenticationResult.redirectTo('/base-path/login?next=%2Fapp%2Fml&msg=SESSION_EXPIRED')
diff --git a/x-pack/plugins/security/server/authentication/providers/basic.ts b/x-pack/plugins/security/server/authentication/providers/basic.ts
index ad46aff8afa51..83d4ea689f46a 100644
--- a/x-pack/plugins/security/server/authentication/providers/basic.ts
+++ b/x-pack/plugins/security/server/authentication/providers/basic.ts
@@ -8,7 +8,10 @@ import { KibanaRequest } from '../../../../../../src/core/server';
 import { canRedirectRequest } from '../can_redirect_request';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
-import { getHTTPAuthenticationScheme } from '../get_http_authentication_scheme';
+import {
+  HTTPAuthorizationHeader,
+  BasicHTTPAuthorizationHeaderCredentials,
+} from '../http_authentication';
 import { BaseAuthenticationProvider } from './base';
 
 /**
@@ -31,6 +34,16 @@ interface ProviderState {
   authorization?: string;
 }
 
+/**
+ * Checks whether current request can initiate new session.
+ * @param request Request instance.
+ */
+function canStartNewSession(request: KibanaRequest) {
+  // We should try to establish new session only if request requires authentication and client
+  // can be redirected to the login page where they can enter username and password.
+  return canRedirectRequest(request) && request.route.options.authRequired === true;
+}
+
 /**
  * Provider that supports request authentication via Basic HTTP Authentication.
  */
@@ -54,7 +67,10 @@ export class BasicAuthenticationProvider extends BaseAuthenticationProvider {
     this.logger.debug('Trying to perform a login.');
 
     const authHeaders = {
-      authorization: `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`,
+      authorization: new HTTPAuthorizationHeader(
+        'Basic',
+        new BasicHTTPAuthorizationHeaderCredentials(username, password).toString()
+      ).toString(),
     };
 
     try {
@@ -76,7 +92,7 @@ export class BasicAuthenticationProvider extends BaseAuthenticationProvider {
   public async authenticate(request: KibanaRequest, state?: ProviderState | null) {
     this.logger.debug(`Trying to authenticate user request to ${request.url.path}.`);
 
-    if (getHTTPAuthenticationScheme(request) != null) {
+    if (HTTPAuthorizationHeader.parseFromRequest(request) != null) {
       this.logger.debug('Cannot authenticate requests with `Authorization` header.');
       return AuthenticationResult.notHandled();
     }
@@ -86,7 +102,7 @@ export class BasicAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     // If state isn't present let's redirect user to the login page.
-    if (canRedirectRequest(request)) {
+    if (canStartNewSession(request)) {
       this.logger.debug('Redirecting request to Login page.');
       const basePath = this.options.basePath.get(request);
       return AuthenticationResult.redirectTo(
@@ -100,8 +116,15 @@ export class BasicAuthenticationProvider extends BaseAuthenticationProvider {
   /**
    * Redirects user to the login page preserving query string parameters.
    * @param request Request instance.
+   * @param [state] Optional state object associated with the provider.
    */
-  public async logout(request: KibanaRequest) {
+  public async logout(request: KibanaRequest, state?: ProviderState | null) {
+    this.logger.debug(`Trying to log user out via ${request.url.path}.`);
+
+    if (!state) {
+      return DeauthenticationResult.notHandled();
+    }
+
     // Query string may contain the path where logout has been called or
     // logout reason that login page may need to know.
     const queryString = request.url.search || `?msg=LOGGED_OUT`;
@@ -128,7 +151,7 @@ export class BasicAuthenticationProvider extends BaseAuthenticationProvider {
     this.logger.debug('Trying to authenticate via state.');
 
     if (!authorization) {
-      this.logger.debug('Access token is not found in state.');
+      this.logger.debug('Authorization header is not found in state.');
       return AuthenticationResult.notHandled();
     }
 
diff --git a/x-pack/plugins/security/server/authentication/providers/http.test.ts b/x-pack/plugins/security/server/authentication/providers/http.test.ts
index 65fbd7cd9f4ad..47715670e4697 100644
--- a/x-pack/plugins/security/server/authentication/providers/http.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/http.test.ts
@@ -32,7 +32,7 @@ function expectAuthenticateCall(
 describe('HTTPAuthenticationProvider', () => {
   let mockOptions: MockAuthenticationProviderOptions;
   beforeEach(() => {
-    mockOptions = mockAuthenticationProviderOptions();
+    mockOptions = mockAuthenticationProviderOptions({ name: 'http' });
   });
 
   it('throws if `schemes` are not specified', () => {
diff --git a/x-pack/plugins/security/server/authentication/providers/http.ts b/x-pack/plugins/security/server/authentication/providers/http.ts
index 57163bf8145b8..6b75ae2d48156 100644
--- a/x-pack/plugins/security/server/authentication/providers/http.ts
+++ b/x-pack/plugins/security/server/authentication/providers/http.ts
@@ -7,7 +7,7 @@
 import { KibanaRequest } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
-import { getHTTPAuthenticationScheme } from '../get_http_authentication_scheme';
+import { HTTPAuthorizationHeader } from '../http_authentication';
 import { AuthenticationProviderOptions, BaseAuthenticationProvider } from './base';
 
 interface HTTPAuthenticationProviderOptions {
@@ -38,7 +38,9 @@ export class HTTPAuthenticationProvider extends BaseAuthenticationProvider {
     if ((httpOptions?.supportedSchemes?.size ?? 0) === 0) {
       throw new Error('Supported schemes should be specified');
     }
-    this.supportedSchemes = httpOptions.supportedSchemes;
+    this.supportedSchemes = new Set(
+      [...httpOptions.supportedSchemes].map(scheme => scheme.toLowerCase())
+    );
   }
 
   /**
@@ -56,26 +58,26 @@ export class HTTPAuthenticationProvider extends BaseAuthenticationProvider {
   public async authenticate(request: KibanaRequest) {
     this.logger.debug(`Trying to authenticate user request to ${request.url.path}.`);
 
-    const authenticationScheme = getHTTPAuthenticationScheme(request);
-    if (authenticationScheme == null) {
+    const authorizationHeader = HTTPAuthorizationHeader.parseFromRequest(request);
+    if (authorizationHeader == null) {
       this.logger.debug('Authorization header is not presented.');
       return AuthenticationResult.notHandled();
     }
 
-    if (!this.supportedSchemes.has(authenticationScheme)) {
-      this.logger.debug(`Unsupported authentication scheme: ${authenticationScheme}`);
+    if (!this.supportedSchemes.has(authorizationHeader.scheme.toLowerCase())) {
+      this.logger.debug(`Unsupported authentication scheme: ${authorizationHeader.scheme}`);
       return AuthenticationResult.notHandled();
     }
 
     try {
       const user = await this.getUser(request);
       this.logger.debug(
-        `Request to ${request.url.path} has been authenticated via authorization header with "${authenticationScheme}" scheme.`
+        `Request to ${request.url.path} has been authenticated via authorization header with "${authorizationHeader.scheme}" scheme.`
       );
       return AuthenticationResult.succeeded(user);
     } catch (err) {
       this.logger.debug(
-        `Failed to authenticate request to ${request.url.path} via authorization header with "${authenticationScheme}" scheme: ${err.message}`
+        `Failed to authenticate request to ${request.url.path} via authorization header with "${authorizationHeader.scheme}" scheme: ${err.message}`
       );
       return AuthenticationResult.failed(err);
     }
diff --git a/x-pack/plugins/security/server/authentication/providers/index.ts b/x-pack/plugins/security/server/authentication/providers/index.ts
index cd8f5a70c64e3..048afb6190d18 100644
--- a/x-pack/plugins/security/server/authentication/providers/index.ts
+++ b/x-pack/plugins/security/server/authentication/providers/index.ts
@@ -11,8 +11,8 @@ export {
 } from './base';
 export { BasicAuthenticationProvider } from './basic';
 export { KerberosAuthenticationProvider } from './kerberos';
-export { SAMLAuthenticationProvider, isSAMLRequestQuery, SAMLLoginStep } from './saml';
+export { SAMLAuthenticationProvider, SAMLLogin } from './saml';
 export { TokenAuthenticationProvider } from './token';
-export { OIDCAuthenticationProvider, OIDCAuthenticationFlow } from './oidc';
+export { OIDCAuthenticationProvider, OIDCLogin } from './oidc';
 export { PKIAuthenticationProvider } from './pki';
 export { HTTPAuthenticationProvider } from './http';
diff --git a/x-pack/plugins/security/server/authentication/providers/kerberos.test.ts b/x-pack/plugins/security/server/authentication/providers/kerberos.test.ts
index 955805296e2bd..6eb47cfa83e32 100644
--- a/x-pack/plugins/security/server/authentication/providers/kerberos.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/kerberos.test.ts
@@ -14,6 +14,7 @@ import { MockAuthenticationProviderOptions, mockAuthenticationProviderOptions }
 import {
   ElasticsearchErrorHelpers,
   IClusterClient,
+  KibanaRequest,
   ScopeableRequest,
 } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
@@ -36,43 +37,13 @@ describe('KerberosAuthenticationProvider', () => {
   let provider: KerberosAuthenticationProvider;
   let mockOptions: MockAuthenticationProviderOptions;
   beforeEach(() => {
-    mockOptions = mockAuthenticationProviderOptions();
+    mockOptions = mockAuthenticationProviderOptions({ name: 'kerberos' });
     provider = new KerberosAuthenticationProvider(mockOptions);
   });
 
-  describe('`authenticate` method', () => {
-    it('does not handle authentication via `authorization` header with non-negotiate scheme.', async () => {
-      const request = httpServerMock.createKibanaRequest({
-        headers: { authorization: 'Bearer some-token' },
-      });
-
-      await expect(provider.authenticate(request)).resolves.toEqual(
-        AuthenticationResult.notHandled()
-      );
-
-      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
-      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
-      expect(request.headers.authorization).toBe('Bearer some-token');
-    });
-
-    it('does not handle authentication via `authorization` header with non-negotiate scheme even if state contains a valid token.', async () => {
-      const request = httpServerMock.createKibanaRequest({
-        headers: { authorization: 'Bearer some-token' },
-      });
-      const tokenPair = {
-        accessToken: 'some-valid-token',
-        refreshToken: 'some-valid-refresh-token',
-      };
-
-      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
-        AuthenticationResult.notHandled()
-      );
-
-      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
-      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
-      expect(request.headers.authorization).toBe('Bearer some-token');
-    });
-
+  function defineCommonLoginAndAuthenticateTests(
+    operation: (request: KibanaRequest) => Promise<AuthenticationResult>
+  ) {
     it('does not handle requests that can be authenticated without `Negotiate` header.', async () => {
       const request = httpServerMock.createKibanaRequest({ headers: {} });
 
@@ -80,9 +51,7 @@ describe('KerberosAuthenticationProvider', () => {
       mockScopedClusterClient.callAsCurrentUser.mockResolvedValue({});
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
 
-      await expect(provider.authenticate(request, null)).resolves.toEqual(
-        AuthenticationResult.notHandled()
-      );
+      await expect(operation(request)).resolves.toEqual(AuthenticationResult.notHandled());
 
       expectAuthenticateCall(mockOptions.client, {
         headers: { authorization: `Negotiate ${Buffer.from('__fake__').toString('base64')}` },
@@ -98,33 +67,13 @@ describe('KerberosAuthenticationProvider', () => {
       );
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
 
-      await expect(provider.authenticate(request, null)).resolves.toEqual(
-        AuthenticationResult.notHandled()
-      );
+      await expect(operation(request)).resolves.toEqual(AuthenticationResult.notHandled());
 
       expectAuthenticateCall(mockOptions.client, {
         headers: { authorization: `Negotiate ${Buffer.from('__fake__').toString('base64')}` },
       });
     });
 
-    it('fails if state is present, but backend does not support Kerberos.', async () => {
-      const request = httpServerMock.createKibanaRequest();
-      const tokenPair = { accessToken: 'token', refreshToken: 'refresh-token' };
-
-      const failureReason = ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error());
-      const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
-      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
-      mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
-      mockOptions.tokens.refresh.mockResolvedValue(null);
-
-      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
-        AuthenticationResult.failed(failureReason)
-      );
-
-      expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
-      expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(tokenPair.refreshToken);
-    });
-
     it('fails with `Negotiate` challenge if backend supports Kerberos.', async () => {
       const request = httpServerMock.createKibanaRequest({ headers: {} });
 
@@ -137,7 +86,7 @@ describe('KerberosAuthenticationProvider', () => {
       mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
 
-      await expect(provider.authenticate(request, null)).resolves.toEqual(
+      await expect(operation(request)).resolves.toEqual(
         AuthenticationResult.failed(failureReason, {
           authResponseHeaders: { 'WWW-Authenticate': 'Negotiate' },
         })
@@ -156,9 +105,7 @@ describe('KerberosAuthenticationProvider', () => {
       mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
 
-      await expect(provider.authenticate(request, null)).resolves.toEqual(
-        AuthenticationResult.failed(failureReason)
-      );
+      await expect(operation(request)).resolves.toEqual(AuthenticationResult.failed(failureReason));
 
       expectAuthenticateCall(mockOptions.client, {
         headers: { authorization: `Negotiate ${Buffer.from('__fake__').toString('base64')}` },
@@ -179,7 +126,7 @@ describe('KerberosAuthenticationProvider', () => {
         refresh_token: 'some-refresh-token',
       });
 
-      await expect(provider.authenticate(request)).resolves.toEqual(
+      await expect(operation(request)).resolves.toEqual(
         AuthenticationResult.succeeded(
           { ...user, authentication_provider: 'kerberos' },
           {
@@ -215,7 +162,7 @@ describe('KerberosAuthenticationProvider', () => {
         kerberos_authentication_response_token: 'response-token',
       });
 
-      await expect(provider.authenticate(request)).resolves.toEqual(
+      await expect(operation(request)).resolves.toEqual(
         AuthenticationResult.succeeded(
           { ...user, authentication_provider: 'kerberos' },
           {
@@ -249,7 +196,7 @@ describe('KerberosAuthenticationProvider', () => {
       );
       mockOptions.client.callAsInternalUser.mockRejectedValue(failureReason);
 
-      await expect(provider.authenticate(request)).resolves.toEqual(
+      await expect(operation(request)).resolves.toEqual(
         AuthenticationResult.failed(Boom.unauthorized(), {
           authResponseHeaders: { 'WWW-Authenticate': 'Negotiate response-token' },
         })
@@ -274,7 +221,7 @@ describe('KerberosAuthenticationProvider', () => {
       );
       mockOptions.client.callAsInternalUser.mockRejectedValue(failureReason);
 
-      await expect(provider.authenticate(request)).resolves.toEqual(
+      await expect(operation(request)).resolves.toEqual(
         AuthenticationResult.failed(Boom.unauthorized(), {
           authResponseHeaders: { 'WWW-Authenticate': 'Negotiate' },
         })
@@ -295,9 +242,7 @@ describe('KerberosAuthenticationProvider', () => {
       const failureReason = ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error());
       mockOptions.client.callAsInternalUser.mockRejectedValue(failureReason);
 
-      await expect(provider.authenticate(request)).resolves.toEqual(
-        AuthenticationResult.failed(failureReason)
-      );
+      await expect(operation(request)).resolves.toEqual(AuthenticationResult.failed(failureReason));
 
       expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.getAccessToken', {
         body: { grant_type: '_kerberos', kerberos_ticket: 'spnego' },
@@ -320,9 +265,7 @@ describe('KerberosAuthenticationProvider', () => {
         refresh_token: 'some-refresh-token',
       });
 
-      await expect(provider.authenticate(request)).resolves.toEqual(
-        AuthenticationResult.failed(failureReason)
-      );
+      await expect(operation(request)).resolves.toEqual(AuthenticationResult.failed(failureReason));
 
       expectAuthenticateCall(mockOptions.client, {
         headers: { authorization: 'Bearer some-token' },
@@ -334,6 +277,74 @@ describe('KerberosAuthenticationProvider', () => {
 
       expect(request.headers.authorization).toBe('negotiate spnego');
     });
+  }
+
+  describe('`login` method', () => {
+    defineCommonLoginAndAuthenticateTests(request => provider.login(request));
+  });
+
+  describe('`authenticate` method', () => {
+    defineCommonLoginAndAuthenticateTests(request => provider.authenticate(request, null));
+
+    it('does not handle authentication via `authorization` header with non-negotiate scheme.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        headers: { authorization: 'Bearer some-token' },
+      });
+
+      await expect(provider.authenticate(request)).resolves.toEqual(
+        AuthenticationResult.notHandled()
+      );
+
+      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
+      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
+      expect(request.headers.authorization).toBe('Bearer some-token');
+    });
+
+    it('does not handle authentication via `authorization` header with non-negotiate scheme even if state contains a valid token.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        headers: { authorization: 'Bearer some-token' },
+      });
+      const tokenPair = {
+        accessToken: 'some-valid-token',
+        refreshToken: 'some-valid-refresh-token',
+      };
+
+      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
+        AuthenticationResult.notHandled()
+      );
+
+      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
+      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
+      expect(request.headers.authorization).toBe('Bearer some-token');
+    });
+
+    it('fails if state is present, but backend does not support Kerberos.', async () => {
+      const request = httpServerMock.createKibanaRequest();
+      const tokenPair = { accessToken: 'token', refreshToken: 'refresh-token' };
+
+      const failureReason = ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error());
+      const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
+      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
+      mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
+      mockOptions.tokens.refresh.mockResolvedValue(null);
+
+      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
+        AuthenticationResult.failed(failureReason)
+      );
+
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(tokenPair.refreshToken);
+    });
+
+    it('does not start SPNEGO if request does not require authentication.', async () => {
+      const request = httpServerMock.createKibanaRequest({ routeAuthRequired: false });
+      await expect(provider.authenticate(request)).resolves.toEqual(
+        AuthenticationResult.notHandled()
+      );
+
+      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
+      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
+    });
 
     it('succeeds if state contains a valid token.', async () => {
       const user = mockAuthenticatedUser();
@@ -454,6 +465,29 @@ describe('KerberosAuthenticationProvider', () => {
       expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
       expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(tokenPair.refreshToken);
     });
+
+    it('does not re-start SPNEGO if both access and refresh tokens from the state are expired.', async () => {
+      const request = httpServerMock.createKibanaRequest({ routeAuthRequired: false });
+      const tokenPair = { accessToken: 'expired-token', refreshToken: 'some-valid-refresh-token' };
+
+      const failureReason = ElasticsearchErrorHelpers.decorateNotAuthorizedError(
+        new (errors.AuthenticationException as any)('Unauthorized', {
+          body: { error: { header: { 'WWW-Authenticate': 'Negotiate' } } },
+        })
+      );
+      const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
+      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
+      mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
+
+      mockOptions.tokens.refresh.mockResolvedValue(null);
+
+      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
+        AuthenticationResult.notHandled()
+      );
+
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(tokenPair.refreshToken);
+    });
   });
 
   describe('`logout` method', () => {
diff --git a/x-pack/plugins/security/server/authentication/providers/kerberos.ts b/x-pack/plugins/security/server/authentication/providers/kerberos.ts
index 632a07ca2b21a..c4bbe554a3da1 100644
--- a/x-pack/plugins/security/server/authentication/providers/kerberos.ts
+++ b/x-pack/plugins/security/server/authentication/providers/kerberos.ts
@@ -12,7 +12,7 @@ import {
 } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
-import { getHTTPAuthenticationScheme } from '../get_http_authentication_scheme';
+import { HTTPAuthorizationHeader } from '../http_authentication';
 import { Tokens, TokenPair } from '../tokens';
 import { BaseAuthenticationProvider } from './base';
 
@@ -27,6 +27,15 @@ type ProviderState = TokenPair;
  */
 const WWWAuthenticateHeaderName = 'WWW-Authenticate';
 
+/**
+ * Checks whether current request can initiate new session.
+ * @param request Request instance.
+ */
+function canStartNewSession(request: KibanaRequest) {
+  // We should try to establish new session only if request requires authentication.
+  return request.route.options.authRequired === true;
+}
+
 /**
  * Provider that supports Kerberos request authentication.
  */
@@ -36,6 +45,20 @@ export class KerberosAuthenticationProvider extends BaseAuthenticationProvider {
    */
   static readonly type = 'kerberos';
 
+  /**
+   * Performs initial login request.
+   * @param request Request instance.
+   */
+  public async login(request: KibanaRequest) {
+    this.logger.debug('Trying to perform a login.');
+
+    if (HTTPAuthorizationHeader.parseFromRequest(request)?.scheme.toLowerCase() === 'negotiate') {
+      return await this.authenticateWithNegotiateScheme(request);
+    }
+
+    return await this.authenticateViaSPNEGO(request);
+  }
+
   /**
    * Performs Kerberos request authentication.
    * @param request Request instance.
@@ -44,13 +67,13 @@ export class KerberosAuthenticationProvider extends BaseAuthenticationProvider {
   public async authenticate(request: KibanaRequest, state?: ProviderState | null) {
     this.logger.debug(`Trying to authenticate user request to ${request.url.path}.`);
 
-    const authenticationScheme = getHTTPAuthenticationScheme(request);
-    if (authenticationScheme && authenticationScheme !== 'negotiate') {
-      this.logger.debug(`Unsupported authentication scheme: ${authenticationScheme}`);
+    const authorizationHeader = HTTPAuthorizationHeader.parseFromRequest(request);
+    if (authorizationHeader && authorizationHeader.scheme.toLowerCase() !== 'negotiate') {
+      this.logger.debug(`Unsupported authentication scheme: ${authorizationHeader.scheme}`);
       return AuthenticationResult.notHandled();
     }
 
-    let authenticationResult = authenticationScheme
+    let authenticationResult = authorizationHeader
       ? await this.authenticateWithNegotiateScheme(request)
       : AuthenticationResult.notHandled();
 
@@ -66,7 +89,7 @@ export class KerberosAuthenticationProvider extends BaseAuthenticationProvider {
 
     // If we couldn't authenticate by means of all methods above, let's try to check if Elasticsearch can
     // start authentication mechanism negotiation, otherwise just return authentication result we have.
-    return authenticationResult.notHandled()
+    return authenticationResult.notHandled() && canStartNewSession(request)
       ? await this.authenticateViaSPNEGO(request, state)
       : authenticationResult;
   }
@@ -175,7 +198,9 @@ export class KerberosAuthenticationProvider extends BaseAuthenticationProvider {
 
     try {
       // Then attempt to query for the user details using the new token
-      const authHeaders = { authorization: `Bearer ${tokens.access_token}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader('Bearer', tokens.access_token).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('User has been authenticated with new access token');
@@ -205,7 +230,9 @@ export class KerberosAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     try {
-      const authHeaders = { authorization: `Bearer ${accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader('Bearer', accessToken).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Request has been authenticated via state.');
@@ -235,14 +262,19 @@ export class KerberosAuthenticationProvider extends BaseAuthenticationProvider {
 
     // If refresh token is no longer valid, then we should clear session and renegotiate using SPNEGO.
     if (refreshedTokenPair === null) {
-      this.logger.debug(
-        'Both access and refresh tokens are expired. Re-initiating SPNEGO handshake.'
-      );
-      return this.authenticateViaSPNEGO(request, state);
+      this.logger.debug('Both access and refresh tokens are expired.');
+      return canStartNewSession(request)
+        ? this.authenticateViaSPNEGO(request, state)
+        : AuthenticationResult.notHandled();
     }
 
     try {
-      const authHeaders = { authorization: `Bearer ${refreshedTokenPair.accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader(
+          'Bearer',
+          refreshedTokenPair.accessToken
+        ).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Request has been authenticated via refreshed token.');
diff --git a/x-pack/plugins/security/server/authentication/providers/oidc.test.ts b/x-pack/plugins/security/server/authentication/providers/oidc.test.ts
index 6a4ba1ccb41e2..14fe42aac7599 100644
--- a/x-pack/plugins/security/server/authentication/providers/oidc.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/oidc.test.ts
@@ -18,7 +18,7 @@ import {
 } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
-import { OIDCAuthenticationProvider, OIDCAuthenticationFlow, ProviderLoginAttempt } from './oidc';
+import { OIDCAuthenticationProvider, OIDCLogin, ProviderLoginAttempt } from './oidc';
 
 function expectAuthenticateCall(
   mockClusterClient: jest.Mocked<IClusterClient>,
@@ -36,7 +36,7 @@ describe('OIDCAuthenticationProvider', () => {
   let provider: OIDCAuthenticationProvider;
   let mockOptions: MockAuthenticationProviderOptions;
   beforeEach(() => {
-    mockOptions = mockAuthenticationProviderOptions();
+    mockOptions = mockAuthenticationProviderOptions({ name: 'oidc' });
     provider = new OIDCAuthenticationProvider(mockOptions, { realm: 'oidc1' });
   });
 
@@ -72,7 +72,7 @@ describe('OIDCAuthenticationProvider', () => {
 
       await expect(
         provider.login(request, {
-          flow: OIDCAuthenticationFlow.InitiatedBy3rdParty,
+          type: OIDCLogin.LoginInitiatedBy3rdParty,
           iss: 'theissuer',
           loginHint: 'loginhint',
         })
@@ -84,7 +84,14 @@ describe('OIDCAuthenticationProvider', () => {
             '&state=statevalue' +
             '&redirect_uri=https%3A%2F%2Ftest-hostname:1234%2Ftest-base-path%2Fapi%2Fsecurity%2Fv1%2F/oidc' +
             '&login_hint=loginhint',
-          { state: { state: 'statevalue', nonce: 'noncevalue', nextURL: '/base-path/' } }
+          {
+            state: {
+              state: 'statevalue',
+              nonce: 'noncevalue',
+              nextURL: '/mock-server-basepath/',
+              realm: 'oidc1',
+            },
+          }
         )
       );
 
@@ -93,6 +100,50 @@ describe('OIDCAuthenticationProvider', () => {
       });
     });
 
+    it('redirects user initiated login attempts to the OpenId Connect Provider.', async () => {
+      const request = httpServerMock.createKibanaRequest();
+
+      mockOptions.client.callAsInternalUser.mockResolvedValue({
+        state: 'statevalue',
+        nonce: 'noncevalue',
+        redirect:
+          'https://op-host/path/login?response_type=code' +
+          '&scope=openid%20profile%20email' +
+          '&client_id=s6BhdRkqt3' +
+          '&state=statevalue' +
+          '&redirect_uri=https%3A%2F%2Ftest-hostname:1234%2Ftest-base-path%2Fapi%2Fsecurity%2Fv1%2F/oidc' +
+          '&login_hint=loginhint',
+      });
+
+      await expect(
+        provider.login(request, {
+          type: OIDCLogin.LoginInitiatedByUser,
+          redirectURLPath: '/mock-server-basepath/app/super-kibana',
+        })
+      ).resolves.toEqual(
+        AuthenticationResult.redirectTo(
+          'https://op-host/path/login?response_type=code' +
+            '&scope=openid%20profile%20email' +
+            '&client_id=s6BhdRkqt3' +
+            '&state=statevalue' +
+            '&redirect_uri=https%3A%2F%2Ftest-hostname:1234%2Ftest-base-path%2Fapi%2Fsecurity%2Fv1%2F/oidc' +
+            '&login_hint=loginhint',
+          {
+            state: {
+              state: 'statevalue',
+              nonce: 'noncevalue',
+              nextURL: '/mock-server-basepath/app/super-kibana',
+              realm: 'oidc1',
+            },
+          }
+        )
+      );
+
+      expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.oidcPrepare', {
+        body: { realm: 'oidc1' },
+      });
+    });
+
     function defineAuthenticationFlowTests(
       getMocks: () => {
         request: KibanaRequest;
@@ -113,10 +164,15 @@ describe('OIDCAuthenticationProvider', () => {
             state: 'statevalue',
             nonce: 'noncevalue',
             nextURL: '/base-path/some-path',
+            realm: 'oidc1',
           })
         ).resolves.toEqual(
           AuthenticationResult.redirectTo('/base-path/some-path', {
-            state: { accessToken: 'some-token', refreshToken: 'some-refresh-token' },
+            state: {
+              accessToken: 'some-token',
+              refreshToken: 'some-refresh-token',
+              realm: 'oidc1',
+            },
           })
         );
 
@@ -137,7 +193,7 @@ describe('OIDCAuthenticationProvider', () => {
         const { request, attempt } = getMocks();
 
         await expect(
-          provider.login(request, attempt, { nextURL: '/base-path/some-path' })
+          provider.login(request, attempt, { nextURL: '/base-path/some-path', realm: 'oidc1' })
         ).resolves.toEqual(
           AuthenticationResult.failed(
             Boom.badRequest(
@@ -153,7 +209,11 @@ describe('OIDCAuthenticationProvider', () => {
         const { request, attempt } = getMocks();
 
         await expect(
-          provider.login(request, attempt, { state: 'statevalue', nonce: 'noncevalue' })
+          provider.login(request, attempt, {
+            state: 'statevalue',
+            nonce: 'noncevalue',
+            realm: 'oidc1',
+          })
         ).resolves.toEqual(
           AuthenticationResult.failed(
             Boom.badRequest(
@@ -168,7 +228,7 @@ describe('OIDCAuthenticationProvider', () => {
       it('fails if session state is not presented.', async () => {
         const { request, attempt } = getMocks();
 
-        await expect(provider.login(request, attempt, {})).resolves.toEqual(
+        await expect(provider.login(request, attempt, {} as any)).resolves.toEqual(
           AuthenticationResult.failed(
             Boom.badRequest(
               'Response session state does not have corresponding state or nonce parameters or redirect URL.'
@@ -192,6 +252,7 @@ describe('OIDCAuthenticationProvider', () => {
             state: 'statevalue',
             nonce: 'noncevalue',
             nextURL: '/base-path/some-path',
+            realm: 'oidc1',
           })
         ).resolves.toEqual(AuthenticationResult.failed(failureReason));
 
@@ -207,6 +268,20 @@ describe('OIDCAuthenticationProvider', () => {
           }
         );
       });
+
+      it('fails if realm from state is different from the realm provider is configured with.', async () => {
+        const { request, attempt } = getMocks();
+
+        await expect(provider.login(request, attempt, { realm: 'other-realm' })).resolves.toEqual(
+          AuthenticationResult.failed(
+            Boom.unauthorized(
+              'State based on realm "other-realm", but provider with the name "oidc" is configured to use realm "oidc1".'
+            )
+          )
+        );
+
+        expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
+      });
     }
 
     describe('authorization code flow', () => {
@@ -215,7 +290,7 @@ describe('OIDCAuthenticationProvider', () => {
           path: '/api/security/oidc/callback?code=somecodehere&state=somestatehere',
         }),
         attempt: {
-          flow: OIDCAuthenticationFlow.AuthorizationCode,
+          type: OIDCLogin.LoginWithAuthorizationCodeFlow,
           authenticationResponseURI:
             '/api/security/oidc/callback?code=somecodehere&state=somestatehere',
         },
@@ -230,7 +305,7 @@ describe('OIDCAuthenticationProvider', () => {
             '/api/security/oidc/callback?authenticationResponseURI=http://kibana/api/security/oidc/implicit#id_token=sometoken',
         }),
         attempt: {
-          flow: OIDCAuthenticationFlow.Implicit,
+          type: OIDCLogin.LoginWithImplicitFlow,
           authenticationResponseURI: 'http://kibana/api/security/oidc/implicit#id_token=sometoken',
         },
         expectedRedirectURI: 'http://kibana/api/security/oidc/implicit#id_token=sometoken',
@@ -246,6 +321,13 @@ describe('OIDCAuthenticationProvider', () => {
       );
     });
 
+    it('does not handle non-AJAX request that does not require authentication.', async () => {
+      const request = httpServerMock.createKibanaRequest({ routeAuthRequired: false });
+      await expect(provider.authenticate(request)).resolves.toEqual(
+        AuthenticationResult.notHandled()
+      );
+    });
+
     it('redirects non-AJAX request that can not be authenticated to the OpenId Connect Provider.', async () => {
       const request = httpServerMock.createKibanaRequest({ path: '/s/foo/some-path' });
 
@@ -272,6 +354,7 @@ describe('OIDCAuthenticationProvider', () => {
               state: 'statevalue',
               nonce: 'noncevalue',
               nextURL: '/base-path/s/foo/some-path',
+              realm: 'oidc1',
             },
           }
         )
@@ -310,7 +393,9 @@ describe('OIDCAuthenticationProvider', () => {
       mockScopedClusterClient.callAsCurrentUser.mockResolvedValue(user);
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
 
-      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
+      await expect(
+        provider.authenticate(request, { ...tokenPair, realm: 'oidc1' })
+      ).resolves.toEqual(
         AuthenticationResult.succeeded(
           { ...user, authentication_provider: 'oidc' },
           { authHeaders: { authorization } }
@@ -344,6 +429,7 @@ describe('OIDCAuthenticationProvider', () => {
         provider.authenticate(request, {
           accessToken: 'some-valid-token',
           refreshToken: 'some-valid-refresh-token',
+          realm: 'oidc1',
         })
       ).resolves.toEqual(AuthenticationResult.notHandled());
 
@@ -364,9 +450,9 @@ describe('OIDCAuthenticationProvider', () => {
       mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
 
-      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
-        AuthenticationResult.failed(failureReason)
-      );
+      await expect(
+        provider.authenticate(request, { ...tokenPair, realm: 'oidc1' })
+      ).resolves.toEqual(AuthenticationResult.failed(failureReason));
 
       expectAuthenticateCall(mockOptions.client, { headers: { authorization } });
 
@@ -401,12 +487,18 @@ describe('OIDCAuthenticationProvider', () => {
         refreshToken: 'new-refresh-token',
       });
 
-      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
+      await expect(
+        provider.authenticate(request, { ...tokenPair, realm: 'oidc1' })
+      ).resolves.toEqual(
         AuthenticationResult.succeeded(
           { ...user, authentication_provider: 'oidc' },
           {
             authHeaders: { authorization: 'Bearer new-access-token' },
-            state: { accessToken: 'new-access-token', refreshToken: 'new-refresh-token' },
+            state: {
+              accessToken: 'new-access-token',
+              refreshToken: 'new-refresh-token',
+              realm: 'oidc1',
+            },
           }
         )
       );
@@ -434,9 +526,9 @@ describe('OIDCAuthenticationProvider', () => {
       };
       mockOptions.tokens.refresh.mockRejectedValue(refreshFailureReason);
 
-      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
-        AuthenticationResult.failed(refreshFailureReason as any)
-      );
+      await expect(
+        provider.authenticate(request, { ...tokenPair, realm: 'oidc1' })
+      ).resolves.toEqual(AuthenticationResult.failed(refreshFailureReason as any));
 
       expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
       expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(tokenPair.refreshToken);
@@ -470,7 +562,9 @@ describe('OIDCAuthenticationProvider', () => {
 
       mockOptions.tokens.refresh.mockResolvedValue(null);
 
-      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
+      await expect(
+        provider.authenticate(request, { ...tokenPair, realm: 'oidc1' })
+      ).resolves.toEqual(
         AuthenticationResult.redirectTo(
           'https://op-host/path/login?response_type=code' +
             '&scope=openid%20profile%20email' +
@@ -482,6 +576,7 @@ describe('OIDCAuthenticationProvider', () => {
               state: 'statevalue',
               nonce: 'noncevalue',
               nextURL: '/base-path/s/foo/some-path',
+              realm: 'oidc1',
             },
           }
         )
@@ -515,7 +610,9 @@ describe('OIDCAuthenticationProvider', () => {
 
       mockOptions.tokens.refresh.mockResolvedValue(null);
 
-      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
+      await expect(
+        provider.authenticate(request, { ...tokenPair, realm: 'oidc1' })
+      ).resolves.toEqual(
         AuthenticationResult.failed(Boom.badRequest('Both access and refresh tokens are expired.'))
       );
 
@@ -528,6 +625,44 @@ describe('OIDCAuthenticationProvider', () => {
 
       expect(request.headers).not.toHaveProperty('authorization');
     });
+
+    it('fails for non-AJAX requests that do not require authentication with user friendly message if refresh token is expired.', async () => {
+      const request = httpServerMock.createKibanaRequest({ routeAuthRequired: false, headers: {} });
+      const tokenPair = { accessToken: 'expired-token', refreshToken: 'expired-refresh-token' };
+      const authorization = `Bearer ${tokenPair.accessToken}`;
+
+      const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
+      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(
+        ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error())
+      );
+      mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
+
+      mockOptions.tokens.refresh.mockResolvedValue(null);
+
+      await expect(
+        provider.authenticate(request, { ...tokenPair, realm: 'oidc1' })
+      ).resolves.toEqual(
+        AuthenticationResult.failed(Boom.badRequest('Both access and refresh tokens are expired.'))
+      );
+
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(tokenPair.refreshToken);
+
+      expectAuthenticateCall(mockOptions.client, { headers: { authorization } });
+
+      expect(request.headers).not.toHaveProperty('authorization');
+    });
+
+    it('fails if realm from state is different from the realm provider is configured with.', async () => {
+      const request = httpServerMock.createKibanaRequest();
+      await expect(provider.authenticate(request, { realm: 'other-realm' })).resolves.toEqual(
+        AuthenticationResult.failed(
+          Boom.unauthorized(
+            'State based on realm "other-realm", but provider with the name "oidc" is configured to use realm "oidc1".'
+          )
+        )
+      );
+    });
   });
 
   describe('`logout` method', () => {
@@ -538,11 +673,11 @@ describe('OIDCAuthenticationProvider', () => {
         DeauthenticationResult.notHandled()
       );
 
-      await expect(provider.logout(request, {})).resolves.toEqual(
+      await expect(provider.logout(request, {} as any)).resolves.toEqual(
         DeauthenticationResult.notHandled()
       );
 
-      await expect(provider.logout(request, { nonce: 'x' })).resolves.toEqual(
+      await expect(provider.logout(request, { nonce: 'x', realm: 'oidc1' })).resolves.toEqual(
         DeauthenticationResult.notHandled()
       );
 
@@ -557,9 +692,9 @@ describe('OIDCAuthenticationProvider', () => {
       const failureReason = new Error('Realm is misconfigured!');
       mockOptions.client.callAsInternalUser.mockRejectedValue(failureReason);
 
-      await expect(provider.logout(request, { accessToken, refreshToken })).resolves.toEqual(
-        DeauthenticationResult.failed(failureReason)
-      );
+      await expect(
+        provider.logout(request, { accessToken, refreshToken, realm: 'oidc1' })
+      ).resolves.toEqual(DeauthenticationResult.failed(failureReason));
 
       expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledTimes(1);
       expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.oidcLogout', {
@@ -574,7 +709,9 @@ describe('OIDCAuthenticationProvider', () => {
 
       mockOptions.client.callAsInternalUser.mockResolvedValue({ redirect: null });
 
-      await expect(provider.logout(request, { accessToken, refreshToken })).resolves.toEqual(
+      await expect(
+        provider.logout(request, { accessToken, refreshToken, realm: 'oidc1' })
+      ).resolves.toEqual(
         DeauthenticationResult.redirectTo('/mock-server-basepath/security/logged_out')
       );
 
@@ -593,7 +730,9 @@ describe('OIDCAuthenticationProvider', () => {
         redirect: 'http://fake-idp/logout&id_token_hint=thehint',
       });
 
-      await expect(provider.logout(request, { accessToken, refreshToken })).resolves.toEqual(
+      await expect(
+        provider.logout(request, { accessToken, refreshToken, realm: 'oidc1' })
+      ).resolves.toEqual(
         DeauthenticationResult.redirectTo('http://fake-idp/logout&id_token_hint=thehint')
       );
 
diff --git a/x-pack/plugins/security/server/authentication/providers/oidc.ts b/x-pack/plugins/security/server/authentication/providers/oidc.ts
index d52466826c2be..f8e6ac0f9b5d0 100644
--- a/x-pack/plugins/security/server/authentication/providers/oidc.ts
+++ b/x-pack/plugins/security/server/authentication/providers/oidc.ts
@@ -10,7 +10,7 @@ import { KibanaRequest } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { canRedirectRequest } from '../can_redirect_request';
 import { DeauthenticationResult } from '../deauthentication_result';
-import { getHTTPAuthenticationScheme } from '../get_http_authentication_scheme';
+import { HTTPAuthorizationHeader } from '../http_authentication';
 import { Tokens, TokenPair } from '../tokens';
 import {
   AuthenticationProviderOptions,
@@ -19,23 +19,25 @@ import {
 } from './base';
 
 /**
- * Describes possible OpenID Connect authentication flows.
+ * Describes possible OpenID Connect login flows.
  */
-export enum OIDCAuthenticationFlow {
-  Implicit = 'implicit',
-  AuthorizationCode = 'authorization-code',
-  InitiatedBy3rdParty = 'initiated-by-3rd-party',
+export enum OIDCLogin {
+  LoginInitiatedByUser = 'login-by-user',
+  LoginWithImplicitFlow = 'login-implicit',
+  LoginWithAuthorizationCodeFlow = 'login-authorization-code',
+  LoginInitiatedBy3rdParty = 'login-initiated-by-3rd-party',
 }
 
 /**
  * Describes the parameters that are required by the provider to process the initial login request.
  */
 export type ProviderLoginAttempt =
+  | { type: OIDCLogin.LoginInitiatedByUser; redirectURLPath: string }
   | {
-      flow: OIDCAuthenticationFlow.Implicit | OIDCAuthenticationFlow.AuthorizationCode;
+      type: OIDCLogin.LoginWithImplicitFlow | OIDCLogin.LoginWithAuthorizationCodeFlow;
       authenticationResponseURI: string;
     }
-  | { flow: OIDCAuthenticationFlow.InitiatedBy3rdParty; iss: string; loginHint?: string };
+  | { type: OIDCLogin.LoginInitiatedBy3rdParty; iss: string; loginHint?: string };
 
 /**
  * The state supported by the provider (for the OpenID Connect handshake or established session).
@@ -57,6 +59,21 @@ interface ProviderState extends Partial<TokenPair> {
    * URL to redirect user to after successful OpenID Connect handshake.
    */
   nextURL?: string;
+
+  /**
+   * The name of the OpenID Connect realm that was used to establish session.
+   */
+  realm: string;
+}
+
+/**
+ * Checks whether current request can initiate new session.
+ * @param request Request instance.
+ */
+function canStartNewSession(request: KibanaRequest) {
+  // We should try to establish new session only if request requires authentication and client
+  // can be redirected to the Identity Provider where they can authenticate.
+  return canRedirectRequest(request) && request.route.options.authRequired === true;
 }
 
 /**
@@ -102,15 +119,38 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
   ) {
     this.logger.debug('Trying to perform a login.');
 
-    if (attempt.flow === OIDCAuthenticationFlow.InitiatedBy3rdParty) {
-      this.logger.debug('Authentication has been initiated by a Third Party.');
+    // It may happen that Kibana is re-configured to use different realm for the same provider name,
+    // we should clear such session an log user out.
+    if (state?.realm && state.realm !== this.realm) {
+      const message = `State based on realm "${state.realm}", but provider with the name "${this.options.name}" is configured to use realm "${this.realm}".`;
+      this.logger.debug(message);
+      return AuthenticationResult.failed(Boom.unauthorized(message));
+    }
+
+    if (attempt.type === OIDCLogin.LoginInitiatedBy3rdParty) {
+      this.logger.debug('Login has been initiated by a Third Party.');
       // We might already have a state and nonce generated by Elasticsearch (from an unfinished authentication in
       // another tab)
       const oidcPrepareParams = attempt.loginHint
         ? { iss: attempt.iss, login_hint: attempt.loginHint }
         : { iss: attempt.iss };
-      return this.initiateOIDCAuthentication(request, oidcPrepareParams);
-    } else if (attempt.flow === OIDCAuthenticationFlow.Implicit) {
+      return this.initiateOIDCAuthentication(
+        request,
+        oidcPrepareParams,
+        `${this.options.basePath.serverBasePath}/`
+      );
+    }
+
+    if (attempt.type === OIDCLogin.LoginInitiatedByUser) {
+      this.logger.debug(`Login has been initiated by a user.`);
+      return this.initiateOIDCAuthentication(
+        request,
+        { realm: this.realm },
+        attempt.redirectURLPath
+      );
+    }
+
+    if (attempt.type === OIDCLogin.LoginWithImplicitFlow) {
       this.logger.debug('OpenID Connect Implicit Authentication flow is used.');
     } else {
       this.logger.debug('OpenID Connect Authorization Code Authentication flow is used.');
@@ -131,11 +171,19 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
   public async authenticate(request: KibanaRequest, state?: ProviderState | null) {
     this.logger.debug(`Trying to authenticate user request to ${request.url.path}.`);
 
-    if (getHTTPAuthenticationScheme(request) != null) {
+    if (HTTPAuthorizationHeader.parseFromRequest(request) != null) {
       this.logger.debug('Cannot authenticate requests with `Authorization` header.');
       return AuthenticationResult.notHandled();
     }
 
+    // It may happen that Kibana is re-configured to use different realm for the same provider name,
+    // we should clear such session an log user out.
+    if (state?.realm && state.realm !== this.realm) {
+      const message = `State based on realm "${state.realm}", but provider with the name "${this.options.name}" is configured to use realm "${this.realm}".`;
+      this.logger.debug(message);
+      return AuthenticationResult.failed(Boom.unauthorized(message));
+    }
+
     let authenticationResult = AuthenticationResult.notHandled();
     if (state) {
       authenticationResult = await this.authenticateViaState(request, state);
@@ -151,7 +199,7 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
     // initiate an OpenID Connect based authentication, otherwise just return the authentication result we have.
     // We might already have a state and nonce generated by Elasticsearch (from an unfinished authentication in
     // another tab)
-    return authenticationResult.notHandled()
+    return authenticationResult.notHandled() && canStartNewSession(request)
       ? await this.initiateOIDCAuthentication(request, { realm: this.realm })
       : authenticationResult;
   }
@@ -211,7 +259,7 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
       this.logger.debug('Request has been authenticated via OpenID Connect.');
 
       return AuthenticationResult.redirectTo(stateRedirectURL, {
-        state: { accessToken, refreshToken },
+        state: { accessToken, refreshToken, realm: this.realm },
       });
     } catch (err) {
       this.logger.debug(`Failed to authenticate request via OpenID Connect: ${err.message}`);
@@ -224,49 +272,30 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
    *
    * @param request Request instance.
    * @param params OIDC authentication parameters.
-   * @param [sessionState] Optional state object associated with the provider.
+   * @param [redirectURLPath] Optional URL user is supposed to be redirected to after successful
+   * login. If not provided the URL of the specified request is used.
    */
   private async initiateOIDCAuthentication(
     request: KibanaRequest,
     params: { realm: string } | { iss: string; login_hint?: string },
-    sessionState?: ProviderState | null
+    redirectURLPath = `${this.options.basePath.get(request)}${request.url.path}`
   ) {
     this.logger.debug('Trying to initiate OpenID Connect authentication.');
 
-    // If client can't handle redirect response, we shouldn't initiate OpenID Connect authentication.
-    if (!canRedirectRequest(request)) {
-      this.logger.debug('OpenID Connect authentication can not be initiated by AJAX requests.');
-      return AuthenticationResult.notHandled();
-    }
-
     try {
-      /*
-       * Possibly adds the state and nonce parameter that was saved in the user's session state to
-       * the params. There is no use case where we would have only a state parameter or only a nonce
-       * parameter in the session state so we only enrich the params object if we have both
-       */
-      const oidcPrepareParams =
-        sessionState && sessionState.nonce && sessionState.state
-          ? { ...params, nonce: sessionState.nonce, state: sessionState.state }
-          : params;
       // This operation should be performed on behalf of the user with a privilege that normal
       // user usually doesn't have `cluster:admin/xpack/security/oidc/prepare`.
-      const { state, nonce, redirect } = await this.options.client.callAsInternalUser(
-        'shield.oidcPrepare',
-        {
-          body: oidcPrepareParams,
-        }
-      );
+      const {
+        state,
+        nonce,
+        redirect,
+      } = await this.options.client.callAsInternalUser('shield.oidcPrepare', { body: params });
 
       this.logger.debug('Redirecting to OpenID Connect Provider with authentication request.');
-      // If this is a third party initiated login, redirect to the base path
-      const redirectAfterLogin = `${this.options.basePath.get(request)}${
-        'iss' in params ? '/' : request.url.path
-      }`;
       return AuthenticationResult.redirectTo(
         redirect,
         // Store the state and nonce parameters in the session state of the user
-        { state: { state, nonce, nextURL: redirectAfterLogin } }
+        { state: { state, nonce, nextURL: redirectURLPath, realm: this.realm } }
       );
     } catch (err) {
       this.logger.debug(`Failed to initiate OpenID Connect authentication: ${err.message}`);
@@ -289,7 +318,9 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     try {
-      const authHeaders = { authorization: `Bearer ${accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader('Bearer', accessToken).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Request has been authenticated via state.');
@@ -332,7 +363,7 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
     // seems logical to do the same on Kibana side and `401` would force user to logout and do full SLO if it's
     // supported.
     if (refreshedTokenPair === null) {
-      if (canRedirectRequest(request)) {
+      if (canStartNewSession(request)) {
         this.logger.debug(
           'Both elasticsearch access and refresh tokens are expired. Re-initiating OpenID Connect authentication.'
         );
@@ -345,11 +376,19 @@ export class OIDCAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     try {
-      const authHeaders = { authorization: `Bearer ${refreshedTokenPair.accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader(
+          'Bearer',
+          refreshedTokenPair.accessToken
+        ).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Request has been authenticated via refreshed token.');
-      return AuthenticationResult.succeeded(user, { authHeaders, state: refreshedTokenPair });
+      return AuthenticationResult.succeeded(user, {
+        authHeaders,
+        state: { ...refreshedTokenPair, realm: this.realm },
+      });
     } catch (err) {
       this.logger.debug(`Failed to refresh elasticsearch access token: ${err.message}`);
       return AuthenticationResult.failed(err);
diff --git a/x-pack/plugins/security/server/authentication/providers/pki.test.ts b/x-pack/plugins/security/server/authentication/providers/pki.test.ts
index 044416032a4c3..638bb5732f3c0 100644
--- a/x-pack/plugins/security/server/authentication/providers/pki.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/pki.test.ts
@@ -19,6 +19,7 @@ import { MockAuthenticationProviderOptions, mockAuthenticationProviderOptions }
 import {
   ElasticsearchErrorHelpers,
   IClusterClient,
+  KibanaRequest,
   ScopeableRequest,
 } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
@@ -78,53 +79,21 @@ describe('PKIAuthenticationProvider', () => {
   let provider: PKIAuthenticationProvider;
   let mockOptions: MockAuthenticationProviderOptions;
   beforeEach(() => {
-    mockOptions = mockAuthenticationProviderOptions();
+    mockOptions = mockAuthenticationProviderOptions({ name: 'pki' });
     provider = new PKIAuthenticationProvider(mockOptions);
   });
 
   afterEach(() => jest.clearAllMocks());
 
-  describe('`authenticate` method', () => {
-    it('does not handle authentication via `authorization` header.', async () => {
-      const request = httpServerMock.createKibanaRequest({
-        headers: { authorization: 'Bearer some-token' },
-      });
-
-      await expect(provider.authenticate(request)).resolves.toEqual(
-        AuthenticationResult.notHandled()
-      );
-
-      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
-      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
-      expect(request.headers.authorization).toBe('Bearer some-token');
-    });
-
-    it('does not handle authentication via `authorization` header even if state contains a valid token.', async () => {
-      const request = httpServerMock.createKibanaRequest({
-        headers: { authorization: 'Bearer some-token' },
-      });
-      const state = {
-        accessToken: 'some-valid-token',
-        peerCertificateFingerprint256: '2A:7A:C2:DD',
-      };
-
-      await expect(provider.authenticate(request, state)).resolves.toEqual(
-        AuthenticationResult.notHandled()
-      );
-
-      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
-      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
-      expect(request.headers.authorization).toBe('Bearer some-token');
-    });
-
+  function defineCommonLoginAndAuthenticateTests(
+    operation: (request: KibanaRequest) => Promise<AuthenticationResult>
+  ) {
     it('does not handle requests without certificate.', async () => {
       const request = httpServerMock.createKibanaRequest({
         socket: getMockSocket({ authorized: true }),
       });
 
-      await expect(provider.authenticate(request, null)).resolves.toEqual(
-        AuthenticationResult.notHandled()
-      );
+      await expect(operation(request)).resolves.toEqual(AuthenticationResult.notHandled());
 
       expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
       expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
@@ -135,58 +104,12 @@ describe('PKIAuthenticationProvider', () => {
         socket: getMockSocket({ peerCertificate: getMockPeerCertificate('2A:7A:C2:DD') }),
       });
 
-      await expect(provider.authenticate(request, null)).resolves.toEqual(
-        AuthenticationResult.notHandled()
-      );
+      await expect(operation(request)).resolves.toEqual(AuthenticationResult.notHandled());
 
       expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
       expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
     });
 
-    it('fails with non-401 error if state is available, peer is authorized, but certificate is not available.', async () => {
-      const request = httpServerMock.createKibanaRequest({
-        socket: getMockSocket({ authorized: true }),
-      });
-
-      const state = { accessToken: 'token', peerCertificateFingerprint256: '2A:7A:C2:DD' };
-
-      await expect(provider.authenticate(request, state)).resolves.toEqual(
-        AuthenticationResult.failed(new Error('Peer certificate is not available'))
-      );
-
-      expect(mockOptions.tokens.invalidate).not.toHaveBeenCalled();
-    });
-
-    it('invalidates token and fails with 401 if state is present, but peer certificate is not.', async () => {
-      const request = httpServerMock.createKibanaRequest({ socket: getMockSocket() });
-      const state = { accessToken: 'token', peerCertificateFingerprint256: '2A:7A:C2:DD' };
-
-      await expect(provider.authenticate(request, state)).resolves.toEqual(
-        AuthenticationResult.failed(Boom.unauthorized())
-      );
-
-      expect(mockOptions.tokens.invalidate).toHaveBeenCalledTimes(1);
-      expect(mockOptions.tokens.invalidate).toHaveBeenCalledWith({
-        accessToken: state.accessToken,
-      });
-    });
-
-    it('invalidates token and fails with 401 if new certificate is present, but not authorized.', async () => {
-      const request = httpServerMock.createKibanaRequest({
-        socket: getMockSocket({ peerCertificate: getMockPeerCertificate('2A:7A:C2:DD') }),
-      });
-      const state = { accessToken: 'token', peerCertificateFingerprint256: '2A:7A:C2:DD' };
-
-      await expect(provider.authenticate(request, state)).resolves.toEqual(
-        AuthenticationResult.failed(Boom.unauthorized())
-      );
-
-      expect(mockOptions.tokens.invalidate).toHaveBeenCalledTimes(1);
-      expect(mockOptions.tokens.invalidate).toHaveBeenCalledWith({
-        accessToken: state.accessToken,
-      });
-    });
-
     it('gets an access token in exchange to peer certificate chain and stores it in the state.', async () => {
       const user = mockAuthenticatedUser();
       const request = httpServerMock.createKibanaRequest({
@@ -202,7 +125,7 @@ describe('PKIAuthenticationProvider', () => {
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
       mockOptions.client.callAsInternalUser.mockResolvedValue({ access_token: 'access-token' });
 
-      await expect(provider.authenticate(request)).resolves.toEqual(
+      await expect(operation(request)).resolves.toEqual(
         AuthenticationResult.succeeded(
           { ...user, authentication_provider: 'pki' },
           {
@@ -244,7 +167,7 @@ describe('PKIAuthenticationProvider', () => {
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
       mockOptions.client.callAsInternalUser.mockResolvedValue({ access_token: 'access-token' });
 
-      await expect(provider.authenticate(request)).resolves.toEqual(
+      await expect(operation(request)).resolves.toEqual(
         AuthenticationResult.succeeded(
           { ...user, authentication_provider: 'pki' },
           {
@@ -266,6 +189,156 @@ describe('PKIAuthenticationProvider', () => {
       expect(request.headers).not.toHaveProperty('authorization');
     });
 
+    it('fails if could not retrieve an access token in exchange to peer certificate chain.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        socket: getMockSocket({
+          authorized: true,
+          peerCertificate: getMockPeerCertificate('2A:7A:C2:DD'),
+        }),
+      });
+
+      const failureReason = ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error());
+      mockOptions.client.callAsInternalUser.mockRejectedValue(failureReason);
+
+      await expect(operation(request)).resolves.toEqual(AuthenticationResult.failed(failureReason));
+
+      expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.delegatePKI', {
+        body: { x509_certificate_chain: ['fingerprint:2A:7A:C2:DD:base64'] },
+      });
+
+      expect(request.headers).not.toHaveProperty('authorization');
+    });
+
+    it('fails if could not retrieve user using the new access token.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        headers: {},
+        socket: getMockSocket({
+          authorized: true,
+          peerCertificate: getMockPeerCertificate('2A:7A:C2:DD'),
+        }),
+      });
+
+      const failureReason = ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error());
+      const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
+      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
+      mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
+      mockOptions.client.callAsInternalUser.mockResolvedValue({ access_token: 'access-token' });
+
+      await expect(operation(request)).resolves.toEqual(AuthenticationResult.failed(failureReason));
+
+      expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledTimes(1);
+      expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.delegatePKI', {
+        body: { x509_certificate_chain: ['fingerprint:2A:7A:C2:DD:base64'] },
+      });
+
+      expectAuthenticateCall(mockOptions.client, {
+        headers: { authorization: 'Bearer access-token' },
+      });
+
+      expect(request.headers).not.toHaveProperty('authorization');
+    });
+  }
+
+  describe('`login` method', () => {
+    defineCommonLoginAndAuthenticateTests(request => provider.login(request));
+  });
+
+  describe('`authenticate` method', () => {
+    defineCommonLoginAndAuthenticateTests(request => provider.authenticate(request, null));
+
+    it('does not handle authentication via `authorization` header.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        headers: { authorization: 'Bearer some-token' },
+      });
+
+      await expect(provider.authenticate(request)).resolves.toEqual(
+        AuthenticationResult.notHandled()
+      );
+
+      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
+      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
+      expect(request.headers.authorization).toBe('Bearer some-token');
+    });
+
+    it('does not handle authentication via `authorization` header even if state contains a valid token.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        headers: { authorization: 'Bearer some-token' },
+      });
+      const state = {
+        accessToken: 'some-valid-token',
+        peerCertificateFingerprint256: '2A:7A:C2:DD',
+      };
+
+      await expect(provider.authenticate(request, state)).resolves.toEqual(
+        AuthenticationResult.notHandled()
+      );
+
+      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
+      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
+      expect(request.headers.authorization).toBe('Bearer some-token');
+    });
+
+    it('does not exchange peer certificate to access token if request does not require authentication.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        routeAuthRequired: false,
+        socket: getMockSocket({
+          authorized: true,
+          peerCertificate: getMockPeerCertificate(['2A:7A:C2:DD', '3B:8B:D3:EE']),
+        }),
+      });
+      await expect(provider.authenticate(request)).resolves.toEqual(
+        AuthenticationResult.notHandled()
+      );
+
+      expect(mockOptions.client.asScoped).not.toHaveBeenCalled();
+      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
+    });
+
+    it('fails with non-401 error if state is available, peer is authorized, but certificate is not available.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        socket: getMockSocket({ authorized: true }),
+      });
+
+      const state = { accessToken: 'token', peerCertificateFingerprint256: '2A:7A:C2:DD' };
+
+      await expect(provider.authenticate(request, state)).resolves.toEqual(
+        AuthenticationResult.failed(new Error('Peer certificate is not available'))
+      );
+
+      expect(mockOptions.tokens.invalidate).not.toHaveBeenCalled();
+    });
+
+    it('invalidates token and fails with 401 if state is present, but peer certificate is not.', async () => {
+      const request = httpServerMock.createKibanaRequest({ socket: getMockSocket() });
+      const state = { accessToken: 'token', peerCertificateFingerprint256: '2A:7A:C2:DD' };
+
+      await expect(provider.authenticate(request, state)).resolves.toEqual(
+        AuthenticationResult.failed(Boom.unauthorized())
+      );
+
+      expect(mockOptions.tokens.invalidate).toHaveBeenCalledTimes(1);
+      expect(mockOptions.tokens.invalidate).toHaveBeenCalledWith({
+        accessToken: state.accessToken,
+      });
+    });
+
+    it('invalidates token and fails with 401 if new certificate is present, but not authorized.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        socket: getMockSocket({ peerCertificate: getMockPeerCertificate('2A:7A:C2:DD') }),
+      });
+      const state = { accessToken: 'token', peerCertificateFingerprint256: '2A:7A:C2:DD' };
+
+      await expect(provider.authenticate(request, state)).resolves.toEqual(
+        AuthenticationResult.failed(Boom.unauthorized())
+      );
+
+      expect(mockOptions.tokens.invalidate).toHaveBeenCalledTimes(1);
+      expect(mockOptions.tokens.invalidate).toHaveBeenCalledWith({
+        accessToken: state.accessToken,
+      });
+    });
+
     it('invalidates existing token and gets a new one if fingerprints do not match.', async () => {
       const user = mockAuthenticatedUser();
       const request = httpServerMock.createKibanaRequest({
@@ -351,75 +424,45 @@ describe('PKIAuthenticationProvider', () => {
       expect(request.headers).not.toHaveProperty('authorization');
     });
 
-    it('fails with 401 if existing token is expired, but certificate is not present.', async () => {
-      const request = httpServerMock.createKibanaRequest({ socket: getMockSocket() });
+    it('does not exchange peer certificate to a new access token even if existing token is expired and request does not require authentication.', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        routeAuthRequired: false,
+        socket: getMockSocket({
+          authorized: true,
+          peerCertificate: getMockPeerCertificate(['2A:7A:C2:DD', '3B:8B:D3:EE']),
+        }),
+      });
       const state = { accessToken: 'existing-token', peerCertificateFingerprint256: '2A:7A:C2:DD' };
 
       const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
-      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(
+      mockScopedClusterClient.callAsCurrentUser.mockRejectedValueOnce(
         ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error())
       );
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
 
       await expect(provider.authenticate(request, state)).resolves.toEqual(
-        AuthenticationResult.failed(Boom.unauthorized())
+        AuthenticationResult.notHandled()
       );
 
       expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
-
-      expect(request.headers).not.toHaveProperty('authorization');
-    });
-
-    it('fails if could not retrieve an access token in exchange to peer certificate chain.', async () => {
-      const request = httpServerMock.createKibanaRequest({
-        socket: getMockSocket({
-          authorized: true,
-          peerCertificate: getMockPeerCertificate('2A:7A:C2:DD'),
-        }),
-      });
-
-      const failureReason = ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error());
-      mockOptions.client.callAsInternalUser.mockRejectedValue(failureReason);
-
-      await expect(provider.authenticate(request)).resolves.toEqual(
-        AuthenticationResult.failed(failureReason)
-      );
-
-      expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledTimes(1);
-      expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.delegatePKI', {
-        body: { x509_certificate_chain: ['fingerprint:2A:7A:C2:DD:base64'] },
-      });
-
       expect(request.headers).not.toHaveProperty('authorization');
     });
 
-    it('fails if could not retrieve user using the new access token.', async () => {
-      const request = httpServerMock.createKibanaRequest({
-        headers: {},
-        socket: getMockSocket({
-          authorized: true,
-          peerCertificate: getMockPeerCertificate('2A:7A:C2:DD'),
-        }),
-      });
+    it('fails with 401 if existing token is expired, but certificate is not present.', async () => {
+      const request = httpServerMock.createKibanaRequest({ socket: getMockSocket() });
+      const state = { accessToken: 'existing-token', peerCertificateFingerprint256: '2A:7A:C2:DD' };
 
-      const failureReason = ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error());
       const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
-      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
+      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(
+        ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error())
+      );
       mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
-      mockOptions.client.callAsInternalUser.mockResolvedValue({ access_token: 'access-token' });
 
-      await expect(provider.authenticate(request)).resolves.toEqual(
-        AuthenticationResult.failed(failureReason)
+      await expect(provider.authenticate(request, state)).resolves.toEqual(
+        AuthenticationResult.failed(Boom.unauthorized())
       );
 
-      expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledTimes(1);
-      expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.delegatePKI', {
-        body: { x509_certificate_chain: ['fingerprint:2A:7A:C2:DD:base64'] },
-      });
-
-      expectAuthenticateCall(mockOptions.client, {
-        headers: { authorization: 'Bearer access-token' },
-      });
+      expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
 
       expect(request.headers).not.toHaveProperty('authorization');
     });
diff --git a/x-pack/plugins/security/server/authentication/providers/pki.ts b/x-pack/plugins/security/server/authentication/providers/pki.ts
index 252ab8cc67144..243e5415ad2c2 100644
--- a/x-pack/plugins/security/server/authentication/providers/pki.ts
+++ b/x-pack/plugins/security/server/authentication/providers/pki.ts
@@ -9,7 +9,7 @@ import { DetailedPeerCertificate } from 'tls';
 import { KibanaRequest } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
-import { getHTTPAuthenticationScheme } from '../get_http_authentication_scheme';
+import { HTTPAuthorizationHeader } from '../http_authentication';
 import { Tokens } from '../tokens';
 import { BaseAuthenticationProvider } from './base';
 
@@ -28,6 +28,15 @@ interface ProviderState {
   peerCertificateFingerprint256: string;
 }
 
+/**
+ * Checks whether current request can initiate new session.
+ * @param request Request instance.
+ */
+function canStartNewSession(request: KibanaRequest) {
+  // We should try to establish new session only if request requires authentication.
+  return request.route.options.authRequired === true;
+}
+
 /**
  * Provider that supports PKI request authentication.
  */
@@ -37,6 +46,15 @@ export class PKIAuthenticationProvider extends BaseAuthenticationProvider {
    */
   static readonly type = 'pki';
 
+  /**
+   * Performs initial login request.
+   * @param request Request instance.
+   */
+  public async login(request: KibanaRequest) {
+    this.logger.debug('Trying to perform a login.');
+    return await this.authenticateViaPeerCertificate(request);
+  }
+
   /**
    * Performs PKI request authentication.
    * @param request Request instance.
@@ -45,7 +63,7 @@ export class PKIAuthenticationProvider extends BaseAuthenticationProvider {
   public async authenticate(request: KibanaRequest, state?: ProviderState | null) {
     this.logger.debug(`Trying to authenticate user request to ${request.url.path}.`);
 
-    if (getHTTPAuthenticationScheme(request) != null) {
+    if (HTTPAuthorizationHeader.parseFromRequest(request) != null) {
       this.logger.debug('Cannot authenticate requests with `Authorization` header.');
       return AuthenticationResult.notHandled();
     }
@@ -55,12 +73,12 @@ export class PKIAuthenticationProvider extends BaseAuthenticationProvider {
       authenticationResult = await this.authenticateViaState(request, state);
 
       // If access token expired or doesn't match to the certificate fingerprint we should try to get
-      // a new one in exchange to peer certificate chain.
-      if (
+      // a new one in exchange to peer certificate chain assuming request can initiate new session.
+      const invalidAccessToken =
         authenticationResult.notHandled() ||
         (authenticationResult.failed() &&
-          Tokens.isAccessTokenExpiredError(authenticationResult.error))
-      ) {
+          Tokens.isAccessTokenExpiredError(authenticationResult.error));
+      if (invalidAccessToken && canStartNewSession(request)) {
         authenticationResult = await this.authenticateViaPeerCertificate(request);
         // If we have an active session that we couldn't use to authenticate user and at the same time
         // we couldn't use peer's certificate to establish a new one, then we should respond with 401
@@ -68,12 +86,15 @@ export class PKIAuthenticationProvider extends BaseAuthenticationProvider {
         if (authenticationResult.notHandled()) {
           return AuthenticationResult.failed(Boom.unauthorized());
         }
+      } else if (invalidAccessToken) {
+        return AuthenticationResult.notHandled();
       }
     }
 
     // If we couldn't authenticate by means of all methods above, let's try to check if we can authenticate
     // request using its peer certificate chain, otherwise just return authentication result we have.
-    return authenticationResult.notHandled()
+    // We shouldn't establish new session if authentication isn't required for this particular request.
+    return authenticationResult.notHandled() && canStartNewSession(request)
       ? await this.authenticateViaPeerCertificate(request)
       : authenticationResult;
   }
@@ -156,7 +177,9 @@ export class PKIAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     try {
-      const authHeaders = { authorization: `Bearer ${accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader('Bearer', accessToken).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Request has been authenticated via state.');
@@ -207,7 +230,9 @@ export class PKIAuthenticationProvider extends BaseAuthenticationProvider {
 
     try {
       // Then attempt to query for the user details using the new token
-      const authHeaders = { authorization: `Bearer ${accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader('Bearer', accessToken).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('User has been authenticated with new access token');
diff --git a/x-pack/plugins/security/server/authentication/providers/saml.test.ts b/x-pack/plugins/security/server/authentication/providers/saml.test.ts
index b3f6ca4af13c4..c85a44d819adc 100644
--- a/x-pack/plugins/security/server/authentication/providers/saml.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/saml.test.ts
@@ -18,7 +18,7 @@ import {
 } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
-import { SAMLAuthenticationProvider, SAMLLoginStep } from './saml';
+import { SAMLAuthenticationProvider, SAMLLogin } from './saml';
 
 function expectAuthenticateCall(
   mockClusterClient: jest.Mocked<IClusterClient>,
@@ -36,7 +36,7 @@ describe('SAMLAuthenticationProvider', () => {
   let provider: SAMLAuthenticationProvider;
   let mockOptions: MockAuthenticationProviderOptions;
   beforeEach(() => {
-    mockOptions = mockAuthenticationProviderOptions();
+    mockOptions = mockAuthenticationProviderOptions({ name: 'saml' });
     provider = new SAMLAuthenticationProvider(mockOptions, {
       maxRedirectURLSize: new ByteSizeValue(100),
     });
@@ -66,13 +66,18 @@ describe('SAMLAuthenticationProvider', () => {
         username: 'user',
         access_token: 'some-token',
         refresh_token: 'some-refresh-token',
+        realm: 'test-realm',
       });
 
       await expect(
         provider.login(
           request,
-          { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
-          { requestId: 'some-request-id', redirectURL: '/test-base-path/some-path#some-app' }
+          { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
+          {
+            requestId: 'some-request-id',
+            redirectURL: '/test-base-path/some-path#some-app',
+            realm: 'test-realm',
+          }
         )
       ).resolves.toEqual(
         AuthenticationResult.redirectTo('/test-base-path/some-path#some-app', {
@@ -80,13 +85,14 @@ describe('SAMLAuthenticationProvider', () => {
             username: 'user',
             accessToken: 'some-token',
             refreshToken: 'some-refresh-token',
+            realm: 'test-realm',
           },
         })
       );
 
       expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith(
         'shield.samlAuthenticate',
-        { body: { ids: ['some-request-id'], content: 'saml-response-xml' } }
+        { body: { ids: ['some-request-id'], content: 'saml-response-xml', realm: 'test-realm' } }
       );
     });
 
@@ -96,8 +102,8 @@ describe('SAMLAuthenticationProvider', () => {
       await expect(
         provider.login(
           request,
-          { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
-          {}
+          { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
+          {} as any
         )
       ).resolves.toEqual(
         AuthenticationResult.failed(
@@ -108,32 +114,61 @@ describe('SAMLAuthenticationProvider', () => {
       expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
     });
 
+    it('fails if realm from state is different from the realm provider is configured with.', async () => {
+      const request = httpServerMock.createKibanaRequest();
+      const customMockOptions = mockAuthenticationProviderOptions({ name: 'saml' });
+      provider = new SAMLAuthenticationProvider(customMockOptions, {
+        realm: 'test-realm',
+        maxRedirectURLSize: new ByteSizeValue(100),
+      });
+
+      await expect(
+        provider.login(
+          request,
+          { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
+          { realm: 'other-realm' }
+        )
+      ).resolves.toEqual(
+        AuthenticationResult.failed(
+          Boom.unauthorized(
+            'State based on realm "other-realm", but provider with the name "saml" is configured to use realm "test-realm".'
+          )
+        )
+      );
+
+      expect(customMockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
+    });
+
     it('redirects to the default location if state contains empty redirect URL.', async () => {
       const request = httpServerMock.createKibanaRequest();
 
       mockOptions.client.callAsInternalUser.mockResolvedValue({
+        username: 'user',
         access_token: 'user-initiated-login-token',
         refresh_token: 'user-initiated-login-refresh-token',
+        realm: 'test-realm',
       });
 
       await expect(
         provider.login(
           request,
-          { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
-          { requestId: 'some-request-id', redirectURL: '' }
+          { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
+          { requestId: 'some-request-id', redirectURL: '', realm: 'test-realm' }
         )
       ).resolves.toEqual(
         AuthenticationResult.redirectTo('/base-path/', {
           state: {
+            username: 'user',
             accessToken: 'user-initiated-login-token',
             refreshToken: 'user-initiated-login-refresh-token',
+            realm: 'test-realm',
           },
         })
       );
 
       expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith(
         'shield.samlAuthenticate',
-        { body: { ids: ['some-request-id'], content: 'saml-response-xml' } }
+        { body: { ids: ['some-request-id'], content: 'saml-response-xml', realm: 'test-realm' } }
       );
     });
 
@@ -141,20 +176,24 @@ describe('SAMLAuthenticationProvider', () => {
       const request = httpServerMock.createKibanaRequest();
 
       mockOptions.client.callAsInternalUser.mockResolvedValue({
+        username: 'user',
+        realm: 'test-realm',
         access_token: 'idp-initiated-login-token',
         refresh_token: 'idp-initiated-login-refresh-token',
       });
 
       await expect(
         provider.login(request, {
-          step: SAMLLoginStep.SAMLResponseReceived,
+          type: SAMLLogin.LoginWithSAMLResponse,
           samlResponse: 'saml-response-xml',
         })
       ).resolves.toEqual(
         AuthenticationResult.redirectTo('/base-path/', {
           state: {
+            username: 'user',
             accessToken: 'idp-initiated-login-token',
             refreshToken: 'idp-initiated-login-refresh-token',
+            realm: 'test-realm',
           },
         })
       );
@@ -174,14 +213,18 @@ describe('SAMLAuthenticationProvider', () => {
       await expect(
         provider.login(
           request,
-          { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
-          { requestId: 'some-request-id', redirectURL: '/test-base-path/some-path' }
+          { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
+          {
+            requestId: 'some-request-id',
+            redirectURL: '/test-base-path/some-path',
+            realm: 'test-realm',
+          }
         )
       ).resolves.toEqual(AuthenticationResult.failed(failureReason));
 
       expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith(
         'shield.samlAuthenticate',
-        { body: { ids: ['some-request-id'], content: 'saml-response-xml' } }
+        { body: { ids: ['some-request-id'], content: 'saml-response-xml', realm: 'test-realm' } }
       );
     });
 
@@ -189,7 +232,7 @@ describe('SAMLAuthenticationProvider', () => {
       const request = httpServerMock.createKibanaRequest();
 
       // Create new provider instance with additional `realm` option.
-      const customMockOptions = mockAuthenticationProviderOptions();
+      const customMockOptions = mockAuthenticationProviderOptions({ name: 'saml' });
       provider = new SAMLAuthenticationProvider(customMockOptions, {
         realm: 'test-realm',
         maxRedirectURLSize: new ByteSizeValue(100),
@@ -199,13 +242,18 @@ describe('SAMLAuthenticationProvider', () => {
         username: 'user',
         access_token: 'some-token',
         refresh_token: 'some-refresh-token',
+        realm: 'test-realm',
       });
 
       await expect(
         provider.login(
           request,
-          { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
-          { requestId: 'some-request-id', redirectURL: '/test-base-path/some-path' }
+          { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
+          {
+            requestId: 'some-request-id',
+            redirectURL: '/test-base-path/some-path',
+            realm: 'test-realm',
+          }
         )
       ).resolves.toEqual(
         AuthenticationResult.redirectTo('/test-base-path/some-path', {
@@ -213,6 +261,7 @@ describe('SAMLAuthenticationProvider', () => {
             username: 'user',
             accessToken: 'some-token',
             refreshToken: 'some-refresh-token',
+            realm: 'test-realm',
           },
         })
       );
@@ -226,7 +275,7 @@ describe('SAMLAuthenticationProvider', () => {
     });
 
     describe('IdP initiated login with existing session', () => {
-      it('fails if new SAML Response is rejected.', async () => {
+      it('fails if new SAML Response is rejected and provider is not configured with specific realm.', async () => {
         const request = httpServerMock.createKibanaRequest({ headers: {} });
         const authorization = 'Bearer some-valid-token';
 
@@ -241,11 +290,12 @@ describe('SAMLAuthenticationProvider', () => {
         await expect(
           provider.login(
             request,
-            { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
+            { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
             {
               username: 'user',
               accessToken: 'some-valid-token',
               refreshToken: 'some-valid-refresh-token',
+              realm: 'test-realm',
             }
           )
         ).resolves.toEqual(AuthenticationResult.failed(failureReason));
@@ -260,51 +310,43 @@ describe('SAMLAuthenticationProvider', () => {
         );
       });
 
-      it('fails if token received in exchange to new SAML Response is rejected.', async () => {
-        const request = httpServerMock.createKibanaRequest();
-
-        // Call to `authenticate` using existing valid session and also with token received in
-        // exchange to new SAML payload.
-        const user = mockAuthenticatedUser();
-        const failureReason = new Error('Access token is invalid!');
-        mockOptions.client.asScoped.mockImplementation(scopeableRequest => {
-          if (scopeableRequest?.headers.authorization === 'Bearer new-invalid-token') {
-            const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
-            mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(failureReason);
-            return mockScopedClusterClient;
-          }
-
-          if (scopeableRequest?.headers.authorization === 'Bearer existing-valid-token') {
-            const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
-            mockScopedClusterClient.callAsCurrentUser.mockResolvedValue(user);
-            return mockScopedClusterClient;
-          }
+      it('returns `notHandled` if new SAML Response is rejected and provider is configured with specific realm.', async () => {
+        const request = httpServerMock.createKibanaRequest({ headers: {} });
+        const authorization = 'Bearer some-valid-token';
 
-          throw new Error('Unexpected call');
+        const customMockOptions = mockAuthenticationProviderOptions({ name: 'saml' });
+        provider = new SAMLAuthenticationProvider(customMockOptions, {
+          realm: 'test-realm',
+          maxRedirectURLSize: new ByteSizeValue(100),
         });
 
-        mockOptions.client.callAsInternalUser.mockResolvedValue({
-          username: 'user',
-          access_token: 'new-invalid-token',
-          refresh_token: 'new-invalid-token',
-        });
+        const user = mockAuthenticatedUser();
+        const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
+        mockScopedClusterClient.callAsCurrentUser.mockResolvedValue(user);
+        customMockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
+
+        const failureReason = new Error('SAML response is invalid!');
+        customMockOptions.client.callAsInternalUser.mockRejectedValue(failureReason);
 
         await expect(
           provider.login(
             request,
-            { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
+            { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
             {
               username: 'user',
-              accessToken: 'existing-valid-token',
-              refreshToken: 'existing-valid-refresh-token',
+              accessToken: 'some-valid-token',
+              refreshToken: 'some-valid-refresh-token',
+              realm: 'test-realm',
             }
           )
-        ).resolves.toEqual(AuthenticationResult.failed(failureReason));
+        ).resolves.toEqual(AuthenticationResult.notHandled());
 
-        expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith(
+        expectAuthenticateCall(customMockOptions.client, { headers: { authorization } });
+
+        expect(customMockOptions.client.callAsInternalUser).toHaveBeenCalledWith(
           'shield.samlAuthenticate',
           {
-            body: { ids: [], content: 'saml-response-xml' },
+            body: { ids: [], content: 'saml-response-xml', realm: 'test-realm' },
           }
         );
       });
@@ -315,6 +357,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'user',
           accessToken: 'existing-valid-token',
           refreshToken: 'existing-valid-refresh-token',
+          realm: 'test-realm',
         };
 
         const user = mockAuthenticatedUser();
@@ -334,7 +377,7 @@ describe('SAMLAuthenticationProvider', () => {
         await expect(
           provider.login(
             request,
-            { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
+            { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
             state
           )
         ).resolves.toEqual(AuthenticationResult.failed(failureReason));
@@ -359,6 +402,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'user',
           accessToken: 'existing-valid-token',
           refreshToken: 'existing-valid-refresh-token',
+          realm: 'test-realm',
         };
 
         const user = { username: 'user', authentication_realm: { name: 'saml1' } };
@@ -370,6 +414,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'user',
           access_token: 'new-valid-token',
           refresh_token: 'new-valid-refresh-token',
+          realm: 'test-realm',
         });
 
         mockOptions.tokens.invalidate.mockResolvedValue(undefined);
@@ -377,7 +422,7 @@ describe('SAMLAuthenticationProvider', () => {
         await expect(
           provider.login(
             request,
-            { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
+            { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
             state
           )
         ).resolves.toEqual(
@@ -386,6 +431,7 @@ describe('SAMLAuthenticationProvider', () => {
               username: 'user',
               accessToken: 'new-valid-token',
               refreshToken: 'new-valid-refresh-token',
+              realm: 'test-realm',
             },
           })
         );
@@ -410,6 +456,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'user',
           accessToken: 'existing-valid-token',
           refreshToken: 'existing-valid-refresh-token',
+          realm: 'test-realm',
         };
 
         const existingUser = { username: 'user', authentication_realm: { name: 'saml1' } };
@@ -434,6 +481,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'new-user',
           access_token: 'new-valid-token',
           refresh_token: 'new-valid-refresh-token',
+          realm: 'test-realm',
         });
 
         mockOptions.tokens.invalidate.mockResolvedValue(undefined);
@@ -441,7 +489,7 @@ describe('SAMLAuthenticationProvider', () => {
         await expect(
           provider.login(
             request,
-            { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
+            { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
             state
           )
         ).resolves.toEqual(
@@ -450,6 +498,7 @@ describe('SAMLAuthenticationProvider', () => {
               username: 'new-user',
               accessToken: 'new-valid-token',
               refreshToken: 'new-valid-refresh-token',
+              realm: 'test-realm',
             },
           })
         );
@@ -474,6 +523,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'user',
           accessToken: 'existing-valid-token',
           refreshToken: 'existing-valid-refresh-token',
+          realm: 'saml1',
         };
 
         const existingUser = { username: 'user', authentication_realm: { name: 'saml1' } };
@@ -498,6 +548,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'user',
           access_token: 'new-valid-token',
           refresh_token: 'new-valid-refresh-token',
+          realm: 'saml2',
         });
 
         mockOptions.tokens.invalidate.mockResolvedValue(undefined);
@@ -505,7 +556,7 @@ describe('SAMLAuthenticationProvider', () => {
         await expect(
           provider.login(
             request,
-            { step: SAMLLoginStep.SAMLResponseReceived, samlResponse: 'saml-response-xml' },
+            { type: SAMLLogin.LoginWithSAMLResponse, samlResponse: 'saml-response-xml' },
             state
           )
         ).resolves.toEqual(
@@ -514,6 +565,7 @@ describe('SAMLAuthenticationProvider', () => {
               username: 'user',
               accessToken: 'new-valid-token',
               refreshToken: 'new-valid-refresh-token',
+              realm: 'saml2',
             },
           })
         );
@@ -534,56 +586,81 @@ describe('SAMLAuthenticationProvider', () => {
     });
 
     describe('User initiated login with captured redirect URL', () => {
-      it('fails if state is not available', async () => {
+      it('fails if redirectURLPath is not available', async () => {
         const request = httpServerMock.createKibanaRequest();
 
         await expect(
           provider.login(request, {
-            step: SAMLLoginStep.RedirectURLFragmentCaptured,
+            type: SAMLLogin.LoginInitiatedByUser,
             redirectURLFragment: '#some-fragment',
           })
         ).resolves.toEqual(
           AuthenticationResult.failed(
-            Boom.badRequest('State does not include URL path to redirect to.')
+            Boom.badRequest('State or login attempt does not include URL path to redirect to.')
           )
         );
 
         expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
       });
 
-      it('does not handle AJAX requests.', async () => {
-        const request = httpServerMock.createKibanaRequest({ headers: { 'kbn-xsrf': 'xsrf' } });
+      it('redirects requests to the IdP remembering combined redirect URL.', async () => {
+        const request = httpServerMock.createKibanaRequest();
+
+        mockOptions.client.callAsInternalUser.mockResolvedValue({
+          id: 'some-request-id',
+          redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
+          realm: 'test-realm',
+        });
 
         await expect(
           provider.login(
             request,
             {
-              step: SAMLLoginStep.RedirectURLFragmentCaptured,
+              type: SAMLLogin.LoginInitiatedByUser,
               redirectURLFragment: '#some-fragment',
             },
             { redirectURL: '/test-base-path/some-path' }
           )
-        ).resolves.toEqual(AuthenticationResult.notHandled());
+        ).resolves.toEqual(
+          AuthenticationResult.redirectTo(
+            'https://idp-host/path/login?SAMLRequest=some%20request%20',
+            {
+              state: {
+                requestId: 'some-request-id',
+                redirectURL: '/test-base-path/some-path#some-fragment',
+                realm: 'test-realm',
+              },
+            }
+          )
+        );
 
-        expect(mockOptions.client.callAsInternalUser).not.toHaveBeenCalled();
+        expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.samlPrepare', {
+          body: {
+            acs: 'test-protocol://test-hostname:1234/mock-server-basepath/api/security/v1/saml',
+          },
+        });
+
+        expect(mockOptions.logger.warn).not.toHaveBeenCalled();
       });
 
-      it('redirects non-AJAX requests to the IdP remembering combined redirect URL.', async () => {
+      it('redirects requests to the IdP remembering combined redirect URL if path is provided in attempt.', async () => {
         const request = httpServerMock.createKibanaRequest();
 
         mockOptions.client.callAsInternalUser.mockResolvedValue({
           id: 'some-request-id',
           redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
+          realm: 'test-realm',
         });
 
         await expect(
           provider.login(
             request,
             {
-              step: SAMLLoginStep.RedirectURLFragmentCaptured,
+              type: SAMLLogin.LoginInitiatedByUser,
+              redirectURLPath: '/test-base-path/some-path',
               redirectURLFragment: '#some-fragment',
             },
-            { redirectURL: '/test-base-path/some-path' }
+            null
           )
         ).resolves.toEqual(
           AuthenticationResult.redirectTo(
@@ -592,6 +669,7 @@ describe('SAMLAuthenticationProvider', () => {
               state: {
                 requestId: 'some-request-id',
                 redirectURL: '/test-base-path/some-path#some-fragment',
+                realm: 'test-realm',
               },
             }
           )
@@ -612,13 +690,14 @@ describe('SAMLAuthenticationProvider', () => {
         mockOptions.client.callAsInternalUser.mockResolvedValue({
           id: 'some-request-id',
           redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
+          realm: 'test-realm',
         });
 
         await expect(
           provider.login(
             request,
             {
-              step: SAMLLoginStep.RedirectURLFragmentCaptured,
+              type: SAMLLogin.LoginInitiatedByUser,
               redirectURLFragment: '../some-fragment',
             },
             { redirectURL: '/test-base-path/some-path' }
@@ -630,6 +709,7 @@ describe('SAMLAuthenticationProvider', () => {
               state: {
                 requestId: 'some-request-id',
                 redirectURL: '/test-base-path/some-path#../some-fragment',
+                realm: 'test-realm',
               },
             }
           )
@@ -647,19 +727,20 @@ describe('SAMLAuthenticationProvider', () => {
         );
       });
 
-      it('redirects non-AJAX requests to the IdP remembering only redirect URL path if fragment is too large.', async () => {
+      it('redirects requests to the IdP remembering only redirect URL path if fragment is too large.', async () => {
         const request = httpServerMock.createKibanaRequest();
 
         mockOptions.client.callAsInternalUser.mockResolvedValue({
           id: 'some-request-id',
           redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
+          realm: 'test-realm',
         });
 
         await expect(
           provider.login(
             request,
             {
-              step: SAMLLoginStep.RedirectURLFragmentCaptured,
+              type: SAMLLogin.LoginInitiatedByUser,
               redirectURLFragment: '#some-fragment'.repeat(10),
             },
             { redirectURL: '/test-base-path/some-path' }
@@ -671,6 +752,7 @@ describe('SAMLAuthenticationProvider', () => {
               state: {
                 requestId: 'some-request-id',
                 redirectURL: '/test-base-path/some-path',
+                realm: 'test-realm',
               },
             }
           )
@@ -701,16 +783,17 @@ describe('SAMLAuthenticationProvider', () => {
         customMockOptions.client.callAsInternalUser.mockResolvedValue({
           id: 'some-request-id',
           redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
+          realm: 'test-realm',
         });
 
         await expect(
           provider.login(
             request,
             {
-              step: SAMLLoginStep.RedirectURLFragmentCaptured,
+              type: SAMLLogin.LoginInitiatedByUser,
               redirectURLFragment: '#some-fragment',
             },
-            { redirectURL: '/test-base-path/some-path' }
+            { redirectURL: '/test-base-path/some-path', realm: 'test-realm' }
           )
         ).resolves.toEqual(
           AuthenticationResult.redirectTo(
@@ -719,6 +802,7 @@ describe('SAMLAuthenticationProvider', () => {
               state: {
                 requestId: 'some-request-id',
                 redirectURL: '/test-base-path/some-path#some-fragment',
+                realm: 'test-realm',
               },
             }
           )
@@ -729,6 +813,43 @@ describe('SAMLAuthenticationProvider', () => {
         ).toHaveBeenCalledWith('shield.samlPrepare', { body: { realm: 'test-realm' } });
       });
 
+      it('redirects requests to the IdP remembering base path if redirect URL path in attempt is too large.', async () => {
+        const request = httpServerMock.createKibanaRequest();
+        mockOptions.client.callAsInternalUser.mockResolvedValue({
+          id: 'some-request-id',
+          redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
+          realm: 'test-realm',
+        });
+
+        await expect(
+          provider.login(
+            request,
+            {
+              type: SAMLLogin.LoginInitiatedByUser,
+              redirectURLPath: `/s/foo/${'some-path'.repeat(11)}`,
+              redirectURLFragment: '#some-fragment',
+            },
+            null
+          )
+        ).resolves.toEqual(
+          AuthenticationResult.redirectTo(
+            'https://idp-host/path/login?SAMLRequest=some%20request%20',
+            { state: { requestId: 'some-request-id', redirectURL: '', realm: 'test-realm' } }
+          )
+        );
+
+        expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.samlPrepare', {
+          body: {
+            acs: 'test-protocol://test-hostname:1234/mock-server-basepath/api/security/v1/saml',
+          },
+        });
+
+        expect(mockOptions.logger.warn).toHaveBeenCalledTimes(1);
+        expect(mockOptions.logger.warn).toHaveBeenCalledWith(
+          'Max URL path size should not exceed 100b but it was 106b. URL is not captured.'
+        );
+      });
+
       it('fails if SAML request preparation fails.', async () => {
         const request = httpServerMock.createKibanaRequest();
 
@@ -739,7 +860,7 @@ describe('SAMLAuthenticationProvider', () => {
           provider.login(
             request,
             {
-              step: SAMLLoginStep.RedirectURLFragmentCaptured,
+              type: SAMLLogin.LoginInitiatedByUser,
               redirectURLFragment: '#some-fragment',
             },
             { redirectURL: '/test-base-path/some-path' }
@@ -764,6 +885,13 @@ describe('SAMLAuthenticationProvider', () => {
       );
     });
 
+    it('does not handle non-AJAX request that does not require authentication.', async () => {
+      const request = httpServerMock.createKibanaRequest({ routeAuthRequired: false });
+      await expect(provider.authenticate(request)).resolves.toEqual(
+        AuthenticationResult.notHandled()
+      );
+    });
+
     it('does not handle authentication via `authorization` header.', async () => {
       const request = httpServerMock.createKibanaRequest({
         headers: { authorization: 'Bearer some-token' },
@@ -787,6 +915,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'user',
           accessToken: 'some-valid-token',
           refreshToken: 'some-valid-refresh-token',
+          realm: 'test-realm',
         })
       ).resolves.toEqual(AuthenticationResult.notHandled());
 
@@ -797,14 +926,9 @@ describe('SAMLAuthenticationProvider', () => {
     it('redirects non-AJAX request that can not be authenticated to the "capture fragment" page.', async () => {
       const request = httpServerMock.createKibanaRequest({ path: '/s/foo/some-path' });
 
-      mockOptions.client.callAsInternalUser.mockResolvedValue({
-        id: 'some-request-id',
-        redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
-      });
-
       await expect(provider.authenticate(request)).resolves.toEqual(
         AuthenticationResult.redirectTo(
-          '/mock-server-basepath/api/security/saml/capture-url-fragment',
+          '/mock-server-basepath/internal/security/saml/capture-url-fragment',
           { state: { redirectURL: '/base-path/s/foo/some-path' } }
         )
       );
@@ -820,12 +944,13 @@ describe('SAMLAuthenticationProvider', () => {
       mockOptions.client.callAsInternalUser.mockResolvedValue({
         id: 'some-request-id',
         redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
+        realm: 'test-realm',
       });
 
       await expect(provider.authenticate(request)).resolves.toEqual(
         AuthenticationResult.redirectTo(
           'https://idp-host/path/login?SAMLRequest=some%20request%20',
-          { state: { requestId: 'some-request-id', redirectURL: '' } }
+          { state: { requestId: 'some-request-id', redirectURL: '', realm: 'test-realm' } }
         )
       );
 
@@ -867,6 +992,7 @@ describe('SAMLAuthenticationProvider', () => {
         username: 'user',
         accessToken: 'some-valid-token',
         refreshToken: 'some-valid-refresh-token',
+        realm: 'test-realm',
       };
       const authorization = `Bearer ${state.accessToken}`;
 
@@ -892,6 +1018,7 @@ describe('SAMLAuthenticationProvider', () => {
         username: 'user',
         accessToken: 'some-valid-token',
         refreshToken: 'some-valid-refresh-token',
+        realm: 'test-realm',
       };
       const authorization = `Bearer ${state.accessToken}`;
 
@@ -916,6 +1043,7 @@ describe('SAMLAuthenticationProvider', () => {
         username: 'user',
         accessToken: 'expired-token',
         refreshToken: 'valid-refresh-token',
+        realm: 'test-realm',
       };
 
       mockOptions.client.asScoped.mockImplementation(scopeableRequest => {
@@ -950,6 +1078,7 @@ describe('SAMLAuthenticationProvider', () => {
               username: 'user',
               accessToken: 'new-access-token',
               refreshToken: 'new-refresh-token',
+              realm: 'test-realm',
             },
           }
         )
@@ -967,6 +1096,7 @@ describe('SAMLAuthenticationProvider', () => {
         username: 'user',
         accessToken: 'expired-token',
         refreshToken: 'invalid-refresh-token',
+        realm: 'test-realm',
       };
       const authorization = `Bearer ${state.accessToken}`;
 
@@ -1000,6 +1130,7 @@ describe('SAMLAuthenticationProvider', () => {
         username: 'user',
         accessToken: 'expired-token',
         refreshToken: 'expired-refresh-token',
+        realm: 'test-realm',
       };
       const authorization = `Bearer ${state.accessToken}`;
 
@@ -1025,12 +1156,45 @@ describe('SAMLAuthenticationProvider', () => {
       expect(request.headers).not.toHaveProperty('authorization');
     });
 
+    it('fails for non-AJAX requests that do not require authentication with user friendly message if refresh token is expired.', async () => {
+      const request = httpServerMock.createKibanaRequest({ routeAuthRequired: false, headers: {} });
+      const state = {
+        username: 'user',
+        accessToken: 'expired-token',
+        refreshToken: 'expired-refresh-token',
+        realm: 'test-realm',
+      };
+      const authorization = `Bearer ${state.accessToken}`;
+
+      const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
+      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(
+        ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error())
+      );
+      mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
+
+      mockOptions.tokens.refresh.mockResolvedValue(null);
+
+      await expect(provider.authenticate(request, state)).resolves.toEqual(
+        AuthenticationResult.failed(Boom.badRequest('Both access and refresh tokens are expired.'))
+      );
+
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(state.refreshToken);
+
+      expectAuthenticateCall(mockOptions.client, {
+        headers: { authorization },
+      });
+
+      expect(request.headers).not.toHaveProperty('authorization');
+    });
+
     it('re-capture URL for non-AJAX requests if refresh token is expired.', async () => {
       const request = httpServerMock.createKibanaRequest({ path: '/s/foo/some-path', headers: {} });
       const state = {
         username: 'user',
         accessToken: 'expired-token',
         refreshToken: 'expired-refresh-token',
+        realm: 'test-realm',
       };
       const authorization = `Bearer ${state.accessToken}`;
 
@@ -1044,7 +1208,7 @@ describe('SAMLAuthenticationProvider', () => {
 
       await expect(provider.authenticate(request, state)).resolves.toEqual(
         AuthenticationResult.redirectTo(
-          '/mock-server-basepath/api/security/saml/capture-url-fragment',
+          '/mock-server-basepath/internal/security/saml/capture-url-fragment',
           { state: { redirectURL: '/base-path/s/foo/some-path' } }
         )
       );
@@ -1066,12 +1230,14 @@ describe('SAMLAuthenticationProvider', () => {
         username: 'user',
         accessToken: 'expired-token',
         refreshToken: 'expired-refresh-token',
+        realm: 'test-realm',
       };
       const authorization = `Bearer ${state.accessToken}`;
 
       mockOptions.client.callAsInternalUser.mockResolvedValue({
         id: 'some-request-id',
         redirect: 'https://idp-host/path/login?SAMLRequest=some%20request%20',
+        realm: 'test-realm',
       });
 
       const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
@@ -1085,7 +1251,7 @@ describe('SAMLAuthenticationProvider', () => {
       await expect(provider.authenticate(request, state)).resolves.toEqual(
         AuthenticationResult.redirectTo(
           'https://idp-host/path/login?SAMLRequest=some%20request%20',
-          { state: { requestId: 'some-request-id', redirectURL: '' } }
+          { state: { requestId: 'some-request-id', redirectURL: '', realm: 'test-realm' } }
         )
       );
 
@@ -1105,6 +1271,25 @@ describe('SAMLAuthenticationProvider', () => {
         'Max URL path size should not exceed 100b but it was 107b. URL is not captured.'
       );
     });
+
+    it('fails if realm from state is different from the realm provider is configured with.', async () => {
+      const request = httpServerMock.createKibanaRequest();
+
+      // Create new provider instance with additional `realm` option.
+      const customMockOptions = mockAuthenticationProviderOptions({ name: 'saml' });
+      provider = new SAMLAuthenticationProvider(customMockOptions, {
+        realm: 'test-realm',
+        maxRedirectURLSize: new ByteSizeValue(100),
+      });
+
+      await expect(provider.authenticate(request, { realm: 'other-realm' })).resolves.toEqual(
+        AuthenticationResult.failed(
+          Boom.unauthorized(
+            'State based on realm "other-realm", but provider with the name "saml" is configured to use realm "test-realm".'
+          )
+        )
+      );
+    });
   });
 
   describe('`logout` method', () => {
@@ -1131,7 +1316,12 @@ describe('SAMLAuthenticationProvider', () => {
       mockOptions.client.callAsInternalUser.mockRejectedValue(failureReason);
 
       await expect(
-        provider.logout(request, { username: 'user', accessToken, refreshToken })
+        provider.logout(request, {
+          username: 'user',
+          accessToken,
+          refreshToken,
+          realm: 'test-realm',
+        })
       ).resolves.toEqual(DeauthenticationResult.failed(failureReason));
 
       expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledTimes(1);
@@ -1167,7 +1357,12 @@ describe('SAMLAuthenticationProvider', () => {
       mockOptions.client.callAsInternalUser.mockResolvedValue({ redirect: null });
 
       await expect(
-        provider.logout(request, { username: 'user', accessToken, refreshToken })
+        provider.logout(request, {
+          username: 'user',
+          accessToken,
+          refreshToken,
+          realm: 'test-realm',
+        })
       ).resolves.toEqual(
         DeauthenticationResult.redirectTo('/mock-server-basepath/security/logged_out')
       );
@@ -1186,7 +1381,12 @@ describe('SAMLAuthenticationProvider', () => {
       mockOptions.client.callAsInternalUser.mockResolvedValue({ redirect: undefined });
 
       await expect(
-        provider.logout(request, { username: 'user', accessToken, refreshToken })
+        provider.logout(request, {
+          username: 'user',
+          accessToken,
+          refreshToken,
+          realm: 'test-realm',
+        })
       ).resolves.toEqual(
         DeauthenticationResult.redirectTo('/mock-server-basepath/security/logged_out')
       );
@@ -1207,7 +1407,12 @@ describe('SAMLAuthenticationProvider', () => {
       mockOptions.client.callAsInternalUser.mockResolvedValue({ redirect: null });
 
       await expect(
-        provider.logout(request, { username: 'user', accessToken, refreshToken })
+        provider.logout(request, {
+          username: 'user',
+          accessToken,
+          refreshToken,
+          realm: 'test-realm',
+        })
       ).resolves.toEqual(
         DeauthenticationResult.redirectTo('/mock-server-basepath/security/logged_out')
       );
@@ -1228,6 +1433,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'user',
           accessToken: 'x-saml-token',
           refreshToken: 'x-saml-refresh-token',
+          realm: 'test-realm',
         })
       ).resolves.toEqual(
         DeauthenticationResult.redirectTo('/mock-server-basepath/security/logged_out')
@@ -1235,10 +1441,7 @@ describe('SAMLAuthenticationProvider', () => {
 
       expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledTimes(1);
       expect(mockOptions.client.callAsInternalUser).toHaveBeenCalledWith('shield.samlInvalidate', {
-        body: {
-          queryString: 'SAMLRequest=xxx%20yyy',
-          acs: 'test-protocol://test-hostname:1234/mock-server-basepath/api/security/v1/saml',
-        },
+        body: { queryString: 'SAMLRequest=xxx%20yyy', realm: 'test-realm' },
       });
     });
 
@@ -1288,7 +1491,12 @@ describe('SAMLAuthenticationProvider', () => {
       });
 
       await expect(
-        provider.logout(request, { username: 'user', accessToken, refreshToken })
+        provider.logout(request, {
+          username: 'user',
+          accessToken,
+          refreshToken,
+          realm: 'test-realm',
+        })
       ).resolves.toEqual(
         DeauthenticationResult.redirectTo('http://fake-idp/SLO?SAMLRequest=7zlH37H')
       );
@@ -1308,6 +1516,7 @@ describe('SAMLAuthenticationProvider', () => {
           username: 'user',
           accessToken: 'x-saml-token',
           refreshToken: 'x-saml-refresh-token',
+          realm: 'test-realm',
         })
       ).resolves.toEqual(
         DeauthenticationResult.redirectTo('http://fake-idp/SLO?SAMLRequest=7zlH37H')
diff --git a/x-pack/plugins/security/server/authentication/providers/saml.ts b/x-pack/plugins/security/server/authentication/providers/saml.ts
index d56892785d0e0..aabe711e48760 100644
--- a/x-pack/plugins/security/server/authentication/providers/saml.ts
+++ b/x-pack/plugins/security/server/authentication/providers/saml.ts
@@ -7,11 +7,10 @@
 import Boom from 'boom';
 import { ByteSizeValue } from '@kbn/config-schema';
 import { KibanaRequest } from '../../../../../../src/core/server';
-import { AuthenticatedUser } from '../../../common/model';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
 import { canRedirectRequest } from '../can_redirect_request';
-import { getHTTPAuthenticationScheme } from '../get_http_authentication_scheme';
+import { HTTPAuthorizationHeader } from '../http_authentication';
 import { Tokens, TokenPair } from '../tokens';
 import { AuthenticationProviderOptions, BaseAuthenticationProvider } from './base';
 
@@ -33,37 +32,54 @@ interface ProviderState extends Partial<TokenPair> {
    * initiate SAML handshake and where we should redirect user after successful authentication.
    */
   redirectURL?: string;
+
+  /**
+   * The name of the SAML realm that was used to establish session (may not be known during URL
+   * fragment capturing stage).
+   */
+  realm?: string;
 }
 
 /**
- * Describes possible SAML Login steps.
+ * Describes possible SAML Login flows.
  */
-export enum SAMLLoginStep {
+export enum SAMLLogin {
   /**
-   * The final login step when IdP responds with SAML Response payload.
+   * The login flow when user initiates SAML handshake (SP Initiated Login).
    */
-  SAMLResponseReceived = 'saml-response-received',
+  LoginInitiatedByUser = 'login-by-user',
   /**
-   * The login step when we've captured user URL fragment and ready to start SAML handshake.
+   * The login flow when IdP responds with SAML Response payload (last step of the SP Initiated
+   * Login or IdP initiated Login).
    */
-  RedirectURLFragmentCaptured = 'redirect-url-fragment-captured',
+  LoginWithSAMLResponse = 'login-saml-response',
 }
 
 /**
  * Describes the parameters that are required by the provider to process the initial login request.
  */
 type ProviderLoginAttempt =
-  | { step: SAMLLoginStep.RedirectURLFragmentCaptured; redirectURLFragment: string }
-  | { step: SAMLLoginStep.SAMLResponseReceived; samlResponse: string };
+  | { type: SAMLLogin.LoginInitiatedByUser; redirectURLPath?: string; redirectURLFragment?: string }
+  | { type: SAMLLogin.LoginWithSAMLResponse; samlResponse: string };
 
 /**
  * Checks whether request query includes SAML request from IdP.
  * @param query Parsed HTTP request query.
  */
-export function isSAMLRequestQuery(query: any): query is { SAMLRequest: string } {
+function isSAMLRequestQuery(query: any): query is { SAMLRequest: string } {
   return query && query.SAMLRequest;
 }
 
+/**
+ * Checks whether current request can initiate new session.
+ * @param request Request instance.
+ */
+function canStartNewSession(request: KibanaRequest) {
+  // We should try to establish new session only if request requires authentication and client
+  // can be redirected to the Identity Provider where they can authenticate.
+  return canRedirectRequest(request) && request.route.options.authRequired === true;
+}
+
 /**
  * Provider that supports SAML request authentication.
  */
@@ -111,31 +127,23 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
   ) {
     this.logger.debug('Trying to perform a login.');
 
-    if (attempt.step === SAMLLoginStep.RedirectURLFragmentCaptured) {
-      if (!state || !state.redirectURL) {
-        const message = 'State does not include URL path to redirect to.';
+    // It may happen that Kibana is re-configured to use different realm for the same provider name,
+    // we should clear such session an log user out.
+    if (state && this.realm && state.realm !== this.realm) {
+      const message = `State based on realm "${state.realm}", but provider with the name "${this.options.name}" is configured to use realm "${this.realm}".`;
+      this.logger.debug(message);
+      return AuthenticationResult.failed(Boom.unauthorized(message));
+    }
+
+    if (attempt.type === SAMLLogin.LoginInitiatedByUser) {
+      const redirectURLPath = attempt.redirectURLPath || state?.redirectURL;
+      if (!redirectURLPath) {
+        const message = 'State or login attempt does not include URL path to redirect to.';
         this.logger.debug(message);
         return AuthenticationResult.failed(Boom.badRequest(message));
       }
 
-      let redirectURLFragment = attempt.redirectURLFragment;
-      if (redirectURLFragment.length > 0 && !redirectURLFragment.startsWith('#')) {
-        this.logger.warn('Redirect URL fragment does not start with `#`.');
-        redirectURLFragment = `#${redirectURLFragment}`;
-      }
-
-      let redirectURL = `${state.redirectURL}${redirectURLFragment}`;
-      const redirectURLSize = new ByteSizeValue(Buffer.byteLength(redirectURL));
-      if (this.maxRedirectURLSize.isLessThan(redirectURLSize)) {
-        this.logger.warn(
-          `Max URL size should not exceed ${this.maxRedirectURLSize.toString()} but it was ${redirectURLSize.toString()}. Only URL path is captured.`
-        );
-        redirectURL = state.redirectURL;
-      } else {
-        this.logger.debug('Captured redirect URL.');
-      }
-
-      return this.authenticateViaHandshake(request, redirectURL);
+      return this.captureRedirectURL(request, redirectURLPath, attempt.redirectURLFragment);
     }
 
     const { samlResponse } = attempt;
@@ -155,8 +163,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
       return await this.loginWithNewSAMLResponse(
         request,
         samlResponse,
-        (authenticationResult.state || state) as ProviderState,
-        authenticationResult.user as AuthenticatedUser
+        (authenticationResult.state || state) as ProviderState
       );
     }
 
@@ -180,11 +187,19 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
   public async authenticate(request: KibanaRequest, state?: ProviderState | null) {
     this.logger.debug(`Trying to authenticate user request to ${request.url.path}.`);
 
-    if (getHTTPAuthenticationScheme(request) != null) {
+    if (HTTPAuthorizationHeader.parseFromRequest(request) != null) {
       this.logger.debug('Cannot authenticate requests with `Authorization` header.');
       return AuthenticationResult.notHandled();
     }
 
+    // It may happen that Kibana is re-configured to use different realm for the same provider name,
+    // we should clear such session an log user out.
+    if (state && this.realm && state.realm !== this.realm) {
+      const message = `State based on realm "${state.realm}", but provider with the name "${this.options.name}" is configured to use realm "${this.realm}".`;
+      this.logger.debug(message);
+      return AuthenticationResult.failed(Boom.unauthorized(message));
+    }
+
     let authenticationResult = AuthenticationResult.notHandled();
     if (state) {
       authenticationResult = await this.authenticateViaState(request, state);
@@ -198,7 +213,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
 
     // If we couldn't authenticate by means of all methods above, let's try to capture user URL and
     // initiate SAML handshake, otherwise just return authentication result we have.
-    return authenticationResult.notHandled() && canRedirectRequest(request)
+    return authenticationResult.notHandled() && canStartNewSession(request)
       ? this.captureRedirectURL(request)
       : authenticationResult;
   }
@@ -211,15 +226,23 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
   public async logout(request: KibanaRequest, state?: ProviderState) {
     this.logger.debug(`Trying to log user out via ${request.url.path}.`);
 
-    if ((!state || !state.accessToken) && !isSAMLRequestQuery(request.query)) {
-      this.logger.debug('There is neither access token nor SAML session to invalidate.');
+    // Normally when there is no active session in Kibana, `logout` method shouldn't do anything
+    // and user will eventually be redirected to the home page to log in. But when SAML is enabled
+    // there is a special case when logout is initiated by the IdP or another SP, then IdP will
+    // request _every_ SP associated with the current user session to do the logout. So if Kibana,
+    // without an active session, receives such request it shouldn't redirect user to the home page,
+    // but rather redirect back to IdP with correct logout response and only Elasticsearch knows how
+    // to do that.
+    const isIdPInitiatedSLO = isSAMLRequestQuery(request.query);
+    if (!state?.accessToken && !isIdPInitiatedSLO) {
+      this.logger.debug('There is no SAML session to invalidate.');
       return DeauthenticationResult.notHandled();
     }
 
     try {
-      const redirect = isSAMLRequestQuery(request.query)
-        ? await this.performIdPInitiatedSingleLogout(request)
-        : await this.performUserInitiatedSingleLogout(state!.accessToken!, state!.refreshToken!);
+      const redirect = isIdPInitiatedSLO
+        ? await this.performIdPInitiatedSingleLogout(request, this.realm || state?.realm)
+        : await this.performUserInitiatedSingleLogout(state?.accessToken!, state?.refreshToken!);
 
       // Having non-null `redirect` field within logout response means that IdP
       // supports SAML Single Logout and we should redirect user to the specified
@@ -271,9 +294,14 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
 
     // If we have a `SAMLResponse` and state, but state doesn't contain all the necessary information,
     // then something unexpected happened and we should fail.
-    const { requestId: stateRequestId, redirectURL: stateRedirectURL } = state || {
+    const {
+      requestId: stateRequestId,
+      redirectURL: stateRedirectURL,
+      realm: stateRealm,
+    } = state || {
       requestId: '',
       redirectURL: '',
+      realm: '',
     };
     if (state && !stateRequestId) {
       const message = 'SAML response state does not have corresponding request id.';
@@ -282,12 +310,15 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     // When we don't have state and hence request id we assume that SAMLResponse came from the IdP initiated login.
+    const isIdPInitiatedLogin = !stateRequestId;
     this.logger.debug(
-      stateRequestId
+      !isIdPInitiatedLogin
         ? 'Login has been previously initiated by Kibana.'
         : 'Login has been initiated by Identity Provider.'
     );
 
+    const providerRealm = this.realm || stateRealm;
+
     try {
       // This operation should be performed on behalf of the user with a privilege that normal
       // user usually doesn't have `cluster:admin/xpack/security/saml/authenticate`.
@@ -295,22 +326,29 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
         username,
         access_token: accessToken,
         refresh_token: refreshToken,
+        realm,
       } = await this.options.client.callAsInternalUser('shield.samlAuthenticate', {
         body: {
-          ids: stateRequestId ? [stateRequestId] : [],
+          ids: !isIdPInitiatedLogin ? [stateRequestId] : [],
           content: samlResponse,
-          ...(this.realm ? { realm: this.realm } : {}),
+          ...(providerRealm ? { realm: providerRealm } : {}),
         },
       });
 
       this.logger.debug('Login has been performed with SAML response.');
       return AuthenticationResult.redirectTo(
         stateRedirectURL || `${this.options.basePath.get(request)}/`,
-        { state: { username, accessToken, refreshToken } }
+        { state: { username, accessToken, refreshToken, realm } }
       );
     } catch (err) {
       this.logger.debug(`Failed to log in with SAML response: ${err.message}`);
-      return AuthenticationResult.failed(err);
+
+      // Since we don't know upfront what realm is targeted by the Identity Provider initiated login
+      // there is a chance that it failed because of realm mismatch and hence we should return
+      // `notHandled` and give other SAML providers a chance to properly handle it instead.
+      return isIdPInitiatedLogin && providerRealm
+        ? AuthenticationResult.notHandled()
+        : AuthenticationResult.failed(err);
     }
   }
 
@@ -325,19 +363,17 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
    * @param request Request instance.
    * @param samlResponse SAMLResponse payload string.
    * @param existingState State existing user session is based on.
-   * @param user User returned for the existing session.
    */
   private async loginWithNewSAMLResponse(
     request: KibanaRequest,
     samlResponse: string,
-    existingState: ProviderState,
-    user: AuthenticatedUser
+    existingState: ProviderState
   ) {
     this.logger.debug('Trying to log in with SAML response payload and existing valid session.');
 
     // First let's try to authenticate via SAML Response payload.
     const payloadAuthenticationResult = await this.loginWithSAMLResponse(request, samlResponse);
-    if (payloadAuthenticationResult.failed()) {
+    if (payloadAuthenticationResult.failed() || payloadAuthenticationResult.notHandled()) {
       return payloadAuthenticationResult;
     }
 
@@ -349,31 +385,6 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     const newState = payloadAuthenticationResult.state as ProviderState;
-    let differentUser = newState.username !== user.username;
-
-    // If realm name is not configured we can't be sure that user is authenticated by the same realm
-    // even though user name is the same.
-    if (!differentUser && !this.realm) {
-      // Then use received tokens to retrieve user information. We need just username and authentication
-      // realm, once ES starts returning this info from `saml/authenticate` we can get rid of this call.
-      const newUserAuthenticationResult = await this.authenticateViaState(request, newState);
-      if (newUserAuthenticationResult.failed()) {
-        return newUserAuthenticationResult;
-      }
-
-      if (newUserAuthenticationResult.user === undefined) {
-        // Should never happen, but if it does - it's a bug.
-        return AuthenticationResult.failed(
-          new Error(
-            'Could not retrieve user information using tokens produced for the SAML payload.'
-          )
-        );
-      }
-
-      differentUser =
-        newUserAuthenticationResult.user.authentication_realm.name !==
-        user.authentication_realm.name;
-    }
 
     // Now let's invalidate tokens from the existing session.
     try {
@@ -387,7 +398,9 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
       return AuthenticationResult.failed(err);
     }
 
-    if (differentUser) {
+    // At this stage both `existingState` and `newState` should already include `realm` and `username`
+    // returned from saml/authenticate.
+    if (newState.username !== existingState.username || newState.realm !== existingState.realm) {
       this.logger.debug(
         'Login initiated by Identity Provider is for a different user than currently authenticated.'
       );
@@ -416,7 +429,9 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     try {
-      const authHeaders = { authorization: `Bearer ${accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader('Bearer', accessToken).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Request has been authenticated via state.');
@@ -436,7 +451,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
    */
   private async authenticateViaRefreshToken(
     request: KibanaRequest,
-    { username, refreshToken }: ProviderState
+    { username, refreshToken, realm }: ProviderState
   ) {
     this.logger.debug('Trying to refresh access token.');
 
@@ -458,7 +473,7 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
     // There are two reasons for `400` and not `401`: Elasticsearch search responds with `400` so it seems logical
     // to do the same on Kibana side and `401` would force user to logout and do full SLO if it's supported.
     if (refreshedTokenPair === null) {
-      if (canRedirectRequest(request)) {
+      if (canStartNewSession(request)) {
         this.logger.debug(
           'Both access and refresh tokens are expired. Capturing redirect URL and re-initiating SAML handshake.'
         );
@@ -471,13 +486,18 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     try {
-      const authHeaders = { authorization: `Bearer ${refreshedTokenPair.accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader(
+          'Bearer',
+          refreshedTokenPair.accessToken
+        ).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Request has been authenticated via refreshed token.');
       return AuthenticationResult.succeeded(user, {
         authHeaders,
-        state: { username, ...refreshedTokenPair },
+        state: { username, realm: this.realm || realm, ...refreshedTokenPair },
       });
     } catch (err) {
       this.logger.debug(
@@ -495,19 +515,13 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
   private async authenticateViaHandshake(request: KibanaRequest, redirectURL: string) {
     this.logger.debug('Trying to initiate SAML handshake.');
 
-    // If client can't handle redirect response, we shouldn't initiate SAML handshake.
-    if (!canRedirectRequest(request)) {
-      this.logger.debug('SAML handshake can not be initiated by AJAX requests.');
-      return AuthenticationResult.notHandled();
-    }
-
     try {
       // Prefer realm name if it's specified, otherwise fallback to ACS.
       const preparePayload = this.realm ? { realm: this.realm } : { acs: this.getACS() };
 
       // This operation should be performed on behalf of the user with a privilege that normal
       // user usually doesn't have `cluster:admin/xpack/security/saml/prepare`.
-      const { id: requestId, redirect } = await this.options.client.callAsInternalUser(
+      const { id: requestId, redirect, realm } = await this.options.client.callAsInternalUser(
         'shield.samlPrepare',
         {
           body: preparePayload,
@@ -517,7 +531,9 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
       this.logger.debug('Redirecting to Identity Provider with SAML request.');
 
       // Store request id in the state so that we can reuse it once we receive `SAMLResponse`.
-      return AuthenticationResult.redirectTo(redirect, { state: { requestId, redirectURL } });
+      return AuthenticationResult.redirectTo(redirect, {
+        state: { requestId, redirectURL, realm },
+      });
     } catch (err) {
       this.logger.debug(`Failed to initiate SAML handshake: ${err.message}`);
       return AuthenticationResult.failed(err);
@@ -547,12 +563,13 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
    * Calls `saml/invalidate` with the `SAMLRequest` query string parameter received from the Identity
    * Provider and redirects user back to the Identity Provider if needed.
    * @param request Request instance.
+   * @param realm Configured SAML realm name.
    */
-  private async performIdPInitiatedSingleLogout(request: KibanaRequest) {
+  private async performIdPInitiatedSingleLogout(request: KibanaRequest, realm?: string) {
     this.logger.debug('Single logout has been initiated by the Identity Provider.');
 
     // Prefer realm name if it's specified, otherwise fallback to ACS.
-    const invalidatePayload = this.realm ? { realm: this.realm } : { acs: this.getACS() };
+    const invalidatePayload = realm ? { realm } : { acs: this.getACS() };
 
     // This operation should be performed on behalf of the user with a privilege that normal
     // user usually doesn't have `cluster:admin/xpack/security/saml/invalidate`.
@@ -579,18 +596,23 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
   }
 
   /**
-   * Redirects user to the client-side page that will grab URL fragment and redirect user back to Kibana
-   * to initiate SAML handshake.
+   * Tries to capture full redirect URL (both path and fragment) and initiate SAML handshake.
    * @param request Request instance.
+   * @param [redirectURLPath] Optional URL path user is supposed to be redirected to after successful
+   * login. If not provided the URL path of the specified request is used.
+   * @param [redirectURLFragment] Optional URL fragment of the URL user is supposed to be redirected
+   * to after successful login. If not provided user will be redirected to the client-side page that
+   * will grab it and redirect user back to Kibana to initiate SAML handshake.
    */
-  private captureRedirectURL(request: KibanaRequest) {
-    const basePath = this.options.basePath.get(request);
-    const redirectURL = `${basePath}${request.url.path}`;
-
+  private captureRedirectURL(
+    request: KibanaRequest,
+    redirectURLPath = `${this.options.basePath.get(request)}${request.url.path}`,
+    redirectURLFragment?: string
+  ) {
     // If the size of the path already exceeds the maximum allowed size of the URL to store in the
     // session there is no reason to try to capture URL fragment and we start handshake immediately.
     // In this case user will be redirected to the Kibana home/root after successful login.
-    const redirectURLSize = new ByteSizeValue(Buffer.byteLength(redirectURL));
+    let redirectURLSize = new ByteSizeValue(Buffer.byteLength(redirectURLPath));
     if (this.maxRedirectURLSize.isLessThan(redirectURLSize)) {
       this.logger.warn(
         `Max URL path size should not exceed ${this.maxRedirectURLSize.toString()} but it was ${redirectURLSize.toString()}. URL is not captured.`
@@ -598,9 +620,30 @@ export class SAMLAuthenticationProvider extends BaseAuthenticationProvider {
       return this.authenticateViaHandshake(request, '');
     }
 
-    return AuthenticationResult.redirectTo(
-      `${this.options.basePath.serverBasePath}/api/security/saml/capture-url-fragment`,
-      { state: { redirectURL } }
-    );
+    // If URL fragment wasn't specified at all, let's try to capture it.
+    if (redirectURLFragment === undefined) {
+      return AuthenticationResult.redirectTo(
+        `${this.options.basePath.serverBasePath}/internal/security/saml/capture-url-fragment`,
+        { state: { redirectURL: redirectURLPath, realm: this.realm } }
+      );
+    }
+
+    if (redirectURLFragment.length > 0 && !redirectURLFragment.startsWith('#')) {
+      this.logger.warn('Redirect URL fragment does not start with `#`.');
+      redirectURLFragment = `#${redirectURLFragment}`;
+    }
+
+    let redirectURL = `${redirectURLPath}${redirectURLFragment}`;
+    redirectURLSize = new ByteSizeValue(Buffer.byteLength(redirectURL));
+    if (this.maxRedirectURLSize.isLessThan(redirectURLSize)) {
+      this.logger.warn(
+        `Max URL size should not exceed ${this.maxRedirectURLSize.toString()} but it was ${redirectURLSize.toString()}. Only URL path is captured.`
+      );
+      redirectURL = redirectURLPath;
+    } else {
+      this.logger.debug('Captured redirect URL.');
+    }
+
+    return this.authenticateViaHandshake(request, redirectURL);
   }
 }
diff --git a/x-pack/plugins/security/server/authentication/providers/token.test.ts b/x-pack/plugins/security/server/authentication/providers/token.test.ts
index e81d14e8bf9f3..7472adb30307c 100644
--- a/x-pack/plugins/security/server/authentication/providers/token.test.ts
+++ b/x-pack/plugins/security/server/authentication/providers/token.test.ts
@@ -36,7 +36,7 @@ describe('TokenAuthenticationProvider', () => {
   let provider: TokenAuthenticationProvider;
   let mockOptions: MockAuthenticationProviderOptions;
   beforeEach(() => {
-    mockOptions = mockAuthenticationProviderOptions();
+    mockOptions = mockAuthenticationProviderOptions({ name: 'token' });
     provider = new TokenAuthenticationProvider(mockOptions);
   });
 
@@ -163,6 +163,12 @@ describe('TokenAuthenticationProvider', () => {
       ).resolves.toEqual(AuthenticationResult.notHandled());
     });
 
+    it('does not redirect requests that do not require authentication to the login page.', async () => {
+      await expect(
+        provider.authenticate(httpServerMock.createKibanaRequest({ routeAuthRequired: false }))
+      ).resolves.toEqual(AuthenticationResult.notHandled());
+    });
+
     it('redirects non-AJAX requests that can not be authenticated to the login page.', async () => {
       await expect(
         provider.authenticate(
@@ -346,6 +352,35 @@ describe('TokenAuthenticationProvider', () => {
       expect(request.headers).not.toHaveProperty('authorization');
     });
 
+    it('does not redirect non-AJAX requests that do not require authentication if token token cannot be refreshed', async () => {
+      const request = httpServerMock.createKibanaRequest({
+        headers: {},
+        routeAuthRequired: false,
+        path: '/some-path',
+      });
+      const tokenPair = { accessToken: 'foo', refreshToken: 'bar' };
+      const authorization = `Bearer ${tokenPair.accessToken}`;
+
+      const mockScopedClusterClient = elasticsearchServiceMock.createScopedClusterClient();
+      mockScopedClusterClient.callAsCurrentUser.mockRejectedValue(
+        ElasticsearchErrorHelpers.decorateNotAuthorizedError(new Error())
+      );
+      mockOptions.client.asScoped.mockReturnValue(mockScopedClusterClient);
+
+      mockOptions.tokens.refresh.mockResolvedValue(null);
+
+      await expect(provider.authenticate(request, tokenPair)).resolves.toEqual(
+        AuthenticationResult.failed(Boom.badRequest('Both access and refresh tokens are expired.'))
+      );
+
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledTimes(1);
+      expect(mockOptions.tokens.refresh).toHaveBeenCalledWith(tokenPair.refreshToken);
+
+      expectAuthenticateCall(mockOptions.client, { headers: { authorization } });
+
+      expect(request.headers).not.toHaveProperty('authorization');
+    });
+
     it('fails if new access token is rejected after successful refresh', async () => {
       const request = httpServerMock.createKibanaRequest();
       const tokenPair = { accessToken: 'foo', refreshToken: 'bar' };
@@ -386,15 +421,13 @@ describe('TokenAuthenticationProvider', () => {
   });
 
   describe('`logout` method', () => {
-    it('returns `redirected` if state is not presented.', async () => {
+    it('returns `notHandled` if state is not presented.', async () => {
       const request = httpServerMock.createKibanaRequest();
 
-      await expect(provider.logout(request)).resolves.toEqual(
-        DeauthenticationResult.redirectTo('/base-path/login?msg=LOGGED_OUT')
-      );
+      await expect(provider.logout(request)).resolves.toEqual(DeauthenticationResult.notHandled());
 
       await expect(provider.logout(request, null)).resolves.toEqual(
-        DeauthenticationResult.redirectTo('/base-path/login?msg=LOGGED_OUT')
+        DeauthenticationResult.notHandled()
       );
 
       expect(mockOptions.tokens.invalidate).not.toHaveBeenCalled();
diff --git a/x-pack/plugins/security/server/authentication/providers/token.ts b/x-pack/plugins/security/server/authentication/providers/token.ts
index fffac254ed30a..abf4c293c4c53 100644
--- a/x-pack/plugins/security/server/authentication/providers/token.ts
+++ b/x-pack/plugins/security/server/authentication/providers/token.ts
@@ -9,7 +9,7 @@ import { KibanaRequest } from '../../../../../../src/core/server';
 import { AuthenticationResult } from '../authentication_result';
 import { DeauthenticationResult } from '../deauthentication_result';
 import { canRedirectRequest } from '../can_redirect_request';
-import { getHTTPAuthenticationScheme } from '../get_http_authentication_scheme';
+import { HTTPAuthorizationHeader } from '../http_authentication';
 import { Tokens, TokenPair } from '../tokens';
 import { BaseAuthenticationProvider } from './base';
 
@@ -26,6 +26,16 @@ interface ProviderLoginAttempt {
  */
 type ProviderState = TokenPair;
 
+/**
+ * Checks whether current request can initiate new session.
+ * @param request Request instance.
+ */
+function canStartNewSession(request: KibanaRequest) {
+  // We should try to establish new session only if request requires authentication and client
+  // can be redirected to the login page where they can enter username and password.
+  return canRedirectRequest(request) && request.route.options.authRequired === true;
+}
+
 /**
  * Provider that supports token-based request authentication.
  */
@@ -60,7 +70,9 @@ export class TokenAuthenticationProvider extends BaseAuthenticationProvider {
       this.logger.debug('Get token API request to Elasticsearch successful');
 
       // Then attempt to query for the user details using the new token
-      const authHeaders = { authorization: `Bearer ${accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader('Bearer', accessToken).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Login has been successfully performed.');
@@ -82,7 +94,7 @@ export class TokenAuthenticationProvider extends BaseAuthenticationProvider {
   public async authenticate(request: KibanaRequest, state?: ProviderState | null) {
     this.logger.debug(`Trying to authenticate user request to ${request.url.path}.`);
 
-    if (getHTTPAuthenticationScheme(request) != null) {
+    if (HTTPAuthorizationHeader.parseFromRequest(request) != null) {
       this.logger.debug('Cannot authenticate requests with `Authorization` header.');
       return AuthenticationResult.notHandled();
     }
@@ -100,7 +112,7 @@ export class TokenAuthenticationProvider extends BaseAuthenticationProvider {
 
     // finally, if authentication still can not be handled for this
     // request/state combination, redirect to the login page if appropriate
-    if (authenticationResult.notHandled() && canRedirectRequest(request)) {
+    if (authenticationResult.notHandled() && canStartNewSession(request)) {
       this.logger.debug('Redirecting request to Login page.');
       authenticationResult = AuthenticationResult.redirectTo(this.getLoginPageURL(request));
     }
@@ -116,16 +128,17 @@ export class TokenAuthenticationProvider extends BaseAuthenticationProvider {
   public async logout(request: KibanaRequest, state?: ProviderState | null) {
     this.logger.debug(`Trying to log user out via ${request.url.path}.`);
 
-    if (state) {
-      this.logger.debug('Token-based logout has been initiated by the user.');
-      try {
-        await this.options.tokens.invalidate(state);
-      } catch (err) {
-        this.logger.debug(`Failed invalidating user's access token: ${err.message}`);
-        return DeauthenticationResult.failed(err);
-      }
-    } else {
+    if (!state) {
       this.logger.debug('There are no access and refresh tokens to invalidate.');
+      return DeauthenticationResult.notHandled();
+    }
+
+    this.logger.debug('Token-based logout has been initiated by the user.');
+    try {
+      await this.options.tokens.invalidate(state);
+    } catch (err) {
+      this.logger.debug(`Failed invalidating user's access token: ${err.message}`);
+      return DeauthenticationResult.failed(err);
     }
 
     const queryString = request.url.search || `?msg=LOGGED_OUT`;
@@ -152,7 +165,9 @@ export class TokenAuthenticationProvider extends BaseAuthenticationProvider {
     this.logger.debug('Trying to authenticate via state.');
 
     try {
-      const authHeaders = { authorization: `Bearer ${accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader('Bearer', accessToken).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Request has been authenticated via state.');
@@ -186,7 +201,7 @@ export class TokenAuthenticationProvider extends BaseAuthenticationProvider {
     // If refresh token is no longer valid, then we should clear session and redirect user to the
     // login page to re-authenticate, or fail if redirect isn't possible.
     if (refreshedTokenPair === null) {
-      if (canRedirectRequest(request)) {
+      if (canStartNewSession(request)) {
         this.logger.debug('Clearing session since both access and refresh tokens are expired.');
 
         // Set state to `null` to let `Authenticator` know that we want to clear current session.
@@ -199,7 +214,12 @@ export class TokenAuthenticationProvider extends BaseAuthenticationProvider {
     }
 
     try {
-      const authHeaders = { authorization: `Bearer ${refreshedTokenPair.accessToken}` };
+      const authHeaders = {
+        authorization: new HTTPAuthorizationHeader(
+          'Bearer',
+          refreshedTokenPair.accessToken
+        ).toString(),
+      };
       const user = await this.getUser(request, authHeaders);
 
       this.logger.debug('Request has been authenticated via refreshed token.');
diff --git a/x-pack/plugins/security/server/authorization/actions/actions.ts b/x-pack/plugins/security/server/authorization/actions/actions.ts
index 4bf7a41550cc6..00293e88abe76 100644
--- a/x-pack/plugins/security/server/authorization/actions/actions.ts
+++ b/x-pack/plugins/security/server/authorization/actions/actions.ts
@@ -15,13 +15,6 @@ import { UIActions } from './ui';
  * by the various `checkPrivilegesWithRequest` derivatives
  */
 export class Actions {
-  /**
-   * The allHack action is used to differentiate the `all` privilege from the `read` privilege
-   * for those applications which register the same set of actions for both privileges. This is a
-   * temporary hack until we remove this assumption in the role management UI
-   */
-  public readonly allHack = 'allHack:';
-
   public readonly api = new ApiActions(this.versionNumber);
 
   public readonly app = new AppActions(this.versionNumber);
diff --git a/x-pack/plugins/security/server/authorization/actions/api.test.ts b/x-pack/plugins/security/server/authorization/actions/api.test.ts
index 60a42ba6a78a2..d6e7a5d242d49 100644
--- a/x-pack/plugins/security/server/authorization/actions/api.test.ts
+++ b/x-pack/plugins/security/server/authorization/actions/api.test.ts
@@ -8,13 +8,6 @@ import { ApiActions } from './api';
 
 const version = '1.0.0-zeta1';
 
-describe('#all', () => {
-  test('returns `api:${version}:*`', () => {
-    const apiActions = new ApiActions(version);
-    expect(apiActions.all).toBe('api:1.0.0-zeta1:*');
-  });
-});
-
 describe('#get', () => {
   [null, undefined, '', 1, true, {}].forEach((operation: any) => {
     test(`operation of ${JSON.stringify(operation)} throws error`, () => {
diff --git a/x-pack/plugins/security/server/authorization/actions/api.ts b/x-pack/plugins/security/server/authorization/actions/api.ts
index 35e614e7a03d4..60b135acc15ef 100644
--- a/x-pack/plugins/security/server/authorization/actions/api.ts
+++ b/x-pack/plugins/security/server/authorization/actions/api.ts
@@ -12,10 +12,6 @@ export class ApiActions {
     this.prefix = `api:${versionNumber}:`;
   }
 
-  public get all(): string {
-    return `${this.prefix}*`;
-  }
-
   public get(operation: string) {
     if (!operation || !isString(operation)) {
       throw new Error('operation is required and must be a string');
diff --git a/x-pack/plugins/security/server/authorization/actions/app.test.ts b/x-pack/plugins/security/server/authorization/actions/app.test.ts
index a696fd8693997..74c372a0699a2 100644
--- a/x-pack/plugins/security/server/authorization/actions/app.test.ts
+++ b/x-pack/plugins/security/server/authorization/actions/app.test.ts
@@ -8,13 +8,6 @@ import { AppActions } from './app';
 
 const version = '1.0.0-zeta1';
 
-describe('#all', () => {
-  test('returns `app:${version}:*`', () => {
-    const appActions = new AppActions(version);
-    expect(appActions.all).toBe('app:1.0.0-zeta1:*');
-  });
-});
-
 describe('#get', () => {
   [null, undefined, '', 1, true, {}].forEach((appid: any) => {
     test(`appId of ${JSON.stringify(appid)} throws error`, () => {
diff --git a/x-pack/plugins/security/server/authorization/actions/app.ts b/x-pack/plugins/security/server/authorization/actions/app.ts
index ed0854e8a805b..227c658619175 100644
--- a/x-pack/plugins/security/server/authorization/actions/app.ts
+++ b/x-pack/plugins/security/server/authorization/actions/app.ts
@@ -12,10 +12,6 @@ export class AppActions {
     this.prefix = `app:${versionNumber}:`;
   }
 
-  public get all(): string {
-    return `${this.prefix}*`;
-  }
-
   public get(appId: string) {
     if (!appId || !isString(appId)) {
       throw new Error('appId is required and must be a string');
diff --git a/x-pack/plugins/security/server/authorization/actions/saved_object.test.ts b/x-pack/plugins/security/server/authorization/actions/saved_object.test.ts
index 5e5da7233d93e..9e8bfb6ad795f 100644
--- a/x-pack/plugins/security/server/authorization/actions/saved_object.test.ts
+++ b/x-pack/plugins/security/server/authorization/actions/saved_object.test.ts
@@ -8,13 +8,6 @@ import { SavedObjectActions } from './saved_object';
 
 const version = '1.0.0-zeta1';
 
-describe('#all', () => {
-  test(`returns saved_object:*`, () => {
-    const savedObjectActions = new SavedObjectActions(version);
-    expect(savedObjectActions.all).toBe('saved_object:1.0.0-zeta1:*');
-  });
-});
-
 describe('#get', () => {
   [null, undefined, '', 1, true, {}].forEach((type: any) => {
     test(`type of ${JSON.stringify(type)} throws error`, () => {
diff --git a/x-pack/plugins/security/server/authorization/actions/saved_object.ts b/x-pack/plugins/security/server/authorization/actions/saved_object.ts
index 4a0bc7cda1b8f..e3a02d3807399 100644
--- a/x-pack/plugins/security/server/authorization/actions/saved_object.ts
+++ b/x-pack/plugins/security/server/authorization/actions/saved_object.ts
@@ -13,10 +13,6 @@ export class SavedObjectActions {
     this.prefix = `saved_object:${versionNumber}:`;
   }
 
-  public get all(): string {
-    return `${this.prefix}*`;
-  }
-
   public get(type: string, operation: string): string {
     if (!type || !isString(type)) {
       throw new Error('type is required and must be a string');
diff --git a/x-pack/plugins/security/server/authorization/actions/ui.test.ts b/x-pack/plugins/security/server/authorization/actions/ui.test.ts
index f91b7baf78baa..32827822117d0 100644
--- a/x-pack/plugins/security/server/authorization/actions/ui.test.ts
+++ b/x-pack/plugins/security/server/authorization/actions/ui.test.ts
@@ -8,34 +8,6 @@ import { UIActions } from './ui';
 
 const version = '1.0.0-zeta1';
 
-describe('#all', () => {
-  test('returns `ui:${version}:*`', () => {
-    const uiActions = new UIActions(version);
-    expect(uiActions.all).toBe('ui:1.0.0-zeta1:*');
-  });
-});
-
-describe('#allNavlinks', () => {
-  test('returns `ui:${version}:navLinks/*`', () => {
-    const uiActions = new UIActions(version);
-    expect(uiActions.allNavLinks).toBe('ui:1.0.0-zeta1:navLinks/*');
-  });
-});
-
-describe('#allCatalogueEntries', () => {
-  test('returns `ui:${version}:catalogue/*`', () => {
-    const uiActions = new UIActions(version);
-    expect(uiActions.allCatalogueEntries).toBe('ui:1.0.0-zeta1:catalogue/*');
-  });
-});
-
-describe('#allManagementLinks', () => {
-  test('returns `ui:${version}:management/*`', () => {
-    const uiActions = new UIActions(version);
-    expect(uiActions.allManagementLinks).toBe('ui:1.0.0-zeta1:management/*');
-  });
-});
-
 describe('#get', () => {
   [null, undefined, '', 1, true, {}].forEach((featureId: any) => {
     test(`featureId of ${JSON.stringify(featureId)} throws error`, () => {
diff --git a/x-pack/plugins/security/server/authorization/actions/ui.ts b/x-pack/plugins/security/server/authorization/actions/ui.ts
index 9e77c319a9b3a..3dae9a47b3827 100644
--- a/x-pack/plugins/security/server/authorization/actions/ui.ts
+++ b/x-pack/plugins/security/server/authorization/actions/ui.ts
@@ -14,22 +14,6 @@ export class UIActions {
     this.prefix = `ui:${versionNumber}:`;
   }
 
-  public get all(): string {
-    return `${this.prefix}*`;
-  }
-
-  public get allNavLinks(): string {
-    return `${this.prefix}navLinks/*`;
-  }
-
-  public get allCatalogueEntries(): string {
-    return `${this.prefix}catalogue/*`;
-  }
-
-  public get allManagementLinks(): string {
-    return `${this.prefix}management/*`;
-  }
-
   public get(featureId: keyof UICapabilities, ...uiCapabilityParts: string[]) {
     if (!featureId || !isString(featureId)) {
       throw new Error('featureId is required and must be a string');
diff --git a/x-pack/plugins/security/server/authorization/disable_ui_capabilities.test.ts b/x-pack/plugins/security/server/authorization/disable_ui_capabilities.test.ts
index 49c9db2d0e6e3..912ae60e12065 100644
--- a/x-pack/plugins/security/server/authorization/disable_ui_capabilities.test.ts
+++ b/x-pack/plugins/security/server/authorization/disable_ui_capabilities.test.ts
@@ -9,6 +9,7 @@ import { disableUICapabilitiesFactory } from './disable_ui_capabilities';
 
 import { httpServerMock, loggingServiceMock } from '../../../../../src/core/server/mocks';
 import { authorizationMock } from './index.mock';
+import { Feature } from '../../../features/server';
 
 type MockAuthzOptions = { rejectCheckPrivileges: any } | { resolveCheckPrivileges: any };
 
@@ -42,7 +43,15 @@ describe('usingPrivileges', () => {
 
       const { usingPrivileges } = disableUICapabilitiesFactory(
         mockRequest,
-        [{ id: 'fooFeature', name: 'Foo Feature', app: [], navLinkId: 'foo', privileges: {} }],
+        [
+          new Feature({
+            id: 'fooFeature',
+            name: 'Foo Feature',
+            app: [],
+            navLinkId: 'foo',
+            privileges: null,
+          }),
+        ],
         mockLoggers.get(),
         mockAuthz
       );
@@ -108,7 +117,15 @@ describe('usingPrivileges', () => {
 
       const { usingPrivileges } = disableUICapabilitiesFactory(
         mockRequest,
-        [{ id: 'fooFeature', name: 'Foo Feature', app: [], navLinkId: 'foo', privileges: {} }],
+        [
+          new Feature({
+            id: 'fooFeature',
+            name: 'Foo Feature',
+            app: [],
+            navLinkId: 'foo',
+            privileges: null,
+          }),
+        ],
         mockLoggers.get(),
         mockAuthz
       );
@@ -226,20 +243,20 @@ describe('usingPrivileges', () => {
     const { usingPrivileges } = disableUICapabilitiesFactory(
       mockRequest,
       [
-        {
+        new Feature({
           id: 'fooFeature',
           name: 'Foo Feature',
           navLinkId: 'foo',
           app: [],
-          privileges: {},
-        },
-        {
+          privileges: null,
+        }),
+        new Feature({
           id: 'barFeature',
           name: 'Bar Feature',
           navLinkId: 'bar',
           app: [],
-          privileges: {},
-        },
+          privileges: null,
+        }),
       ],
       loggingServiceMock.create().get(),
       mockAuthz
@@ -312,20 +329,20 @@ describe('usingPrivileges', () => {
     const { usingPrivileges } = disableUICapabilitiesFactory(
       mockRequest,
       [
-        {
+        new Feature({
           id: 'fooFeature',
           name: 'Foo Feature',
           navLinkId: 'foo',
           app: [],
-          privileges: {},
-        },
-        {
+          privileges: null,
+        }),
+        new Feature({
           id: 'barFeature',
           name: 'Bar Feature',
           navLinkId: 'bar',
           app: [],
-          privileges: {},
-        },
+          privileges: null,
+        }),
       ],
       loggingServiceMock.create().get(),
       mockAuthz
@@ -383,7 +400,15 @@ describe('all', () => {
 
     const { all } = disableUICapabilitiesFactory(
       mockRequest,
-      [{ id: 'fooFeature', name: 'Foo Feature', app: [], navLinkId: 'foo', privileges: {} }],
+      [
+        new Feature({
+          id: 'fooFeature',
+          name: 'Foo Feature',
+          app: [],
+          navLinkId: 'foo',
+          privileges: null,
+        }),
+      ],
       loggingServiceMock.create().get(),
       mockAuthz
     );
diff --git a/x-pack/plugins/security/server/authorization/index.test.ts b/x-pack/plugins/security/server/authorization/index.test.ts
index 9e99cae620633..3252053454764 100644
--- a/x-pack/plugins/security/server/authorization/index.test.ts
+++ b/x-pack/plugins/security/server/authorization/index.test.ts
@@ -93,7 +93,7 @@ test(`returns exposed services`, () => {
   );
 
   expect(authz.privileges).toBe(mockPrivilegesService);
-  expect(privilegesFactory).toHaveBeenCalledWith(authz.actions, mockFeaturesService);
+  expect(privilegesFactory).toHaveBeenCalledWith(authz.actions, mockFeaturesService, mockLicense);
 
   expect(authz.mode).toBe(mockAuthorizationMode);
   expect(authorizationModeFactory).toHaveBeenCalledWith(mockLicense);
diff --git a/x-pack/plugins/security/server/authorization/index.ts b/x-pack/plugins/security/server/authorization/index.ts
index 4cbc76ecb6be4..f065c9cfd90ba 100644
--- a/x-pack/plugins/security/server/authorization/index.ts
+++ b/x-pack/plugins/security/server/authorization/index.ts
@@ -35,6 +35,7 @@ import { SecurityLicense } from '../../common/licensing';
 
 export { Actions } from './actions';
 export { CheckSavedObjectsPrivileges } from './check_saved_objects_privileges';
+export { featurePrivilegeIterator } from './privileges';
 
 interface SetupAuthorizationParams {
   packageVersion: string;
@@ -80,7 +81,7 @@ export function setupAuthorization({
     clusterClient,
     applicationName
   );
-  const privileges = privilegesFactory(actions, featuresService);
+  const privileges = privilegesFactory(actions, featuresService, license);
   const logger = loggers.get('authorization');
 
   const authz = {
@@ -120,7 +121,7 @@ export function setupAuthorization({
     },
 
     registerPrivilegesWithCluster: async () => {
-      validateFeaturePrivileges(actions, featuresService.getFeatures());
+      validateFeaturePrivileges(featuresService.getFeatures());
 
       await registerPrivilegesWithCluster(logger, privileges, applicationName, clusterClient);
     },
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/app.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/app.ts
index c874886d908eb..514d6734b47ba 100644
--- a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/app.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/app.ts
@@ -9,7 +9,7 @@ import { BaseFeaturePrivilegeBuilder } from './feature_privilege_builder';
 
 export class FeaturePrivilegeAppBuilder extends BaseFeaturePrivilegeBuilder {
   public getActions(privilegeDefinition: FeatureKibanaPrivileges, feature: Feature): string[] {
-    const appIds = privilegeDefinition.app || feature.app;
+    const appIds = privilegeDefinition.app;
 
     if (!appIds) {
       return [];
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/catalogue.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/catalogue.ts
index 3dbe71db93f4a..fc15aff32b975 100644
--- a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/catalogue.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/catalogue.ts
@@ -9,7 +9,7 @@ import { BaseFeaturePrivilegeBuilder } from './feature_privilege_builder';
 
 export class FeaturePrivilegeCatalogueBuilder extends BaseFeaturePrivilegeBuilder {
   public getActions(privilegeDefinition: FeatureKibanaPrivileges, feature: Feature): string[] {
-    const catalogueEntries = privilegeDefinition.catalogue || feature.catalogue;
+    const catalogueEntries = privilegeDefinition.catalogue;
 
     if (!catalogueEntries) {
       return [];
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/management.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/management.ts
index 0180554a47ccc..7a2bb87d72b45 100644
--- a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/management.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/management.ts
@@ -9,7 +9,7 @@ import { BaseFeaturePrivilegeBuilder } from './feature_privilege_builder';
 
 export class FeaturePrivilegeManagementBuilder extends BaseFeaturePrivilegeBuilder {
   public getActions(privilegeDefinition: FeatureKibanaPrivileges, feature: Feature): string[] {
-    const managementSections = privilegeDefinition.management || feature.management;
+    const managementSections = privilegeDefinition.management;
 
     if (!managementSections) {
       return [];
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.test.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.test.ts
new file mode 100644
index 0000000000000..7d92eacfe6b35
--- /dev/null
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.test.ts
@@ -0,0 +1,891 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Feature } from '../../../../../features/server';
+import { featurePrivilegeIterator } from './feature_privilege_iterator';
+
+describe('featurePrivilegeIterator', () => {
+  it('handles features with no privileges', () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      privileges: null,
+      app: [],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: true,
+      })
+    );
+
+    expect(actualPrivileges).toHaveLength(0);
+  });
+
+  it('handles features with no sub-features', () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      privileges: {
+        all: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+        read: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      app: ['foo'],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: true,
+      })
+    );
+
+    expect(actualPrivileges).toEqual([
+      {
+        privilegeId: 'all',
+        privilege: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      {
+        privilegeId: 'read',
+        privilege: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+    ]);
+  });
+
+  it('filters privileges using the provided predicate', () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      privileges: {
+        all: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+        read: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      app: ['foo'],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: true,
+        predicate: privilegeId => privilegeId === 'all',
+      })
+    );
+
+    expect(actualPrivileges).toEqual([
+      {
+        privilegeId: 'all',
+        privilege: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+    ]);
+  });
+
+  it('ignores sub features when `augmentWithSubFeaturePrivileges` is false', () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      app: [],
+      privileges: {
+        all: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+        read: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'sub feature 1',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-feature-priv-1',
+                  name: 'first sub feature privilege',
+                  includeIn: 'read',
+                  api: ['sub-feature-api'],
+                  app: ['sub-app'],
+                  catalogue: ['sub-catalogue'],
+                  management: {
+                    kibana: ['sub-management'],
+                  },
+                  savedObject: {
+                    all: ['all-sub-type'],
+                    read: ['read-sub-type'],
+                  },
+                  ui: ['ui-sub-type'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: false,
+      })
+    );
+
+    expect(actualPrivileges).toEqual([
+      {
+        privilegeId: 'all',
+        privilege: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      {
+        privilegeId: 'read',
+        privilege: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+    ]);
+  });
+
+  it('ignores sub features when `includeIn` is none, even if `augmentWithSubFeaturePrivileges` is true', () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      app: [],
+      privileges: {
+        all: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+        read: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'sub feature 1',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-feature-priv-1',
+                  name: 'first sub feature privilege',
+                  includeIn: 'none',
+                  api: ['sub-feature-api'],
+                  app: ['sub-app'],
+                  catalogue: ['sub-catalogue'],
+                  management: {
+                    kibana: ['sub-management'],
+                  },
+                  savedObject: {
+                    all: ['all-sub-type'],
+                    read: ['read-sub-type'],
+                  },
+                  ui: ['ui-sub-type'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: true,
+      })
+    );
+
+    expect(actualPrivileges).toEqual([
+      {
+        privilegeId: 'all',
+        privilege: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      {
+        privilegeId: 'read',
+        privilege: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+    ]);
+  });
+
+  it('includes sub feature privileges into both all and read when`augmentWithSubFeaturePrivileges` is true and `includeIn: read`', () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      app: [],
+      privileges: {
+        all: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+        read: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'sub feature 1',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-feature-priv-1',
+                  name: 'first sub feature privilege',
+                  includeIn: 'read',
+                  api: ['sub-feature-api'],
+                  app: ['sub-app'],
+                  catalogue: ['sub-catalogue'],
+                  management: {
+                    section: ['other-sub-management'],
+                    kibana: ['sub-management'],
+                  },
+                  savedObject: {
+                    all: ['all-sub-type'],
+                    read: ['read-sub-type'],
+                  },
+                  ui: ['ui-sub-type'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: true,
+      })
+    );
+
+    expect(actualPrivileges).toEqual([
+      {
+        privilegeId: 'all',
+        privilege: {
+          api: ['all-api', 'read-api', 'sub-feature-api'],
+          app: ['foo', 'sub-app'],
+          catalogue: ['foo-catalogue', 'sub-catalogue'],
+          management: {
+            section: ['foo-management', 'other-sub-management'],
+            kibana: ['sub-management'],
+          },
+          savedObject: {
+            all: ['all-type', 'all-sub-type'],
+            read: ['read-type', 'read-sub-type'],
+          },
+          ui: ['ui-action', 'ui-sub-type'],
+        },
+      },
+      {
+        privilegeId: 'read',
+        privilege: {
+          api: ['read-api', 'sub-feature-api'],
+          app: ['foo', 'sub-app'],
+          catalogue: ['foo-catalogue', 'sub-catalogue'],
+          management: {
+            section: ['foo-management', 'other-sub-management'],
+            kibana: ['sub-management'],
+          },
+          savedObject: {
+            all: ['all-sub-type'],
+            read: ['read-type', 'read-sub-type'],
+          },
+          ui: ['ui-action', 'ui-sub-type'],
+        },
+      },
+    ]);
+  });
+
+  it('does not duplicate privileges when merging', () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      app: [],
+      privileges: {
+        all: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+        read: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'sub feature 1',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-feature-priv-1',
+                  name: 'first sub feature privilege',
+                  includeIn: 'read',
+                  api: ['read-api'],
+                  app: ['foo'],
+                  catalogue: ['foo-catalogue'],
+                  management: {
+                    section: ['foo-management'],
+                  },
+                  savedObject: {
+                    all: [],
+                    read: ['read-type'],
+                  },
+                  ui: ['ui-action'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: true,
+      })
+    );
+
+    expect(actualPrivileges).toEqual([
+      {
+        privilegeId: 'all',
+        privilege: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      {
+        privilegeId: 'read',
+        privilege: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+    ]);
+  });
+
+  it('includes sub feature privileges into both all and read when`augmentWithSubFeaturePrivileges` is true and `includeIn: all`', () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      app: [],
+      privileges: {
+        all: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+        read: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'sub feature 1',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-feature-priv-1',
+                  name: 'first sub feature privilege',
+                  includeIn: 'all',
+                  api: ['sub-feature-api'],
+                  app: ['sub-app'],
+                  catalogue: ['sub-catalogue'],
+                  management: {
+                    section: ['other-sub-management'],
+                    kibana: ['sub-management'],
+                  },
+                  savedObject: {
+                    all: ['all-sub-type'],
+                    read: ['read-sub-type'],
+                  },
+                  ui: ['ui-sub-type'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: true,
+      })
+    );
+
+    expect(actualPrivileges).toEqual([
+      {
+        privilegeId: 'all',
+        privilege: {
+          api: ['all-api', 'read-api', 'sub-feature-api'],
+          app: ['foo', 'sub-app'],
+          catalogue: ['foo-catalogue', 'sub-catalogue'],
+          management: {
+            section: ['foo-management', 'other-sub-management'],
+            kibana: ['sub-management'],
+          },
+          savedObject: {
+            all: ['all-type', 'all-sub-type'],
+            read: ['read-type', 'read-sub-type'],
+          },
+          ui: ['ui-action', 'ui-sub-type'],
+        },
+      },
+      {
+        privilegeId: 'read',
+        privilege: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+    ]);
+  });
+
+  it(`can augment primary feature privileges even if they don't specify their own`, () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      app: [],
+      privileges: {
+        all: {
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+        },
+        read: {
+          savedObject: {
+            all: [],
+            read: [],
+          },
+          ui: [],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'sub feature 1',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-feature-priv-1',
+                  name: 'first sub feature privilege',
+                  includeIn: 'read',
+                  api: ['sub-feature-api'],
+                  app: ['sub-app'],
+                  catalogue: ['sub-catalogue'],
+                  management: {
+                    section: ['other-sub-management'],
+                    kibana: ['sub-management'],
+                  },
+                  savedObject: {
+                    all: ['all-sub-type'],
+                    read: ['read-sub-type'],
+                  },
+                  ui: ['ui-sub-type'],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: true,
+      })
+    );
+
+    expect(actualPrivileges).toEqual([
+      {
+        privilegeId: 'all',
+        privilege: {
+          api: ['sub-feature-api'],
+          app: ['sub-app'],
+          catalogue: ['sub-catalogue'],
+          management: {
+            section: ['other-sub-management'],
+            kibana: ['sub-management'],
+          },
+          savedObject: {
+            all: ['all-sub-type'],
+            read: ['read-sub-type'],
+          },
+          ui: ['ui-sub-type'],
+        },
+      },
+      {
+        privilegeId: 'read',
+        privilege: {
+          api: ['sub-feature-api'],
+          app: ['sub-app'],
+          catalogue: ['sub-catalogue'],
+          management: {
+            section: ['other-sub-management'],
+            kibana: ['sub-management'],
+          },
+          savedObject: {
+            all: ['all-sub-type'],
+            read: ['read-sub-type'],
+          },
+          ui: ['ui-sub-type'],
+        },
+      },
+    ]);
+  });
+
+  it(`can augment primary feature privileges even if the sub-feature privileges don't specify their own`, () => {
+    const feature = new Feature({
+      id: 'foo',
+      name: 'foo',
+      app: [],
+      privileges: {
+        all: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+        read: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      subFeatures: [
+        {
+          name: 'sub feature 1',
+          privilegeGroups: [
+            {
+              groupType: 'independent',
+              privileges: [
+                {
+                  id: 'sub-feature-priv-1',
+                  name: 'first sub feature privilege',
+                  includeIn: 'read',
+                  savedObject: {
+                    all: [],
+                    read: [],
+                  },
+                  ui: [],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    const actualPrivileges = Array.from(
+      featurePrivilegeIterator(feature, {
+        augmentWithSubFeaturePrivileges: true,
+      })
+    );
+
+    expect(actualPrivileges).toEqual([
+      {
+        privilegeId: 'all',
+        privilege: {
+          api: ['all-api', 'read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: ['all-type'],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+      {
+        privilegeId: 'read',
+        privilege: {
+          api: ['read-api'],
+          app: ['foo'],
+          catalogue: ['foo-catalogue'],
+          management: {
+            section: ['foo-management'],
+          },
+          savedObject: {
+            all: [],
+            read: ['read-type'],
+          },
+          ui: ['ui-action'],
+        },
+      },
+    ]);
+  });
+});
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.ts
new file mode 100644
index 0000000000000..e239a6e280aec
--- /dev/null
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/feature_privilege_iterator.ts
@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import _ from 'lodash';
+import { Feature, FeatureKibanaPrivileges } from '../../../../../features/server';
+import { subFeaturePrivilegeIterator } from './sub_feature_privilege_iterator';
+
+interface IteratorOptions {
+  augmentWithSubFeaturePrivileges: boolean;
+  predicate?: (privilegeId: string, privilege: FeatureKibanaPrivileges) => boolean;
+}
+
+export function* featurePrivilegeIterator(
+  feature: Feature,
+  options: IteratorOptions
+): IterableIterator<{ privilegeId: string; privilege: FeatureKibanaPrivileges }> {
+  for (const entry of Object.entries(feature.privileges ?? {})) {
+    const [privilegeId, privilege] = entry;
+
+    if (options.predicate && !options.predicate(privilegeId, privilege)) {
+      continue;
+    }
+
+    if (options.augmentWithSubFeaturePrivileges) {
+      yield { privilegeId, privilege: mergeWithSubFeatures(privilegeId, privilege, feature) };
+    } else {
+      yield { privilegeId, privilege };
+    }
+  }
+}
+
+function mergeWithSubFeatures(
+  privilegeId: string,
+  privilege: FeatureKibanaPrivileges,
+  feature: Feature
+) {
+  const mergedConfig = _.cloneDeep(privilege);
+  for (const subFeaturePrivilege of subFeaturePrivilegeIterator(feature)) {
+    if (subFeaturePrivilege.includeIn !== 'read' && subFeaturePrivilege.includeIn !== privilegeId) {
+      continue;
+    }
+
+    mergedConfig.api = mergeArrays(mergedConfig.api, subFeaturePrivilege.api);
+
+    mergedConfig.app = mergeArrays(mergedConfig.app, subFeaturePrivilege.app);
+
+    mergedConfig.catalogue = mergeArrays(mergedConfig.catalogue, subFeaturePrivilege.catalogue);
+
+    const managementEntries = Object.entries(mergedConfig.management ?? {});
+    const subFeatureManagementEntries = Object.entries(subFeaturePrivilege.management ?? {});
+
+    mergedConfig.management = [managementEntries, subFeatureManagementEntries]
+      .flat()
+      .reduce((acc, [sectionId, managementApps]) => {
+        return {
+          ...acc,
+          [sectionId]: mergeArrays(acc[sectionId], managementApps),
+        };
+      }, {} as Record<string, string[]>);
+
+    mergedConfig.ui = mergeArrays(mergedConfig.ui, subFeaturePrivilege.ui);
+
+    mergedConfig.savedObject.all = mergeArrays(
+      mergedConfig.savedObject.all,
+      subFeaturePrivilege.savedObject.all
+    );
+
+    mergedConfig.savedObject.read = mergeArrays(
+      mergedConfig.savedObject.read,
+      subFeaturePrivilege.savedObject.read
+    );
+  }
+  return mergedConfig;
+}
+
+function mergeArrays(input1: string[] | undefined, input2: string[] | undefined) {
+  const first = input1 ?? [];
+  const second = input2 ?? [];
+  return Array.from(new Set([...first, ...second]));
+}
diff --git a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/index.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/index.ts
similarity index 61%
rename from x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/index.ts
rename to x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/index.ts
index 056a4d3022fc5..24af524c350b0 100644
--- a/x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/kibana_privilege_calculator/index.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/index.ts
@@ -4,5 +4,5 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-export { KibanaPrivilegeCalculatorFactory } from './kibana_privileges_calculator_factory';
-export * from './kibana_privilege_calculator_types';
+export { featurePrivilegeIterator } from './feature_privilege_iterator';
+export { subFeaturePrivilegeIterator } from './sub_feature_privilege_iterator';
diff --git a/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/sub_feature_privilege_iterator.ts b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/sub_feature_privilege_iterator.ts
new file mode 100644
index 0000000000000..b288262be25c6
--- /dev/null
+++ b/x-pack/plugins/security/server/authorization/privileges/feature_privilege_iterator/sub_feature_privilege_iterator.ts
@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SubFeaturePrivilegeConfig } from '../../../../../features/common';
+import { Feature } from '../../../../../features/server';
+
+export function* subFeaturePrivilegeIterator(
+  feature: Feature
+): IterableIterator<SubFeaturePrivilegeConfig> {
+  for (const subFeature of feature.subFeatures) {
+    for (const group of subFeature.privilegeGroups) {
+      yield* group.privileges;
+    }
+  }
+}
diff --git a/x-pack/plugins/security/server/authorization/privileges/index.ts b/x-pack/plugins/security/server/authorization/privileges/index.ts
index 22b9cd45d4c0f..e12a33ce509bd 100644
--- a/x-pack/plugins/security/server/authorization/privileges/index.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/index.ts
@@ -5,3 +5,4 @@
  */
 
 export { privilegesFactory, PrivilegesService } from './privileges';
+export { featurePrivilegeIterator } from './feature_privilege_iterator';
diff --git a/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts b/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts
index 38d4d413c591e..3d25fc03f568b 100644
--- a/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts
@@ -11,9 +11,9 @@ import { privilegesFactory } from './privileges';
 const actions = new Actions('1.0.0-zeta1');
 
 describe('features', () => {
-  test('actions defined at the feature cascade to the privileges', () => {
+  test('actions defined at the feature do not cascade to the privileges', () => {
     const features: Feature[] = [
-      {
+      new Feature({
         id: 'foo-feature',
         name: 'Foo Feature',
         icon: 'arrowDown',
@@ -39,115 +39,25 @@ describe('features', () => {
             ui: [],
           },
         },
-      },
+      }),
     ];
 
     const mockFeaturesService = { getFeatures: jest.fn().mockReturnValue(features) };
-    const privileges = privilegesFactory(actions, mockFeaturesService);
-
-    const actual = privileges.get();
-    expect(actual).toHaveProperty('features.foo-feature', {
-      all: [
-        actions.login,
-        actions.version,
-        actions.app.get('app-1'),
-        actions.app.get('app-2'),
-        actions.ui.get('catalogue', 'catalogue-1'),
-        actions.ui.get('catalogue', 'catalogue-2'),
-        actions.ui.get('management', 'foo', 'management-1'),
-        actions.ui.get('management', 'foo', 'management-2'),
-        actions.ui.get('navLinks', 'kibana:foo'),
-        actions.allHack,
-      ],
-      read: [
-        actions.login,
-        actions.version,
-        actions.app.get('app-1'),
-        actions.app.get('app-2'),
-        actions.ui.get('catalogue', 'catalogue-1'),
-        actions.ui.get('catalogue', 'catalogue-2'),
-        actions.ui.get('management', 'foo', 'management-1'),
-        actions.ui.get('management', 'foo', 'management-2'),
-        actions.ui.get('navLinks', 'kibana:foo'),
-      ],
-    });
-  });
-
-  test('actions defined at the privilege take precedence', () => {
-    const features: Feature[] = [
-      {
-        id: 'foo',
-        name: 'Foo Feature',
-        icon: 'arrowDown',
-        app: ['ignore-me-1', 'ignore-me-2'],
-        catalogue: ['ignore-me-1', 'ignore-me-2'],
-        management: {
-          foo: ['ignore-me-1', 'ignore-me-2'],
-        },
-        privileges: {
-          all: {
-            app: ['all-app-1', 'all-app-2'],
-            catalogue: ['catalogue-all-1', 'catalogue-all-2'],
-            management: {
-              all: ['all-management-1', 'all-management-2'],
-            },
-            savedObject: {
-              all: [],
-              read: [],
-            },
-            ui: [],
-          },
-          read: {
-            app: ['read-app-1', 'read-app-2'],
-            catalogue: ['catalogue-read-1', 'catalogue-read-2'],
-            management: {
-              read: ['read-management-1', 'read-management-2'],
-            },
-            savedObject: {
-              all: [],
-              read: [],
-            },
-            ui: [],
-          },
-        },
-      },
-    ];
-
-    const mockXPackMainPlugin = {
-      getFeatures: jest.fn().mockReturnValue(features),
+    const mockLicenseService = {
+      getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
     };
-
-    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+    const privileges = privilegesFactory(actions, mockFeaturesService, mockLicenseService);
 
     const actual = privileges.get();
-    expect(actual).toHaveProperty('features.foo', {
-      all: [
-        actions.login,
-        actions.version,
-        actions.app.get('all-app-1'),
-        actions.app.get('all-app-2'),
-        actions.ui.get('catalogue', 'catalogue-all-1'),
-        actions.ui.get('catalogue', 'catalogue-all-2'),
-        actions.ui.get('management', 'all', 'all-management-1'),
-        actions.ui.get('management', 'all', 'all-management-2'),
-        actions.allHack,
-      ],
-      read: [
-        actions.login,
-        actions.version,
-        actions.app.get('read-app-1'),
-        actions.app.get('read-app-2'),
-        actions.ui.get('catalogue', 'catalogue-read-1'),
-        actions.ui.get('catalogue', 'catalogue-read-2'),
-        actions.ui.get('management', 'read', 'read-management-1'),
-        actions.ui.get('management', 'read', 'read-management-2'),
-      ],
+    expect(actual).toHaveProperty('features.foo-feature', {
+      all: [actions.login, actions.version, actions.ui.get('navLinks', 'kibana:foo')],
+      read: [actions.login, actions.version, actions.ui.get('navLinks', 'kibana:foo')],
     });
   });
 
   test(`actions only specified at the privilege are alright too`, () => {
     const features: Feature[] = [
-      {
+      new Feature({
         id: 'foo',
         name: 'Foo Feature',
         icon: 'arrowDown',
@@ -168,93 +78,100 @@ describe('features', () => {
             ui: ['read-ui-1', 'read-ui-2'],
           },
         },
-      },
+      }),
     ];
 
     const mockXPackMainPlugin = {
       getFeatures: jest.fn().mockReturnValue(features),
     };
+    const mockLicenseService = {
+      getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+    };
+    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
-    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+    const expectedAllPrivileges = [
+      actions.login,
+      actions.version,
+      actions.savedObject.get('all-savedObject-all-1', 'bulk_get'),
+      actions.savedObject.get('all-savedObject-all-1', 'get'),
+      actions.savedObject.get('all-savedObject-all-1', 'find'),
+      actions.savedObject.get('all-savedObject-all-1', 'create'),
+      actions.savedObject.get('all-savedObject-all-1', 'bulk_create'),
+      actions.savedObject.get('all-savedObject-all-1', 'update'),
+      actions.savedObject.get('all-savedObject-all-1', 'bulk_update'),
+      actions.savedObject.get('all-savedObject-all-1', 'delete'),
+      actions.savedObject.get('all-savedObject-all-2', 'bulk_get'),
+      actions.savedObject.get('all-savedObject-all-2', 'get'),
+      actions.savedObject.get('all-savedObject-all-2', 'find'),
+      actions.savedObject.get('all-savedObject-all-2', 'create'),
+      actions.savedObject.get('all-savedObject-all-2', 'bulk_create'),
+      actions.savedObject.get('all-savedObject-all-2', 'update'),
+      actions.savedObject.get('all-savedObject-all-2', 'bulk_update'),
+      actions.savedObject.get('all-savedObject-all-2', 'delete'),
+      actions.savedObject.get('all-savedObject-read-1', 'bulk_get'),
+      actions.savedObject.get('all-savedObject-read-1', 'get'),
+      actions.savedObject.get('all-savedObject-read-1', 'find'),
+      actions.savedObject.get('all-savedObject-read-2', 'bulk_get'),
+      actions.savedObject.get('all-savedObject-read-2', 'get'),
+      actions.savedObject.get('all-savedObject-read-2', 'find'),
+      actions.ui.get('foo', 'all-ui-1'),
+      actions.ui.get('foo', 'all-ui-2'),
+    ];
+
+    const expectedReadPrivileges = [
+      actions.login,
+      actions.version,
+      actions.savedObject.get('read-savedObject-all-1', 'bulk_get'),
+      actions.savedObject.get('read-savedObject-all-1', 'get'),
+      actions.savedObject.get('read-savedObject-all-1', 'find'),
+      actions.savedObject.get('read-savedObject-all-1', 'create'),
+      actions.savedObject.get('read-savedObject-all-1', 'bulk_create'),
+      actions.savedObject.get('read-savedObject-all-1', 'update'),
+      actions.savedObject.get('read-savedObject-all-1', 'bulk_update'),
+      actions.savedObject.get('read-savedObject-all-1', 'delete'),
+      actions.savedObject.get('read-savedObject-all-2', 'bulk_get'),
+      actions.savedObject.get('read-savedObject-all-2', 'get'),
+      actions.savedObject.get('read-savedObject-all-2', 'find'),
+      actions.savedObject.get('read-savedObject-all-2', 'create'),
+      actions.savedObject.get('read-savedObject-all-2', 'bulk_create'),
+      actions.savedObject.get('read-savedObject-all-2', 'update'),
+      actions.savedObject.get('read-savedObject-all-2', 'bulk_update'),
+      actions.savedObject.get('read-savedObject-all-2', 'delete'),
+      actions.savedObject.get('read-savedObject-read-1', 'bulk_get'),
+      actions.savedObject.get('read-savedObject-read-1', 'get'),
+      actions.savedObject.get('read-savedObject-read-1', 'find'),
+      actions.savedObject.get('read-savedObject-read-2', 'bulk_get'),
+      actions.savedObject.get('read-savedObject-read-2', 'get'),
+      actions.savedObject.get('read-savedObject-read-2', 'find'),
+      actions.ui.get('foo', 'read-ui-1'),
+      actions.ui.get('foo', 'read-ui-2'),
+    ];
 
     const actual = privileges.get();
     expect(actual).toHaveProperty('features.foo', {
-      all: [
-        actions.login,
-        actions.version,
-        actions.savedObject.get('all-savedObject-all-1', 'bulk_get'),
-        actions.savedObject.get('all-savedObject-all-1', 'get'),
-        actions.savedObject.get('all-savedObject-all-1', 'find'),
-        actions.savedObject.get('all-savedObject-all-1', 'create'),
-        actions.savedObject.get('all-savedObject-all-1', 'bulk_create'),
-        actions.savedObject.get('all-savedObject-all-1', 'update'),
-        actions.savedObject.get('all-savedObject-all-1', 'bulk_update'),
-        actions.savedObject.get('all-savedObject-all-1', 'delete'),
-        actions.savedObject.get('all-savedObject-all-2', 'bulk_get'),
-        actions.savedObject.get('all-savedObject-all-2', 'get'),
-        actions.savedObject.get('all-savedObject-all-2', 'find'),
-        actions.savedObject.get('all-savedObject-all-2', 'create'),
-        actions.savedObject.get('all-savedObject-all-2', 'bulk_create'),
-        actions.savedObject.get('all-savedObject-all-2', 'update'),
-        actions.savedObject.get('all-savedObject-all-2', 'bulk_update'),
-        actions.savedObject.get('all-savedObject-all-2', 'delete'),
-        actions.savedObject.get('all-savedObject-read-1', 'bulk_get'),
-        actions.savedObject.get('all-savedObject-read-1', 'get'),
-        actions.savedObject.get('all-savedObject-read-1', 'find'),
-        actions.savedObject.get('all-savedObject-read-2', 'bulk_get'),
-        actions.savedObject.get('all-savedObject-read-2', 'get'),
-        actions.savedObject.get('all-savedObject-read-2', 'find'),
-        actions.ui.get('foo', 'all-ui-1'),
-        actions.ui.get('foo', 'all-ui-2'),
-        actions.allHack,
-      ],
-      read: [
-        actions.login,
-        actions.version,
-        actions.savedObject.get('read-savedObject-all-1', 'bulk_get'),
-        actions.savedObject.get('read-savedObject-all-1', 'get'),
-        actions.savedObject.get('read-savedObject-all-1', 'find'),
-        actions.savedObject.get('read-savedObject-all-1', 'create'),
-        actions.savedObject.get('read-savedObject-all-1', 'bulk_create'),
-        actions.savedObject.get('read-savedObject-all-1', 'update'),
-        actions.savedObject.get('read-savedObject-all-1', 'bulk_update'),
-        actions.savedObject.get('read-savedObject-all-1', 'delete'),
-        actions.savedObject.get('read-savedObject-all-2', 'bulk_get'),
-        actions.savedObject.get('read-savedObject-all-2', 'get'),
-        actions.savedObject.get('read-savedObject-all-2', 'find'),
-        actions.savedObject.get('read-savedObject-all-2', 'create'),
-        actions.savedObject.get('read-savedObject-all-2', 'bulk_create'),
-        actions.savedObject.get('read-savedObject-all-2', 'update'),
-        actions.savedObject.get('read-savedObject-all-2', 'bulk_update'),
-        actions.savedObject.get('read-savedObject-all-2', 'delete'),
-        actions.savedObject.get('read-savedObject-read-1', 'bulk_get'),
-        actions.savedObject.get('read-savedObject-read-1', 'get'),
-        actions.savedObject.get('read-savedObject-read-1', 'find'),
-        actions.savedObject.get('read-savedObject-read-2', 'bulk_get'),
-        actions.savedObject.get('read-savedObject-read-2', 'get'),
-        actions.savedObject.get('read-savedObject-read-2', 'find'),
-        actions.ui.get('foo', 'read-ui-1'),
-        actions.ui.get('foo', 'read-ui-2'),
-      ],
+      all: [...expectedAllPrivileges],
+      read: [...expectedReadPrivileges],
     });
   });
 
   test(`features with no privileges aren't listed`, () => {
     const features: Feature[] = [
-      {
+      new Feature({
         id: 'foo',
         name: 'Foo Feature',
         icon: 'arrowDown',
         app: [],
-        privileges: {},
-      },
+        privileges: null,
+      }),
     ];
 
     const mockXPackMainPlugin = {
       getFeatures: jest.fn().mockReturnValue(features),
     };
-
-    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+    const mockLicenseService = {
+      getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+    };
+    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
     const actual = privileges.get();
     expect(actual).not.toHaveProperty('features.foo');
@@ -276,82 +193,9 @@ describe('features', () => {
   },
 ].forEach(({ group, expectManageSpaces, expectGetFeatures }) => {
   describe(`${group}`, () => {
-    test('actions defined only at the feature are included in `all` and `read`', () => {
-      const features: Feature[] = [
-        {
-          id: 'foo',
-          name: 'Foo Feature',
-          icon: 'arrowDown',
-          navLinkId: 'kibana:foo',
-          app: ['app-1', 'app-2'],
-          catalogue: ['catalogue-1', 'catalogue-2'],
-          management: {
-            foo: ['management-1', 'management-2'],
-          },
-          privileges: {
-            all: {
-              savedObject: {
-                all: [],
-                read: [],
-              },
-              ui: [],
-            },
-            read: {
-              savedObject: {
-                all: [],
-                read: [],
-              },
-              ui: [],
-            },
-          },
-        },
-      ];
-
-      const mockXPackMainPlugin = {
-        getFeatures: jest.fn().mockReturnValue(features),
-      };
-
-      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
-
-      const actual = privileges.get();
-      expect(actual).toHaveProperty(group, {
-        all: [
-          actions.login,
-          actions.version,
-          ...(expectGetFeatures ? [actions.api.get('features')] : []),
-          ...(expectManageSpaces
-            ? [
-                actions.space.manage,
-                actions.ui.get('spaces', 'manage'),
-                actions.ui.get('management', 'kibana', 'spaces'),
-              ]
-            : []),
-          actions.app.get('app-1'),
-          actions.app.get('app-2'),
-          actions.ui.get('catalogue', 'catalogue-1'),
-          actions.ui.get('catalogue', 'catalogue-2'),
-          actions.ui.get('management', 'foo', 'management-1'),
-          actions.ui.get('management', 'foo', 'management-2'),
-          actions.ui.get('navLinks', 'kibana:foo'),
-          actions.allHack,
-        ],
-        read: [
-          actions.login,
-          actions.version,
-          actions.app.get('app-1'),
-          actions.app.get('app-2'),
-          actions.ui.get('catalogue', 'catalogue-1'),
-          actions.ui.get('catalogue', 'catalogue-2'),
-          actions.ui.get('management', 'foo', 'management-1'),
-          actions.ui.get('management', 'foo', 'management-2'),
-          actions.ui.get('navLinks', 'kibana:foo'),
-        ],
-      });
-    });
-
     test('actions defined in any feature privilege are included in `all`', () => {
       const features: Feature[] = [
-        {
+        new Feature({
           id: 'foo',
           name: 'Foo Feature',
           icon: 'arrowDown',
@@ -362,17 +206,6 @@ describe('features', () => {
             foo: ['ignore-me-1', 'ignore-me-2'],
           },
           privileges: {
-            bar: {
-              management: {
-                'bar-management': ['bar-management-1', 'bar-management-2'],
-              },
-              catalogue: ['bar-catalogue-1', 'bar-catalogue-2'],
-              savedObject: {
-                all: ['bar-savedObject-all-1', 'bar-savedObject-all-2'],
-                read: ['bar-savedObject-read-1', 'bar-savedObject-read-2'],
-              },
-              ui: ['bar-ui-1', 'bar-ui-2'],
-            },
             all: {
               management: {
                 'all-management': ['all-management-1', 'all-management-2'],
@@ -396,14 +229,16 @@ describe('features', () => {
               ui: ['read-ui-1', 'read-ui-2'],
             },
           },
-        },
+        }),
       ];
 
       const mockXPackMainPlugin = {
         getFeatures: jest.fn().mockReturnValue(features),
       };
-
-      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
       const actual = privileges.get();
       expect(actual).toHaveProperty(`${group}.all`, [
@@ -417,39 +252,11 @@ describe('features', () => {
               actions.ui.get('management', 'kibana', 'spaces'),
             ]
           : []),
-        actions.ui.get('catalogue', 'bar-catalogue-1'),
-        actions.ui.get('catalogue', 'bar-catalogue-2'),
-        actions.ui.get('management', 'bar-management', 'bar-management-1'),
-        actions.ui.get('management', 'bar-management', 'bar-management-2'),
-        actions.ui.get('navLinks', 'kibana:foo'),
-        actions.savedObject.get('bar-savedObject-all-1', 'bulk_get'),
-        actions.savedObject.get('bar-savedObject-all-1', 'get'),
-        actions.savedObject.get('bar-savedObject-all-1', 'find'),
-        actions.savedObject.get('bar-savedObject-all-1', 'create'),
-        actions.savedObject.get('bar-savedObject-all-1', 'bulk_create'),
-        actions.savedObject.get('bar-savedObject-all-1', 'update'),
-        actions.savedObject.get('bar-savedObject-all-1', 'bulk_update'),
-        actions.savedObject.get('bar-savedObject-all-1', 'delete'),
-        actions.savedObject.get('bar-savedObject-all-2', 'bulk_get'),
-        actions.savedObject.get('bar-savedObject-all-2', 'get'),
-        actions.savedObject.get('bar-savedObject-all-2', 'find'),
-        actions.savedObject.get('bar-savedObject-all-2', 'create'),
-        actions.savedObject.get('bar-savedObject-all-2', 'bulk_create'),
-        actions.savedObject.get('bar-savedObject-all-2', 'update'),
-        actions.savedObject.get('bar-savedObject-all-2', 'bulk_update'),
-        actions.savedObject.get('bar-savedObject-all-2', 'delete'),
-        actions.savedObject.get('bar-savedObject-read-1', 'bulk_get'),
-        actions.savedObject.get('bar-savedObject-read-1', 'get'),
-        actions.savedObject.get('bar-savedObject-read-1', 'find'),
-        actions.savedObject.get('bar-savedObject-read-2', 'bulk_get'),
-        actions.savedObject.get('bar-savedObject-read-2', 'get'),
-        actions.savedObject.get('bar-savedObject-read-2', 'find'),
-        actions.ui.get('foo', 'bar-ui-1'),
-        actions.ui.get('foo', 'bar-ui-2'),
         actions.ui.get('catalogue', 'all-catalogue-1'),
         actions.ui.get('catalogue', 'all-catalogue-2'),
         actions.ui.get('management', 'all-management', 'all-management-1'),
         actions.ui.get('management', 'all-management', 'all-management-2'),
+        actions.ui.get('navLinks', 'kibana:foo'),
         actions.savedObject.get('all-savedObject-all-1', 'bulk_get'),
         actions.savedObject.get('all-savedObject-all-1', 'get'),
         actions.savedObject.get('all-savedObject-all-1', 'find'),
@@ -502,13 +309,12 @@ describe('features', () => {
         actions.savedObject.get('read-savedObject-read-2', 'find'),
         actions.ui.get('foo', 'read-ui-1'),
         actions.ui.get('foo', 'read-ui-2'),
-        actions.allHack,
       ]);
     });
 
     test('actions defined in a feature privilege with name `read` are included in `read`', () => {
       const features: Feature[] = [
-        {
+        new Feature({
           id: 'foo',
           name: 'Foo Feature',
           icon: 'arrowDown',
@@ -519,17 +325,6 @@ describe('features', () => {
             foo: ['ignore-me-1', 'ignore-me-2'],
           },
           privileges: {
-            bar: {
-              management: {
-                'ignore-me': ['ignore-me-1', 'ignore-me-2'],
-              },
-              catalogue: ['ignore-me-1', 'ignore-me-2'],
-              savedObject: {
-                all: ['ignore-me-1', 'ignore-me-2'],
-                read: ['ignore-me-1', 'ignore-me-2'],
-              },
-              ui: ['ignore-me-1', 'ignore-me-2'],
-            },
             all: {
               management: {
                 'ignore-me': ['ignore-me-1', 'ignore-me-2'],
@@ -553,14 +348,16 @@ describe('features', () => {
               ui: ['read-ui-1', 'read-ui-2'],
             },
           },
-        },
+        }),
       ];
 
       const mockXPackMainPlugin = {
         getFeatures: jest.fn().mockReturnValue(features),
       };
-
-      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
       const actual = privileges.get();
       expect(actual).toHaveProperty(`${group}.read`, [
@@ -600,7 +397,7 @@ describe('features', () => {
 
     test('actions defined in a reserved privilege are not included in `all` or `read`', () => {
       const features: Feature[] = [
-        {
+        new Feature({
           id: 'foo',
           name: 'Foo Feature',
           icon: 'arrowDown',
@@ -610,7 +407,7 @@ describe('features', () => {
           management: {
             foo: ['ignore-me-1', 'ignore-me-2'],
           },
-          privileges: {},
+          privileges: null,
           reserved: {
             privilege: {
               savedObject: {
@@ -621,14 +418,16 @@ describe('features', () => {
             },
             description: '',
           },
-        },
+        }),
       ];
 
       const mockXPackMainPlugin = {
         getFeatures: jest.fn().mockReturnValue(features),
       };
-
-      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
       const actual = privileges.get();
       expect(actual).toHaveProperty(`${group}.all`, [
@@ -642,14 +441,13 @@ describe('features', () => {
               actions.ui.get('management', 'kibana', 'spaces'),
             ]
           : []),
-        actions.allHack,
       ]);
       expect(actual).toHaveProperty(`${group}.read`, [actions.login, actions.version]);
     });
 
     test('actions defined in a feature with excludeFromBasePrivileges are not included in `all` or `read', () => {
       const features: Feature[] = [
-        {
+        new Feature({
           id: 'foo',
           name: 'Foo Feature',
           excludeFromBasePrivileges: true,
@@ -661,17 +459,6 @@ describe('features', () => {
             foo: ['ignore-me-1', 'ignore-me-2'],
           },
           privileges: {
-            bar: {
-              management: {
-                'bar-management': ['bar-management-1'],
-              },
-              catalogue: ['bar-catalogue-1'],
-              savedObject: {
-                all: ['bar-savedObject-all-1'],
-                read: ['bar-savedObject-read-1'],
-              },
-              ui: ['bar-ui-1'],
-            },
             all: {
               management: {
                 'all-management': ['all-management-1'],
@@ -695,14 +482,16 @@ describe('features', () => {
               ui: ['read-ui-1'],
             },
           },
-        },
+        }),
       ];
 
       const mockXPackMainPlugin = {
         getFeatures: jest.fn().mockReturnValue(features),
       };
-
-      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
       const actual = privileges.get();
       expect(actual).toHaveProperty(`${group}.all`, [
@@ -716,14 +505,13 @@ describe('features', () => {
               actions.ui.get('management', 'kibana', 'spaces'),
             ]
           : []),
-        actions.allHack,
       ]);
       expect(actual).toHaveProperty(`${group}.read`, [actions.login, actions.version]);
     });
 
     test('actions defined in an individual feature privilege with excludeFromBasePrivileges are not included in `all` or `read`', () => {
       const features: Feature[] = [
-        {
+        new Feature({
           id: 'foo',
           name: 'Foo Feature',
           icon: 'arrowDown',
@@ -734,18 +522,6 @@ describe('features', () => {
             foo: ['ignore-me-1', 'ignore-me-2'],
           },
           privileges: {
-            bar: {
-              excludeFromBasePrivileges: true,
-              management: {
-                'bar-management': ['bar-management-1'],
-              },
-              catalogue: ['bar-catalogue-1'],
-              savedObject: {
-                all: ['bar-savedObject-all-1'],
-                read: ['bar-savedObject-read-1'],
-              },
-              ui: ['bar-ui-1'],
-            },
             all: {
               excludeFromBasePrivileges: true,
               management: {
@@ -771,14 +547,16 @@ describe('features', () => {
               ui: ['read-ui-1'],
             },
           },
-        },
+        }),
       ];
 
       const mockXPackMainPlugin = {
         getFeatures: jest.fn().mockReturnValue(features),
       };
-
-      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
       const actual = privileges.get();
       expect(actual).toHaveProperty(`${group}.all`, [
@@ -792,7 +570,6 @@ describe('features', () => {
               actions.ui.get('management', 'kibana', 'spaces'),
             ]
           : []),
-        actions.allHack,
       ]);
       expect(actual).toHaveProperty(`${group}.read`, [actions.login, actions.version]);
     });
@@ -800,9 +577,9 @@ describe('features', () => {
 });
 
 describe('reserved', () => {
-  test('actions defined at the feature cascade to the privileges', () => {
+  test('actions defined at the feature do not cascade to the privileges', () => {
     const features: Feature[] = [
-      {
+      new Feature({
         id: 'foo',
         name: 'Foo Feature',
         icon: 'arrowDown',
@@ -812,7 +589,7 @@ describe('reserved', () => {
         management: {
           foo: ['management-1', 'management-2'],
         },
-        privileges: {},
+        privileges: null,
         reserved: {
           privilege: {
             savedObject: {
@@ -823,84 +600,32 @@ describe('reserved', () => {
           },
           description: '',
         },
-      },
+      }),
     ];
 
     const mockXPackMainPlugin = {
       getFeatures: jest.fn().mockReturnValue(features),
     };
-
-    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
-
-    const actual = privileges.get();
-    expect(actual).toHaveProperty('reserved.foo', [
-      actions.version,
-      actions.app.get('app-1'),
-      actions.app.get('app-2'),
-      actions.ui.get('catalogue', 'catalogue-1'),
-      actions.ui.get('catalogue', 'catalogue-2'),
-      actions.ui.get('management', 'foo', 'management-1'),
-      actions.ui.get('management', 'foo', 'management-2'),
-      actions.ui.get('navLinks', 'kibana:foo'),
-    ]);
-  });
-
-  test('actions defined at the reservedPrivilege take precedence', () => {
-    const features: Feature[] = [
-      {
-        id: 'foo',
-        name: 'Foo Feature',
-        icon: 'arrowDown',
-        app: ['ignore-me-1', 'ignore-me-2'],
-        catalogue: ['ignore-me-1', 'ignore-me-2'],
-        management: {
-          foo: ['ignore-me-1', 'ignore-me-2'],
-        },
-        privileges: {},
-        reserved: {
-          privilege: {
-            app: ['app-1', 'app-2'],
-            catalogue: ['catalogue-1', 'catalogue-2'],
-            management: {
-              bar: ['management-1', 'management-2'],
-            },
-            savedObject: {
-              all: [],
-              read: [],
-            },
-            ui: [],
-          },
-          description: '',
-        },
-      },
-    ];
-
-    const mockXPackMainPlugin = {
-      getFeatures: jest.fn().mockReturnValue(features),
+    const mockLicenseService = {
+      getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
     };
-
-    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
     const actual = privileges.get();
     expect(actual).toHaveProperty('reserved.foo', [
       actions.version,
-      actions.app.get('app-1'),
-      actions.app.get('app-2'),
-      actions.ui.get('catalogue', 'catalogue-1'),
-      actions.ui.get('catalogue', 'catalogue-2'),
-      actions.ui.get('management', 'bar', 'management-1'),
-      actions.ui.get('management', 'bar', 'management-2'),
+      actions.ui.get('navLinks', 'kibana:foo'),
     ]);
   });
 
   test(`actions only specified at the privilege are alright too`, () => {
     const features: Feature[] = [
-      {
+      new Feature({
         id: 'foo',
         name: 'Foo Feature',
         icon: 'arrowDown',
         app: [],
-        privileges: {},
+        privileges: null,
         reserved: {
           privilege: {
             savedObject: {
@@ -911,14 +636,16 @@ describe('reserved', () => {
           },
           description: '',
         },
-      },
+      }),
     ];
 
     const mockXPackMainPlugin = {
       getFeatures: jest.fn().mockReturnValue(features),
     };
-
-    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+    const mockLicenseService = {
+      getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+    };
+    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
     const actual = privileges.get();
     expect(actual).toHaveProperty('reserved.foo', [
@@ -952,7 +679,7 @@ describe('reserved', () => {
 
   test(`features with no reservedPrivileges aren't listed`, () => {
     const features: Feature[] = [
-      {
+      new Feature({
         id: 'foo',
         name: 'Foo Feature',
         icon: 'arrowDown',
@@ -965,17 +692,953 @@ describe('reserved', () => {
             },
             ui: ['foo'],
           },
+          read: {
+            savedObject: {
+              all: [],
+              read: [],
+            },
+            ui: ['foo'],
+          },
         },
-      },
+      }),
     ];
 
     const mockXPackMainPlugin = {
       getFeatures: jest.fn().mockReturnValue(features),
     };
-
-    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any);
+    const mockLicenseService = {
+      getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+    };
+    const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
 
     const actual = privileges.get();
     expect(actual).not.toHaveProperty('reserved.foo');
   });
 });
+
+describe('subFeatures', () => {
+  describe(`with includeIn: 'none'`, () => {
+    test(`should not augment the primary feature privileges, base privileges, or minimal feature privileges`, () => {
+      const features: Feature[] = [
+        new Feature({
+          id: 'foo',
+          name: 'Foo Feature',
+          icon: 'arrowDown',
+          app: [],
+          privileges: {
+            all: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+            read: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+          },
+          subFeatures: [
+            {
+              name: 'subFeature1',
+              privilegeGroups: [
+                {
+                  groupType: 'independent',
+                  privileges: [
+                    {
+                      id: 'subFeaturePriv1',
+                      name: 'sub feature priv 1',
+                      includeIn: 'none',
+                      savedObject: {
+                        all: ['all-sub-feature-type'],
+                        read: ['read-sub-feature-type'],
+                      },
+                      ui: ['sub-feature-ui'],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        }),
+      ];
+
+      const mockXPackMainPlugin = {
+        getFeatures: jest.fn().mockReturnValue(features),
+      };
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
+
+      const actual = privileges.get();
+      expect(actual.features).toHaveProperty(`foo.subFeaturePriv1`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty('foo.all', [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+      expect(actual.features).toHaveProperty('foo.minimal_all', [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual.features).toHaveProperty('foo.read', [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+      expect(actual.features).toHaveProperty('foo.minimal_read', [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual).toHaveProperty('global.all', [
+        actions.login,
+        actions.version,
+        actions.api.get('features'),
+        actions.space.manage,
+        actions.ui.get('spaces', 'manage'),
+        actions.ui.get('management', 'kibana', 'spaces'),
+        actions.ui.get('foo', 'foo'),
+      ]);
+      expect(actual).toHaveProperty('global.read', [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual).toHaveProperty('space.all', [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+      expect(actual).toHaveProperty('space.read', [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+    });
+  });
+
+  describe(`with includeIn: 'read'`, () => {
+    test(`should augment the primary feature privileges and base privileges, but never the minimal versions`, () => {
+      const features: Feature[] = [
+        new Feature({
+          id: 'foo',
+          name: 'Foo Feature',
+          icon: 'arrowDown',
+          app: [],
+          privileges: {
+            all: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+            read: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+          },
+          subFeatures: [
+            {
+              name: 'subFeature1',
+              privilegeGroups: [
+                {
+                  groupType: 'independent',
+                  privileges: [
+                    {
+                      id: 'subFeaturePriv1',
+                      name: 'sub feature priv 1',
+                      includeIn: 'read',
+                      savedObject: {
+                        all: ['all-sub-feature-type'],
+                        read: ['read-sub-feature-type'],
+                      },
+                      ui: ['sub-feature-ui'],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        }),
+      ];
+
+      const mockXPackMainPlugin = {
+        getFeatures: jest.fn().mockReturnValue(features),
+      };
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
+
+      const actual = privileges.get();
+      expect(actual.features).toHaveProperty(`foo.subFeaturePriv1`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.all`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.minimal_all`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.read`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.minimal_read`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual).toHaveProperty('global.all', [
+        actions.login,
+        actions.version,
+        actions.api.get('features'),
+        actions.space.manage,
+        actions.ui.get('spaces', 'manage'),
+        actions.ui.get('management', 'kibana', 'spaces'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+      expect(actual).toHaveProperty('global.read', [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual).toHaveProperty('space.all', [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+      expect(actual).toHaveProperty('space.read', [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+    });
+
+    test(`should augment the primary feature privileges, but not base privileges if feature is excluded from them.`, () => {
+      const features: Feature[] = [
+        new Feature({
+          id: 'foo',
+          name: 'Foo Feature',
+          icon: 'arrowDown',
+          app: [],
+          excludeFromBasePrivileges: true,
+          privileges: {
+            all: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+            read: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+          },
+          subFeatures: [
+            {
+              name: 'subFeature1',
+              privilegeGroups: [
+                {
+                  groupType: 'independent',
+                  privileges: [
+                    {
+                      id: 'subFeaturePriv1',
+                      name: 'sub feature priv 1',
+                      includeIn: 'read',
+                      savedObject: {
+                        all: ['all-sub-feature-type'],
+                        read: ['read-sub-feature-type'],
+                      },
+                      ui: ['sub-feature-ui'],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        }),
+      ];
+
+      const mockXPackMainPlugin = {
+        getFeatures: jest.fn().mockReturnValue(features),
+      };
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
+
+      const actual = privileges.get();
+      expect(actual.features).toHaveProperty(`foo.subFeaturePriv1`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.all`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.minimal_all`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.read`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.minimal_read`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual).toHaveProperty('global.all', [
+        actions.login,
+        actions.version,
+        actions.api.get('features'),
+        actions.space.manage,
+        actions.ui.get('spaces', 'manage'),
+        actions.ui.get('management', 'kibana', 'spaces'),
+      ]);
+      expect(actual).toHaveProperty('global.read', [actions.login, actions.version]);
+
+      expect(actual).toHaveProperty('space.all', [actions.login, actions.version]);
+      expect(actual).toHaveProperty('space.read', [actions.login, actions.version]);
+    });
+  });
+
+  describe(`with includeIn: 'all'`, () => {
+    test(`should augment the primary 'all' feature privileges and base 'all' privileges, but never the minimal versions`, () => {
+      const features: Feature[] = [
+        new Feature({
+          id: 'foo',
+          name: 'Foo Feature',
+          icon: 'arrowDown',
+          app: [],
+          privileges: {
+            all: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+            read: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+          },
+          subFeatures: [
+            {
+              name: 'subFeature1',
+              privilegeGroups: [
+                {
+                  groupType: 'independent',
+                  privileges: [
+                    {
+                      id: 'subFeaturePriv1',
+                      name: 'sub feature priv 1',
+                      includeIn: 'all',
+                      savedObject: {
+                        all: ['all-sub-feature-type'],
+                        read: ['read-sub-feature-type'],
+                      },
+                      ui: ['sub-feature-ui'],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        }),
+      ];
+
+      const mockXPackMainPlugin = {
+        getFeatures: jest.fn().mockReturnValue(features),
+      };
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
+
+      const actual = privileges.get();
+      expect(actual.features).toHaveProperty(`foo.subFeaturePriv1`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.all`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.minimal_all`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.read`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.minimal_read`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual).toHaveProperty('global.all', [
+        actions.login,
+        actions.version,
+        actions.api.get('features'),
+        actions.space.manage,
+        actions.ui.get('spaces', 'manage'),
+        actions.ui.get('management', 'kibana', 'spaces'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+      expect(actual).toHaveProperty('global.read', [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual).toHaveProperty('space.all', [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+      expect(actual).toHaveProperty('space.read', [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+    });
+
+    test(`should augment the primary 'all' feature privileges, but not the base privileges if the feature is excluded from them`, () => {
+      const features: Feature[] = [
+        new Feature({
+          id: 'foo',
+          name: 'Foo Feature',
+          icon: 'arrowDown',
+          app: [],
+          excludeFromBasePrivileges: true,
+          privileges: {
+            all: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+            read: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+          },
+          subFeatures: [
+            {
+              name: 'subFeature1',
+              privilegeGroups: [
+                {
+                  groupType: 'independent',
+                  privileges: [
+                    {
+                      id: 'subFeaturePriv1',
+                      name: 'sub feature priv 1',
+                      includeIn: 'all',
+                      savedObject: {
+                        all: ['all-sub-feature-type'],
+                        read: ['read-sub-feature-type'],
+                      },
+                      ui: ['sub-feature-ui'],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        }),
+      ];
+
+      const mockXPackMainPlugin = {
+        getFeatures: jest.fn().mockReturnValue(features),
+      };
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: true }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
+
+      const actual = privileges.get();
+      expect(actual.features).toHaveProperty(`foo.subFeaturePriv1`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.all`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.minimal_all`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.read`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual.features).toHaveProperty(`foo.minimal_read`, [
+        actions.login,
+        actions.version,
+        actions.ui.get('foo', 'foo'),
+      ]);
+
+      expect(actual).toHaveProperty('global.all', [
+        actions.login,
+        actions.version,
+        actions.api.get('features'),
+        actions.space.manage,
+        actions.ui.get('spaces', 'manage'),
+        actions.ui.get('management', 'kibana', 'spaces'),
+      ]);
+      expect(actual).toHaveProperty('global.read', [actions.login, actions.version]);
+
+      expect(actual).toHaveProperty('space.all', [actions.login, actions.version]);
+      expect(actual).toHaveProperty('space.read', [actions.login, actions.version]);
+    });
+  });
+
+  describe(`when license does not allow sub features`, () => {
+    test(`should augment the primary feature privileges, and should not create minimal or sub-feature privileges`, () => {
+      const features: Feature[] = [
+        new Feature({
+          id: 'foo',
+          name: 'Foo Feature',
+          icon: 'arrowDown',
+          app: [],
+          privileges: {
+            all: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+            read: {
+              savedObject: {
+                all: [],
+                read: [],
+              },
+              ui: ['foo'],
+            },
+          },
+          subFeatures: [
+            {
+              name: 'subFeature1',
+              privilegeGroups: [
+                {
+                  groupType: 'independent',
+                  privileges: [
+                    {
+                      id: 'subFeaturePriv1',
+                      name: 'sub feature priv 1',
+                      includeIn: 'read',
+                      savedObject: {
+                        all: ['all-sub-feature-type'],
+                        read: ['read-sub-feature-type'],
+                      },
+                      ui: ['sub-feature-ui'],
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        }),
+      ];
+
+      const mockXPackMainPlugin = {
+        getFeatures: jest.fn().mockReturnValue(features),
+      };
+      const mockLicenseService = {
+        getFeatures: jest.fn().mockReturnValue({ allowSubFeaturePrivileges: false }),
+      };
+      const privileges = privilegesFactory(actions, mockXPackMainPlugin as any, mockLicenseService);
+
+      const actual = privileges.get();
+      expect(actual.features).not.toHaveProperty(`foo.subFeaturePriv1`);
+
+      expect(actual.features).toHaveProperty(`foo.all`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).not.toHaveProperty(`foo.minimal_all`);
+
+      expect(actual.features).toHaveProperty(`foo.read`, [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual.features).not.toHaveProperty(`foo.minimal_read`);
+
+      expect(actual).toHaveProperty('global.all', [
+        actions.login,
+        actions.version,
+        actions.api.get('features'),
+        actions.space.manage,
+        actions.ui.get('spaces', 'manage'),
+        actions.ui.get('management', 'kibana', 'spaces'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+      expect(actual).toHaveProperty('global.read', [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+
+      expect(actual).toHaveProperty('space.all', [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+      expect(actual).toHaveProperty('space.read', [
+        actions.login,
+        actions.version,
+        actions.savedObject.get('all-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('all-sub-feature-type', 'get'),
+        actions.savedObject.get('all-sub-feature-type', 'find'),
+        actions.savedObject.get('all-sub-feature-type', 'create'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_create'),
+        actions.savedObject.get('all-sub-feature-type', 'update'),
+        actions.savedObject.get('all-sub-feature-type', 'bulk_update'),
+        actions.savedObject.get('all-sub-feature-type', 'delete'),
+        actions.savedObject.get('read-sub-feature-type', 'bulk_get'),
+        actions.savedObject.get('read-sub-feature-type', 'get'),
+        actions.savedObject.get('read-sub-feature-type', 'find'),
+        actions.ui.get('foo', 'foo'),
+        actions.ui.get('foo', 'sub-feature-ui'),
+      ]);
+    });
+  });
+});
diff --git a/x-pack/plugins/security/server/authorization/privileges/privileges.ts b/x-pack/plugins/security/server/authorization/privileges/privileges.ts
index c73c4be8f36ac..b25aad30a3423 100644
--- a/x-pack/plugins/security/server/authorization/privileges/privileges.ts
+++ b/x-pack/plugins/security/server/authorization/privileges/privileges.ts
@@ -4,65 +4,94 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { flatten, mapValues, uniq } from 'lodash';
+import { uniq } from 'lodash';
+import { SecurityLicense } from '../../../common/licensing';
 import { Feature } from '../../../../features/server';
-import { RawKibanaFeaturePrivileges, RawKibanaPrivileges } from '../../../common/model';
+import { RawKibanaPrivileges } from '../../../common/model';
 import { Actions } from '../actions';
 import { featurePrivilegeBuilderFactory } from './feature_privilege_builder';
 import { FeaturesService } from '../../plugin';
+import {
+  featurePrivilegeIterator,
+  subFeaturePrivilegeIterator,
+} from './feature_privilege_iterator';
 
 export interface PrivilegesService {
   get(): RawKibanaPrivileges;
 }
 
-export function privilegesFactory(actions: Actions, featuresService: FeaturesService) {
+export function privilegesFactory(
+  actions: Actions,
+  featuresService: FeaturesService,
+  licenseService: Pick<SecurityLicense, 'getFeatures'>
+) {
   const featurePrivilegeBuilder = featurePrivilegeBuilderFactory(actions);
 
   return {
     get() {
       const features = featuresService.getFeatures();
+      const { allowSubFeaturePrivileges } = licenseService.getFeatures();
       const basePrivilegeFeatures = features.filter(feature => !feature.excludeFromBasePrivileges);
 
-      const allActions = uniq(
-        flatten(
-          basePrivilegeFeatures.map(feature =>
-            Object.values(feature.privileges).reduce<string[]>((acc, privilege) => {
-              if (privilege.excludeFromBasePrivileges) {
-                return acc;
-              }
+      let allActions: string[] = [];
+      let readActions: string[] = [];
 
-              return [...acc, ...featurePrivilegeBuilder.getActions(privilege, feature)];
-            }, [])
-          )
-        )
-      );
+      basePrivilegeFeatures.forEach(feature => {
+        for (const { privilegeId, privilege } of featurePrivilegeIterator(feature, {
+          augmentWithSubFeaturePrivileges: true,
+          predicate: (pId, featurePrivilege) => !featurePrivilege.excludeFromBasePrivileges,
+        })) {
+          const privilegeActions = featurePrivilegeBuilder.getActions(privilege, feature);
+          allActions = [...allActions, ...privilegeActions];
+          if (privilegeId === 'read') {
+            readActions = [...readActions, ...privilegeActions];
+          }
+        }
+      });
 
-      const readActions = uniq(
-        flatten(
-          basePrivilegeFeatures.map(feature =>
-            Object.entries(feature.privileges).reduce<string[]>((acc, [privilegeId, privilege]) => {
-              if (privilegeId !== 'read' || privilege.excludeFromBasePrivileges) {
-                return acc;
-              }
+      allActions = uniq(allActions);
+      readActions = uniq(readActions);
 
-              return [...acc, ...featurePrivilegeBuilder.getActions(privilege, feature)];
-            }, [])
-          )
-        )
-      );
+      const featurePrivileges: Record<string, Record<string, string[]>> = {};
+      for (const feature of features) {
+        featurePrivileges[feature.id] = {};
+        for (const featurePrivilege of featurePrivilegeIterator(feature, {
+          augmentWithSubFeaturePrivileges: true,
+        })) {
+          featurePrivileges[feature.id][featurePrivilege.privilegeId] = [
+            actions.login,
+            actions.version,
+            ...uniq(featurePrivilegeBuilder.getActions(featurePrivilege.privilege, feature)),
+          ];
+        }
 
-      return {
-        features: features.reduce((acc: RawKibanaFeaturePrivileges, feature: Feature) => {
-          if (Object.keys(feature.privileges).length > 0) {
-            acc[feature.id] = mapValues(feature.privileges, (privilege, privilegeId) => [
+        if (allowSubFeaturePrivileges && feature.subFeatures?.length > 0) {
+          for (const featurePrivilege of featurePrivilegeIterator(feature, {
+            augmentWithSubFeaturePrivileges: false,
+          })) {
+            featurePrivileges[feature.id][`minimal_${featurePrivilege.privilegeId}`] = [
               actions.login,
               actions.version,
-              ...featurePrivilegeBuilder.getActions(privilege, feature),
-              ...(privilegeId === 'all' ? [actions.allHack] : []),
-            ]);
+              ...uniq(featurePrivilegeBuilder.getActions(featurePrivilege.privilege, feature)),
+            ];
           }
-          return acc;
-        }, {}),
+
+          for (const subFeaturePrivilege of subFeaturePrivilegeIterator(feature)) {
+            featurePrivileges[feature.id][subFeaturePrivilege.id] = [
+              actions.login,
+              actions.version,
+              ...uniq(featurePrivilegeBuilder.getActions(subFeaturePrivilege, feature)),
+            ];
+          }
+        }
+
+        if (Object.keys(featurePrivileges[feature.id]).length === 0) {
+          delete featurePrivileges[feature.id];
+        }
+      }
+
+      return {
+        features: featurePrivileges,
         global: {
           all: [
             actions.login,
@@ -72,12 +101,11 @@ export function privilegesFactory(actions: Actions, featuresService: FeaturesSer
             actions.ui.get('spaces', 'manage'),
             actions.ui.get('management', 'kibana', 'spaces'),
             ...allActions,
-            actions.allHack,
           ],
           read: [actions.login, actions.version, ...readActions],
         },
         space: {
-          all: [actions.login, actions.version, ...allActions, actions.allHack],
+          all: [actions.login, actions.version, ...allActions],
           read: [actions.login, actions.version, ...readActions],
         },
         reserved: features.reduce((acc: Record<string, string[]>, feature: Feature) => {
diff --git a/x-pack/plugins/security/server/authorization/validate_feature_privileges.test.ts b/x-pack/plugins/security/server/authorization/validate_feature_privileges.test.ts
index 3dc3ae03b18cb..ac386d287cff1 100644
--- a/x-pack/plugins/security/server/authorization/validate_feature_privileges.test.ts
+++ b/x-pack/plugins/security/server/authorization/validate_feature_privileges.test.ts
@@ -5,13 +5,42 @@
  */
 
 import { Feature } from '../../../features/server';
-import { Actions } from './actions';
 import { validateFeaturePrivileges } from './validate_feature_privileges';
 
-const actions = new Actions('1.0.0-zeta1');
+it('allows features to be defined without privileges', () => {
+  const feature: Feature = new Feature({
+    id: 'foo',
+    name: 'foo',
+    app: [],
+    privileges: null,
+  });
 
-it(`doesn't allow read to grant privileges which aren't also included in all`, () => {
-  const feature: Feature = {
+  validateFeaturePrivileges([feature]);
+});
+
+it('allows features with reserved privileges to be defined', () => {
+  const feature: Feature = new Feature({
+    id: 'foo',
+    name: 'foo',
+    app: [],
+    privileges: null,
+    reserved: {
+      description: 'foo',
+      privilege: {
+        savedObject: {
+          all: ['foo'],
+          read: ['bar'],
+        },
+        ui: [],
+      },
+    },
+  });
+
+  validateFeaturePrivileges([feature]);
+});
+
+it('allows features with sub-features to be defined', () => {
+  const feature: Feature = new Feature({
     id: 'foo',
     name: 'foo',
     app: [],
@@ -31,15 +60,50 @@ it(`doesn't allow read to grant privileges which aren't also included in all`, (
         ui: [],
       },
     },
-  };
+    subFeatures: [
+      {
+        name: 'sub-feature-1',
+        privilegeGroups: [
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'sub-feature-1-priv-1',
+                name: 'some sub feature',
+                includeIn: 'all',
+                savedObject: {
+                  all: ['foo'],
+                  read: ['bar', 'baz'],
+                },
+                ui: [],
+              },
+            ],
+          },
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'sub-feature-1-priv-2',
+                name: 'some second sub feature',
+                includeIn: 'none',
+                savedObject: {
+                  all: ['foo', 'bar'],
+                  read: ['baz'],
+                },
+                ui: [],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  });
 
-  expect(() => validateFeaturePrivileges(actions, [feature])).toThrowErrorMatchingInlineSnapshot(
-    `"foo's \\"all\\" privilege should be a superset of the \\"read\\" privilege."`
-  );
+  validateFeaturePrivileges([feature]);
 });
 
-it(`allows all and read to grant the same privileges`, () => {
-  const feature: Feature = {
+it('does not allow features with sub-features which have id conflicts with the minimal privileges', () => {
+  const feature: Feature = new Feature({
     id: 'foo',
     name: 'foo',
     app: [],
@@ -54,18 +118,42 @@ it(`allows all and read to grant the same privileges`, () => {
       read: {
         savedObject: {
           all: ['foo'],
-          read: ['bar'],
+          read: ['bar', 'baz'],
         },
         ui: [],
       },
     },
-  };
+    subFeatures: [
+      {
+        name: 'sub-feature-1',
+        privilegeGroups: [
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'minimal_all',
+                name: 'some sub feature',
+                includeIn: 'all',
+                savedObject: {
+                  all: ['foo'],
+                  read: ['bar', 'baz'],
+                },
+                ui: [],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  });
 
-  validateFeaturePrivileges(actions, [feature]);
+  expect(() => validateFeaturePrivileges([feature])).toThrowErrorMatchingInlineSnapshot(
+    `"Feature 'foo' already has a privilege with ID 'minimal_all'. Sub feature 'sub-feature-1' cannot also specify this."`
+  );
 });
 
-it(`allows all to grant privileges in addition to read`, () => {
-  const feature: Feature = {
+it('does not allow features with sub-features which have id conflicts with the primary feature privileges', () => {
+  const feature: Feature = new Feature({
     id: 'foo',
     name: 'foo',
     app: [],
@@ -73,19 +161,113 @@ it(`allows all to grant privileges in addition to read`, () => {
       all: {
         savedObject: {
           all: ['foo'],
-          read: ['bar', 'baz'],
+          read: ['bar'],
         },
         ui: [],
       },
       read: {
+        savedObject: {
+          all: ['foo'],
+          read: ['bar', 'baz'],
+        },
+        ui: [],
+      },
+    },
+    subFeatures: [
+      {
+        name: 'sub-feature-1',
+        privilegeGroups: [
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'read',
+                name: 'some sub feature',
+                includeIn: 'all',
+                savedObject: {
+                  all: ['foo'],
+                  read: ['bar', 'baz'],
+                },
+                ui: [],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  });
+
+  expect(() => validateFeaturePrivileges([feature])).toThrowErrorMatchingInlineSnapshot(
+    `"Feature 'foo' already has a privilege with ID 'read'. Sub feature 'sub-feature-1' cannot also specify this."`
+  );
+});
+
+it('does not allow features with sub-features which have id conflicts each other', () => {
+  const feature: Feature = new Feature({
+    id: 'foo',
+    name: 'foo',
+    app: [],
+    privileges: {
+      all: {
         savedObject: {
           all: ['foo'],
           read: ['bar'],
         },
         ui: [],
       },
+      read: {
+        savedObject: {
+          all: ['foo'],
+          read: ['bar', 'baz'],
+        },
+        ui: [],
+      },
     },
-  };
+    subFeatures: [
+      {
+        name: 'sub-feature-1',
+        privilegeGroups: [
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'some-sub-feature',
+                name: 'some sub feature',
+                includeIn: 'all',
+                savedObject: {
+                  all: ['foo'],
+                  read: ['bar', 'baz'],
+                },
+                ui: [],
+              },
+            ],
+          },
+        ],
+      },
+      {
+        name: 'sub-feature-2',
+        privilegeGroups: [
+          {
+            groupType: 'independent',
+            privileges: [
+              {
+                id: 'some-sub-feature',
+                name: 'some sub feature',
+                includeIn: 'all',
+                savedObject: {
+                  all: ['foo'],
+                  read: ['bar', 'baz'],
+                },
+                ui: [],
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  });
 
-  validateFeaturePrivileges(actions, [feature]);
+  expect(() => validateFeaturePrivileges([feature])).toThrowErrorMatchingInlineSnapshot(
+    `"Feature 'foo' already has a privilege with ID 'some-sub-feature'. Sub feature 'sub-feature-2' cannot also specify this."`
+  );
 });
diff --git a/x-pack/plugins/security/server/authorization/validate_feature_privileges.ts b/x-pack/plugins/security/server/authorization/validate_feature_privileges.ts
index 7998c816ae1c7..510feb1151a9b 100644
--- a/x-pack/plugins/security/server/authorization/validate_feature_privileges.ts
+++ b/x-pack/plugins/security/server/authorization/validate_feature_privileges.ts
@@ -5,21 +5,27 @@
  */
 
 import { Feature } from '../../../features/server';
-import { areActionsFullyCovered } from '../../common/privilege_calculator_utils';
-import { Actions } from './actions';
-import { featurePrivilegeBuilderFactory } from './privileges/feature_privilege_builder';
 
-export function validateFeaturePrivileges(actions: Actions, features: Feature[]) {
-  const featurePrivilegeBuilder = featurePrivilegeBuilderFactory(actions);
+export function validateFeaturePrivileges(features: Feature[]) {
   for (const feature of features) {
-    if (feature.privileges.all != null && feature.privileges.read != null) {
-      const allActions = featurePrivilegeBuilder.getActions(feature.privileges.all, feature);
-      const readActions = featurePrivilegeBuilder.getActions(feature.privileges.read, feature);
-      if (!areActionsFullyCovered(allActions, readActions)) {
-        throw new Error(
-          `${feature.id}'s "all" privilege should be a superset of the "read" privilege.`
-        );
-      }
-    }
+    const seenPrivilegeIds = new Set<string>();
+    Object.keys(feature.privileges ?? {}).forEach(privilegeId => {
+      seenPrivilegeIds.add(privilegeId);
+      seenPrivilegeIds.add(`minimal_${privilegeId}`);
+    });
+
+    const subFeatureEntries = feature.subFeatures ?? [];
+    subFeatureEntries.forEach(subFeature => {
+      subFeature.privilegeGroups.forEach(subFeaturePrivilegeGroup => {
+        subFeaturePrivilegeGroup.privileges.forEach(subFeaturePrivilege => {
+          if (seenPrivilegeIds.has(subFeaturePrivilege.id)) {
+            throw new Error(
+              `Feature '${feature.id}' already has a privilege with ID '${subFeaturePrivilege.id}'. Sub feature '${subFeature.name}' cannot also specify this.`
+            );
+          }
+          seenPrivilegeIds.add(subFeaturePrivilege.id);
+        });
+      });
+    });
   }
 }
diff --git a/x-pack/plugins/security/server/config.test.ts b/x-pack/plugins/security/server/config.test.ts
index 8532622906ffe..d0f497b2c924b 100644
--- a/x-pack/plugins/security/server/config.test.ts
+++ b/x-pack/plugins/security/server/config.test.ts
@@ -6,9 +6,8 @@
 
 jest.mock('crypto', () => ({ randomBytes: jest.fn() }));
 
-import { first } from 'rxjs/operators';
-import { loggingServiceMock, coreMock } from '../../../../src/core/server/mocks';
-import { createConfig$, ConfigSchema } from './config';
+import { loggingServiceMock } from '../../../../src/core/server/mocks';
+import { createConfig, ConfigSchema } from './config';
 
 describe('config schema', () => {
   it('generates proper defaults', () => {
@@ -25,9 +24,22 @@ describe('config schema', () => {
               "apikey",
             ],
           },
-          "providers": Array [
-            "basic",
-          ],
+          "providers": Object {
+            "basic": Object {
+              "basic": Object {
+                "description": undefined,
+                "enabled": true,
+                "order": 0,
+                "showInSelector": true,
+              },
+            },
+            "kerberos": undefined,
+            "oidc": undefined,
+            "pki": undefined,
+            "saml": undefined,
+            "token": undefined,
+          },
+          "selector": Object {},
         },
         "cookieName": "sid",
         "enabled": true,
@@ -55,9 +67,22 @@ describe('config schema', () => {
               "apikey",
             ],
           },
-          "providers": Array [
-            "basic",
-          ],
+          "providers": Object {
+            "basic": Object {
+              "basic": Object {
+                "description": undefined,
+                "enabled": true,
+                "order": 0,
+                "showInSelector": true,
+              },
+            },
+            "kerberos": undefined,
+            "oidc": undefined,
+            "pki": undefined,
+            "saml": undefined,
+            "token": undefined,
+          },
+          "selector": Object {},
         },
         "cookieName": "sid",
         "enabled": true,
@@ -85,9 +110,22 @@ describe('config schema', () => {
               "apikey",
             ],
           },
-          "providers": Array [
-            "basic",
-          ],
+          "providers": Object {
+            "basic": Object {
+              "basic": Object {
+                "description": undefined,
+                "enabled": true,
+                "order": 0,
+                "showInSelector": true,
+              },
+            },
+            "kerberos": undefined,
+            "oidc": undefined,
+            "pki": undefined,
+            "saml": undefined,
+            "token": undefined,
+          },
+          "selector": Object {},
         },
         "cookieName": "sid",
         "enabled": true,
@@ -254,6 +292,7 @@ describe('config schema', () => {
           "providers": Array [
             "oidc",
           ],
+          "selector": Object {},
         }
       `);
     });
@@ -287,6 +326,7 @@ describe('config schema', () => {
             "oidc",
             "basic",
           ],
+          "selector": Object {},
         }
       `);
     });
@@ -318,6 +358,7 @@ describe('config schema', () => {
               "valueInBytes": 2048,
             },
           },
+          "selector": Object {},
         }
       `);
 
@@ -339,6 +380,7 @@ describe('config schema', () => {
               "valueInBytes": 2048,
             },
           },
+          "selector": Object {},
         }
       `);
 
@@ -364,6 +406,7 @@ describe('config schema', () => {
             },
             "realm": "realm-1",
           },
+          "selector": Object {},
         }
       `);
     });
@@ -441,27 +484,476 @@ describe('config schema', () => {
             `);
     });
   });
+
+  describe('authc.providers (extended format)', () => {
+    describe('`basic` provider', () => {
+      it('requires `order`', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { basic: { basic1: { enabled: true } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.basic.basic1.order]: expected value of type [number] but got [undefined]"
+`);
+      });
+
+      it('does not allow custom description', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: {
+              providers: { basic: { basic1: { order: 0, description: 'Some description' } } },
+            },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.basic.basic1.description]: \`basic\` provider does not support custom description."
+`);
+      });
+
+      it('cannot be hidden from selector', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: {
+              providers: { basic: { basic1: { order: 0, showInSelector: false } } },
+            },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.basic.basic1.showInSelector]: \`basic\` provider only supports \`true\` in \`showInSelector\`."
+`);
+      });
+
+      it('can have only provider of this type', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { basic: { basic1: { order: 0 }, basic2: { order: 1 } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.basic]: Only one \\"basic\\" provider can be configured."
+`);
+      });
+
+      it('can be successfully validated', () => {
+        expect(
+          ConfigSchema.validate({
+            authc: { providers: { basic: { basic1: { order: 0 } } } },
+          }).authc.providers
+        ).toMatchInlineSnapshot(`
+          Object {
+            "basic": Object {
+              "basic1": Object {
+                "enabled": true,
+                "order": 0,
+                "showInSelector": true,
+              },
+            },
+          }
+        `);
+      });
+    });
+
+    describe('`token` provider', () => {
+      it('requires `order`', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { token: { token1: { enabled: true } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.token.token1.order]: expected value of type [number] but got [undefined]"
+`);
+      });
+
+      it('does not allow custom description', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: {
+              providers: { token: { token1: { order: 0, description: 'Some description' } } },
+            },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.token.token1.description]: \`token\` provider does not support custom description."
+`);
+      });
+
+      it('cannot be hidden from selector', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: {
+              providers: { token: { token1: { order: 0, showInSelector: false } } },
+            },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.token.token1.showInSelector]: \`token\` provider only supports \`true\` in \`showInSelector\`."
+`);
+      });
+
+      it('can have only provider of this type', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { token: { token1: { order: 0 }, token2: { order: 1 } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.token]: Only one \\"token\\" provider can be configured."
+`);
+      });
+
+      it('can be successfully validated', () => {
+        expect(
+          ConfigSchema.validate({
+            authc: { providers: { token: { token1: { order: 0 } } } },
+          }).authc.providers
+        ).toMatchInlineSnapshot(`
+          Object {
+            "token": Object {
+              "token1": Object {
+                "enabled": true,
+                "order": 0,
+                "showInSelector": true,
+              },
+            },
+          }
+        `);
+      });
+    });
+
+    describe('`pki` provider', () => {
+      it('requires `order`', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { pki: { pki1: { enabled: true } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.pki.pki1.order]: expected value of type [number] but got [undefined]"
+`);
+      });
+
+      it('can have only provider of this type', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { pki: { pki1: { order: 0 }, pki2: { order: 1 } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.pki]: Only one \\"pki\\" provider can be configured."
+`);
+      });
+
+      it('can be successfully validated', () => {
+        expect(
+          ConfigSchema.validate({
+            authc: { providers: { pki: { pki1: { order: 0 } } } },
+          }).authc.providers
+        ).toMatchInlineSnapshot(`
+          Object {
+            "pki": Object {
+              "pki1": Object {
+                "enabled": true,
+                "order": 0,
+                "showInSelector": true,
+              },
+            },
+          }
+        `);
+      });
+    });
+
+    describe('`kerberos` provider', () => {
+      it('requires `order`', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { kerberos: { kerberos1: { enabled: true } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.kerberos.kerberos1.order]: expected value of type [number] but got [undefined]"
+`);
+      });
+
+      it('can have only provider of this type', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: {
+              providers: { kerberos: { kerberos1: { order: 0 }, kerberos2: { order: 1 } } },
+            },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.kerberos]: Only one \\"kerberos\\" provider can be configured."
+`);
+      });
+
+      it('can be successfully validated', () => {
+        expect(
+          ConfigSchema.validate({
+            authc: { providers: { kerberos: { kerberos1: { order: 0 } } } },
+          }).authc.providers
+        ).toMatchInlineSnapshot(`
+          Object {
+            "kerberos": Object {
+              "kerberos1": Object {
+                "enabled": true,
+                "order": 0,
+                "showInSelector": true,
+              },
+            },
+          }
+        `);
+      });
+    });
+
+    describe('`oidc` provider', () => {
+      it('requires `order`', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { oidc: { oidc1: { enabled: true } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.oidc.oidc1.order]: expected value of type [number] but got [undefined]"
+`);
+      });
+
+      it('requires `realm`', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { oidc: { oidc1: { order: 0 } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.oidc.oidc1.realm]: expected value of type [string] but got [undefined]"
+`);
+      });
+
+      it('can be successfully validated', () => {
+        expect(
+          ConfigSchema.validate({
+            authc: {
+              providers: {
+                oidc: { oidc1: { order: 0, realm: 'oidc1' }, oidc2: { order: 1, realm: 'oidc2' } },
+              },
+            },
+          }).authc.providers
+        ).toMatchInlineSnapshot(`
+          Object {
+            "oidc": Object {
+              "oidc1": Object {
+                "enabled": true,
+                "order": 0,
+                "realm": "oidc1",
+                "showInSelector": true,
+              },
+              "oidc2": Object {
+                "enabled": true,
+                "order": 1,
+                "realm": "oidc2",
+                "showInSelector": true,
+              },
+            },
+          }
+        `);
+      });
+    });
+
+    describe('`saml` provider', () => {
+      it('requires `order`', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { saml: { saml1: { enabled: true } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.saml.saml1.order]: expected value of type [number] but got [undefined]"
+`);
+      });
+
+      it('requires `realm`', () => {
+        expect(() =>
+          ConfigSchema.validate({
+            authc: { providers: { saml: { saml1: { order: 0 } } } },
+          })
+        ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1.saml.saml1.realm]: expected value of type [string] but got [undefined]"
+`);
+      });
+
+      it('can be successfully validated', () => {
+        expect(
+          ConfigSchema.validate({
+            authc: {
+              providers: {
+                saml: {
+                  saml1: { order: 0, realm: 'saml1' },
+                  saml2: { order: 1, realm: 'saml2', maxRedirectURLSize: '1kb' },
+                },
+              },
+            },
+          }).authc.providers
+        ).toMatchInlineSnapshot(`
+          Object {
+            "saml": Object {
+              "saml1": Object {
+                "enabled": true,
+                "maxRedirectURLSize": ByteSizeValue {
+                  "valueInBytes": 2048,
+                },
+                "order": 0,
+                "realm": "saml1",
+                "showInSelector": true,
+              },
+              "saml2": Object {
+                "enabled": true,
+                "maxRedirectURLSize": ByteSizeValue {
+                  "valueInBytes": 1024,
+                },
+                "order": 1,
+                "realm": "saml2",
+                "showInSelector": true,
+              },
+            },
+          }
+        `);
+      });
+    });
+
+    it('`name` should be unique across all provider types', () => {
+      expect(() =>
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              basic: { provider1: { order: 0 } },
+              saml: {
+                provider2: { order: 1, realm: 'saml1' },
+                provider1: { order: 2, realm: 'saml2' },
+              },
+            },
+          },
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1]: Found multiple providers configured with the same name \\"provider1\\": [xpack.security.authc.providers.basic.provider1, xpack.security.authc.providers.saml.provider1]"
+`);
+    });
+
+    it('`order` should be unique across all provider types', () => {
+      expect(() =>
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              basic: { provider1: { order: 0 } },
+              saml: {
+                provider2: { order: 0, realm: 'saml1' },
+                provider3: { order: 2, realm: 'saml2' },
+              },
+            },
+          },
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`
+"[authc.providers]: types that failed validation:
+- [authc.providers.0]: expected value of type [array] but got [Object]
+- [authc.providers.1]: Found multiple providers configured with the same order \\"0\\": [xpack.security.authc.providers.basic.provider1, xpack.security.authc.providers.saml.provider2]"
+`);
+    });
+
+    it('can be successfully validated with multiple providers ignoring uniqueness violations in disabled ones', () => {
+      expect(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              basic: { basic1: { order: 0 }, basic2: { enabled: false, order: 1 } },
+              saml: {
+                saml1: { order: 1, realm: 'saml1' },
+                saml2: { order: 2, realm: 'saml2' },
+                basic1: { order: 3, realm: 'saml3', enabled: false },
+              },
+            },
+          },
+        }).authc.providers
+      ).toMatchInlineSnapshot(`
+        Object {
+          "basic": Object {
+            "basic1": Object {
+              "enabled": true,
+              "order": 0,
+              "showInSelector": true,
+            },
+            "basic2": Object {
+              "enabled": false,
+              "order": 1,
+              "showInSelector": true,
+            },
+          },
+          "saml": Object {
+            "basic1": Object {
+              "enabled": false,
+              "maxRedirectURLSize": ByteSizeValue {
+                "valueInBytes": 2048,
+              },
+              "order": 3,
+              "realm": "saml3",
+              "showInSelector": true,
+            },
+            "saml1": Object {
+              "enabled": true,
+              "maxRedirectURLSize": ByteSizeValue {
+                "valueInBytes": 2048,
+              },
+              "order": 1,
+              "realm": "saml1",
+              "showInSelector": true,
+            },
+            "saml2": Object {
+              "enabled": true,
+              "maxRedirectURLSize": ByteSizeValue {
+                "valueInBytes": 2048,
+              },
+              "order": 2,
+              "realm": "saml2",
+              "showInSelector": true,
+            },
+          },
+        }
+      `);
+    });
+  });
 });
 
-describe('createConfig$()', () => {
-  const mockAndCreateConfig = async (isTLSEnabled: boolean, value = {}, context?: any) => {
-    const contextMock = coreMock.createPluginInitializerContext(
-      // we must use validate to avoid errors in `createConfig$`
-      ConfigSchema.validate(value, context)
-    );
-    return await createConfig$(contextMock, isTLSEnabled)
-      .pipe(first())
-      .toPromise()
-      .then(config => ({ contextMock, config }));
-  };
+describe('createConfig()', () => {
   it('should log a warning and set xpack.security.encryptionKey if not set', async () => {
     const mockRandomBytes = jest.requireMock('crypto').randomBytes;
     mockRandomBytes.mockReturnValue('ab'.repeat(16));
 
-    const { contextMock, config } = await mockAndCreateConfig(true, {}, { dist: true });
+    const logger = loggingServiceMock.create().get();
+    const config = createConfig(ConfigSchema.validate({}, { dist: true }), logger, {
+      isTLSEnabled: true,
+    });
     expect(config.encryptionKey).toEqual('ab'.repeat(16));
 
-    expect(loggingServiceMock.collect(contextMock.logger).warn).toMatchInlineSnapshot(`
+    expect(loggingServiceMock.collect(logger).warn).toMatchInlineSnapshot(`
                         Array [
                           Array [
                             "Generating a random key for xpack.security.encryptionKey. To prevent sessions from being invalidated on restart, please set xpack.security.encryptionKey in kibana.yml",
@@ -471,10 +963,11 @@ describe('createConfig$()', () => {
   });
 
   it('should log a warning if SSL is not configured', async () => {
-    const { contextMock, config } = await mockAndCreateConfig(false, {});
+    const logger = loggingServiceMock.create().get();
+    const config = createConfig(ConfigSchema.validate({}), logger, { isTLSEnabled: false });
     expect(config.secureCookies).toEqual(false);
 
-    expect(loggingServiceMock.collect(contextMock.logger).warn).toMatchInlineSnapshot(`
+    expect(loggingServiceMock.collect(logger).warn).toMatchInlineSnapshot(`
                         Array [
                           Array [
                             "Session cookies will be transmitted over insecure connections. This is not recommended.",
@@ -484,10 +977,13 @@ describe('createConfig$()', () => {
   });
 
   it('should log a warning if SSL is not configured yet secure cookies are being used', async () => {
-    const { contextMock, config } = await mockAndCreateConfig(false, { secureCookies: true });
+    const logger = loggingServiceMock.create().get();
+    const config = createConfig(ConfigSchema.validate({ secureCookies: true }), logger, {
+      isTLSEnabled: false,
+    });
     expect(config.secureCookies).toEqual(true);
 
-    expect(loggingServiceMock.collect(contextMock.logger).warn).toMatchInlineSnapshot(`
+    expect(loggingServiceMock.collect(logger).warn).toMatchInlineSnapshot(`
                         Array [
                           Array [
                             "Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.",
@@ -497,9 +993,210 @@ describe('createConfig$()', () => {
   });
 
   it('should set xpack.security.secureCookies if SSL is configured', async () => {
-    const { contextMock, config } = await mockAndCreateConfig(true, {});
+    const logger = loggingServiceMock.create().get();
+    const config = createConfig(ConfigSchema.validate({}), logger, { isTLSEnabled: true });
     expect(config.secureCookies).toEqual(true);
 
-    expect(loggingServiceMock.collect(contextMock.logger).warn).toEqual([]);
+    expect(loggingServiceMock.collect(logger).warn).toEqual([]);
+  });
+
+  it('transforms legacy `authc.providers` into new format', () => {
+    const logger = loggingServiceMock.create().get();
+
+    expect(
+      createConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: ['saml', 'basic'],
+            saml: { realm: 'saml-realm' },
+          },
+        }),
+        logger,
+        { isTLSEnabled: true }
+      ).authc
+    ).toMatchInlineSnapshot(`
+      Object {
+        "http": Object {
+          "autoSchemesEnabled": true,
+          "enabled": true,
+          "schemes": Array [
+            "apikey",
+          ],
+        },
+        "providers": Object {
+          "basic": Object {
+            "basic": Object {
+              "enabled": true,
+              "order": 1,
+              "showInSelector": true,
+            },
+          },
+          "saml": Object {
+            "saml": Object {
+              "enabled": true,
+              "maxRedirectURLSize": ByteSizeValue {
+                "valueInBytes": 2048,
+              },
+              "order": 0,
+              "realm": "saml-realm",
+              "showInSelector": true,
+            },
+          },
+        },
+        "selector": Object {
+          "enabled": false,
+        },
+        "sortedProviders": Array [
+          Object {
+            "name": "saml",
+            "options": Object {
+              "description": undefined,
+              "order": 0,
+              "showInSelector": true,
+            },
+            "type": "saml",
+          },
+          Object {
+            "name": "basic",
+            "options": Object {
+              "description": undefined,
+              "order": 1,
+              "showInSelector": true,
+            },
+            "type": "basic",
+          },
+        ],
+      }
+    `);
+  });
+
+  it('does not automatically set `authc.selector.enabled` to `true` if legacy `authc.providers` format is used', () => {
+    expect(
+      createConfig(
+        ConfigSchema.validate({
+          authc: { providers: ['saml', 'basic'], saml: { realm: 'saml-realm' } },
+        }),
+        loggingServiceMock.create().get(),
+        { isTLSEnabled: true }
+      ).authc.selector.enabled
+    ).toBe(false);
+
+    // But keep it as `true` if it's explicitly set.
+    expect(
+      createConfig(
+        ConfigSchema.validate({
+          authc: {
+            selector: { enabled: true },
+            providers: ['saml', 'basic'],
+            saml: { realm: 'saml-realm' },
+          },
+        }),
+        loggingServiceMock.create().get(),
+        { isTLSEnabled: true }
+      ).authc.selector.enabled
+    ).toBe(true);
+  });
+
+  it('does not automatically set `authc.selector.enabled` to `true` if less than 2 providers must be shown there', () => {
+    expect(
+      createConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              basic: { basic1: { order: 0 } },
+              saml: {
+                saml1: { order: 1, realm: 'saml1', showInSelector: false },
+                saml2: { enabled: false, order: 2, realm: 'saml2' },
+              },
+            },
+          },
+        }),
+        loggingServiceMock.create().get(),
+        { isTLSEnabled: true }
+      ).authc.selector.enabled
+    ).toBe(false);
+  });
+
+  it('automatically set `authc.selector.enabled` to `true` if more than 1 provider must be shown there', () => {
+    expect(
+      createConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              basic: { basic1: { order: 0 } },
+              saml: { saml1: { order: 1, realm: 'saml1' }, saml2: { order: 2, realm: 'saml2' } },
+            },
+          },
+        }),
+        loggingServiceMock.create().get(),
+        { isTLSEnabled: true }
+      ).authc.selector.enabled
+    ).toBe(true);
+  });
+
+  it('correctly sorts providers based on the `order`', () => {
+    expect(
+      createConfig(
+        ConfigSchema.validate({
+          authc: {
+            providers: {
+              basic: { basic1: { order: 3 } },
+              saml: { saml1: { order: 2, realm: 'saml1' }, saml2: { order: 1, realm: 'saml2' } },
+              oidc: { oidc1: { order: 0, realm: 'oidc1' }, oidc2: { order: 4, realm: 'oidc2' } },
+            },
+          },
+        }),
+        loggingServiceMock.create().get(),
+        { isTLSEnabled: true }
+      ).authc.sortedProviders
+    ).toMatchInlineSnapshot(`
+      Array [
+        Object {
+          "name": "oidc1",
+          "options": Object {
+            "description": undefined,
+            "order": 0,
+            "showInSelector": true,
+          },
+          "type": "oidc",
+        },
+        Object {
+          "name": "saml2",
+          "options": Object {
+            "description": undefined,
+            "order": 1,
+            "showInSelector": true,
+          },
+          "type": "saml",
+        },
+        Object {
+          "name": "saml1",
+          "options": Object {
+            "description": undefined,
+            "order": 2,
+            "showInSelector": true,
+          },
+          "type": "saml",
+        },
+        Object {
+          "name": "basic1",
+          "options": Object {
+            "description": undefined,
+            "order": 3,
+            "showInSelector": true,
+          },
+          "type": "basic",
+        },
+        Object {
+          "name": "oidc2",
+          "options": Object {
+            "description": undefined,
+            "order": 4,
+            "showInSelector": true,
+          },
+          "type": "oidc",
+        },
+      ]
+    `);
   });
 });
diff --git a/x-pack/plugins/security/server/config.ts b/x-pack/plugins/security/server/config.ts
index 55f088629611f..2d6feee6bc9d7 100644
--- a/x-pack/plugins/security/server/config.ts
+++ b/x-pack/plugins/security/server/config.ts
@@ -5,14 +5,10 @@
  */
 
 import crypto from 'crypto';
-import { Observable } from 'rxjs';
-import { map } from 'rxjs/operators';
 import { schema, Type, TypeOf } from '@kbn/config-schema';
-import { PluginInitializerContext } from '../../../../src/core/server';
+import { Logger } from '../../../../src/core/server';
 
-export type ConfigType = ReturnType<typeof createConfig$> extends Observable<infer P>
-  ? P
-  : ReturnType<typeof createConfig$>;
+export type ConfigType = ReturnType<typeof createConfig>;
 
 const providerOptionsSchema = (providerType: string, optionsSchema: Type<any>) =>
   schema.conditional(
@@ -24,6 +20,114 @@ const providerOptionsSchema = (providerType: string, optionsSchema: Type<any>) =
     schema.never()
   );
 
+type ProvidersCommonConfigType = Record<
+  'enabled' | 'showInSelector' | 'order' | 'description',
+  Type<any>
+>;
+function getCommonProviderSchemaProperties(overrides: Partial<ProvidersCommonConfigType> = {}) {
+  return {
+    enabled: schema.boolean({ defaultValue: true }),
+    showInSelector: schema.boolean({ defaultValue: true }),
+    order: schema.number({ min: 0 }),
+    description: schema.maybe(schema.string()),
+    ...overrides,
+  };
+}
+
+function getUniqueProviderSchema(
+  providerType: string,
+  overrides?: Partial<ProvidersCommonConfigType>
+) {
+  return schema.maybe(
+    schema.recordOf(schema.string(), schema.object(getCommonProviderSchemaProperties(overrides)), {
+      validate(config) {
+        if (Object.values(config).filter(provider => provider.enabled).length > 1) {
+          return `Only one "${providerType}" provider can be configured.`;
+        }
+      },
+    })
+  );
+}
+
+type ProvidersConfigType = TypeOf<typeof providersConfigSchema>;
+const providersConfigSchema = schema.object(
+  {
+    basic: getUniqueProviderSchema('basic', {
+      description: schema.maybe(
+        schema.any({
+          validate: () => '`basic` provider does not support custom description.',
+        })
+      ),
+      showInSelector: schema.boolean({
+        defaultValue: true,
+        validate: value => {
+          if (!value) {
+            return '`basic` provider only supports `true` in `showInSelector`.';
+          }
+        },
+      }),
+    }),
+    token: getUniqueProviderSchema('token', {
+      description: schema.maybe(
+        schema.any({
+          validate: () => '`token` provider does not support custom description.',
+        })
+      ),
+      showInSelector: schema.boolean({
+        defaultValue: true,
+        validate: value => {
+          if (!value) {
+            return '`token` provider only supports `true` in `showInSelector`.';
+          }
+        },
+      }),
+    }),
+    kerberos: getUniqueProviderSchema('kerberos'),
+    pki: getUniqueProviderSchema('pki'),
+    saml: schema.maybe(
+      schema.recordOf(
+        schema.string(),
+        schema.object({
+          ...getCommonProviderSchemaProperties(),
+          realm: schema.string(),
+          maxRedirectURLSize: schema.byteSize({ defaultValue: '2kb' }),
+        })
+      )
+    ),
+    oidc: schema.maybe(
+      schema.recordOf(
+        schema.string(),
+        schema.object({ ...getCommonProviderSchemaProperties(), realm: schema.string() })
+      )
+    ),
+  },
+  {
+    validate(config) {
+      const checks = { sameOrder: new Map<number, string>(), sameName: new Map<string, string>() };
+      for (const [providerType, providerGroup] of Object.entries(config)) {
+        for (const [providerName, { enabled, order }] of Object.entries(providerGroup ?? {})) {
+          if (!enabled) {
+            continue;
+          }
+
+          const providerPath = `xpack.security.authc.providers.${providerType}.${providerName}`;
+          const providerWithSameOrderPath = checks.sameOrder.get(order);
+          if (providerWithSameOrderPath) {
+            return `Found multiple providers configured with the same order "${order}": [${providerWithSameOrderPath}, ${providerPath}]`;
+          }
+          checks.sameOrder.set(order, providerPath);
+
+          const providerWithSameName = checks.sameName.get(providerName);
+          if (providerWithSameName) {
+            return `Found multiple providers configured with the same name "${providerName}": [${providerWithSameName}, ${providerPath}]`;
+          }
+          checks.sameName.set(providerName, providerPath);
+        }
+      }
+    },
+  }
+);
+
 export const ConfigSchema = schema.object({
   enabled: schema.boolean({ defaultValue: true }),
   loginAssistanceMessage: schema.string({ defaultValue: '' }),
@@ -45,7 +149,17 @@ export const ConfigSchema = schema.object({
     port: schema.maybe(schema.number({ min: 0, max: 65535 })),
   }),
   authc: schema.object({
-    providers: schema.arrayOf(schema.string(), { defaultValue: ['basic'], minSize: 1 }),
+    selector: schema.object({ enabled: schema.maybe(schema.boolean()) }),
+    providers: schema.oneOf([schema.arrayOf(schema.string()), providersConfigSchema], {
+      defaultValue: {
+        basic: { basic: { enabled: true, showInSelector: true, order: 0, description: undefined } },
+        token: undefined,
+        saml: undefined,
+        oidc: undefined,
+        pki: undefined,
+        kerberos: undefined,
+      },
+    }),
     oidc: providerOptionsSchema('oidc', schema.object({ realm: schema.string() })),
     saml: providerOptionsSchema(
       'saml',
@@ -65,42 +179,96 @@ export const ConfigSchema = schema.object({
   }),
 });
 
-export function createConfig$(context: PluginInitializerContext, isTLSEnabled: boolean) {
-  return context.config.create<TypeOf<typeof ConfigSchema>>().pipe(
-    map(config => {
-      const logger = context.logger.get('config');
+export function createConfig(
+  config: TypeOf<typeof ConfigSchema>,
+  logger: Logger,
+  { isTLSEnabled }: { isTLSEnabled: boolean }
+) {
+  let encryptionKey = config.encryptionKey;
+  if (encryptionKey === undefined) {
+    logger.warn(
+      'Generating a random key for xpack.security.encryptionKey. To prevent sessions from being invalidated on ' +
+        'restart, please set xpack.security.encryptionKey in kibana.yml'
+    );
 
-      let encryptionKey = config.encryptionKey;
-      if (encryptionKey === undefined) {
-        logger.warn(
-          'Generating a random key for xpack.security.encryptionKey. To prevent sessions from being invalidated on ' +
-            'restart, please set xpack.security.encryptionKey in kibana.yml'
-        );
+    encryptionKey = crypto.randomBytes(16).toString('hex');
+  }
 
-        encryptionKey = crypto.randomBytes(16).toString('hex');
-      }
+  let secureCookies = config.secureCookies;
+  if (!isTLSEnabled) {
+    if (secureCookies) {
+      logger.warn(
+        'Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to ' +
+          'function properly.'
+      );
+    } else {
+      logger.warn(
+        'Session cookies will be transmitted over insecure connections. This is not recommended.'
+      );
+    }
+  } else if (!secureCookies) {
+    secureCookies = true;
+  }
 
-      let secureCookies = config.secureCookies;
-      if (!isTLSEnabled) {
-        if (secureCookies) {
-          logger.warn(
-            'Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to ' +
-              'function properly.'
-          );
-        } else {
-          logger.warn(
-            'Session cookies will be transmitted over insecure connections. This is not recommended.'
-          );
-        }
-      } else if (!secureCookies) {
-        secureCookies = true;
+  const isUsingLegacyProvidersFormat = Array.isArray(config.authc.providers);
+  const providers = (isUsingLegacyProvidersFormat
+    ? [...new Set(config.authc.providers as Array<keyof ProvidersConfigType>)].reduce(
+        (legacyProviders, providerType, order) => {
+          legacyProviders[providerType] = {
+            [providerType]:
+              providerType === 'saml' || providerType === 'oidc'
+                ? { enabled: true, showInSelector: true, order, ...config.authc[providerType] }
+                : { enabled: true, showInSelector: true, order },
+          };
+          return legacyProviders;
+        },
+        {} as Record<string, unknown>
+      )
+    : config.authc.providers) as ProvidersConfigType;
+
+  // Remove disabled providers and sort the rest.
+  const sortedProviders: Array<{
+    type: keyof ProvidersConfigType;
+    name: string;
+    options: { order: number; showInSelector: boolean; description?: string };
+  }> = [];
+  for (const [type, providerGroup] of Object.entries(providers)) {
+    for (const [name, { enabled, showInSelector, order, description }] of Object.entries(
+      providerGroup ?? {}
+    )) {
+      if (!enabled) {
+        delete providerGroup![name];
+      } else {
+        sortedProviders.push({
+          type: type as any,
+          name,
+          options: { order, showInSelector, description },
+        });
       }
+    }
+  }
 
-      return {
-        ...config,
-        encryptionKey,
-        secureCookies,
-      };
-    })
+  sortedProviders.sort(({ options: { order: orderA } }, { options: { order: orderB } }) =>
+    orderA < orderB ? -1 : orderA > orderB ? 1 : 0
   );
+
+  // We enable Login Selector by default if a) it's not explicitly disabled, b) new config
+  // format of providers is used and c) we have more than one provider enabled.
+  const isLoginSelectorEnabled =
+    typeof config.authc.selector.enabled === 'boolean'
+      ? config.authc.selector.enabled
+      : !isUsingLegacyProvidersFormat &&
+        sortedProviders.filter(provider => provider.options.showInSelector).length > 1;
+
+  return {
+    ...config,
+    authc: {
+      selector: { ...config.authc.selector, enabled: isLoginSelectorEnabled },
+      providers,
+      sortedProviders: Object.freeze(sortedProviders),
+      http: config.authc.http,
+    },
+    encryptionKey,
+    secureCookies,
+  };
 }
diff --git a/x-pack/plugins/security/server/elasticsearch_client_plugin.ts b/x-pack/plugins/security/server/elasticsearch_client_plugin.ts
index 996dcb685f29b..529e8a8aa6e9c 100644
--- a/x-pack/plugins/security/server/elasticsearch_client_plugin.ts
+++ b/x-pack/plugins/security/server/elasticsearch_client_plugin.ts
@@ -538,6 +538,24 @@ export function elasticsearchClientPlugin(Client: any, config: unknown, componen
     },
   });
 
+  /**
+   * Grants an API key in Elasticsearch for the current user.
+   *
+   * @param {string} type The type of grant, either "password" or "access_token"
+   * @param {string} username Required when using the "password" type
+   * @param {string} password Required when using the "password" type
+   * @param {string} access_token Required when using the "access_token" type
+   *
+   * @returns {{api_key: string}}
+   */
+  shield.grantAPIKey = ca({
+    method: 'POST',
+    needBody: true,
+    url: {
+      fmt: '/_security/api_key/grant',
+    },
+  });
+
   /**
    * Invalidates an API key in Elasticsearch.
    *
diff --git a/x-pack/plugins/security/server/index.ts b/x-pack/plugins/security/server/index.ts
index ca204e454df84..01128d1aa7b0f 100644
--- a/x-pack/plugins/security/server/index.ts
+++ b/x-pack/plugins/security/server/index.ts
@@ -23,6 +23,8 @@ export {
   CreateAPIKeyResult,
   InvalidateAPIKeyParams,
   InvalidateAPIKeyResult,
+  SAMLLogin,
+  OIDCLogin,
 } from './authentication';
 export { SecurityPluginSetup };
 export { AuthenticatedUser } from '../common/model';
@@ -33,27 +35,38 @@ export const config: PluginConfigDescriptor<TypeOf<typeof ConfigSchema>> = {
     rename('sessionTimeout', 'session.idleTimeout'),
     rename('authProviders', 'authc.providers'),
     unused('authorization.legacyFallback.enabled'),
+    // Deprecation warning for the old array-based format of `xpack.security.authc.providers`.
     (settings, fromPath, log) => {
-      const securityConfig = settings?.xpack?.security;
-      const hasProvider = (provider: string) =>
-        securityConfig?.authc?.providers?.includes(provider) ?? false;
-
-      if (hasProvider('basic') && hasProvider('token')) {
+      if (Array.isArray(settings?.xpack?.security?.authc?.providers)) {
         log(
-          'Enabling both `basic` and `token` authentication providers in `xpack.security.authc.providers` is deprecated. Login page will only use `token` provider.'
+          'Defining `xpack.security.authc.providers` as an array of provider types is deprecated. Use extended `object` format instead.'
         );
       }
 
-      if (hasProvider('saml') && !securityConfig?.authc?.saml?.realm) {
+      return settings;
+    },
+    (settings, fromPath, log) => {
+      const hasProviderType = (providerType: string) => {
+        const providers = settings?.xpack?.security?.authc?.providers;
+        if (Array.isArray(providers)) {
+          return providers.includes(providerType);
+        }
+
+        return Object.values(providers?.[providerType] || {}).some(
+          provider => (provider as { enabled: boolean | undefined })?.enabled !== false
+        );
+      };
+
+      if (hasProviderType('basic') && hasProviderType('token')) {
         log(
-          'Config key "xpack.security.authc.saml.realm" will become mandatory when using the SAML authentication provider in the next major version.'
+          'Enabling both `basic` and `token` authentication providers in `xpack.security.authc.providers` is deprecated. Login page will only use `token` provider.'
         );
       }
 
-      if (securityConfig?.public) {
+      if (settings?.xpack?.security?.public) {
         log(
           'Config key "xpack.security.public" is deprecated and will be removed in the next major version. ' +
-            'Specify "xpack.security.authc.saml.realm" instead.'
+            'Specify SAML authentication provider and its realm in "xpack.security.authc.providers.saml.*" instead.'
         );
       }
 
diff --git a/x-pack/plugins/security/server/plugin.test.ts b/x-pack/plugins/security/server/plugin.test.ts
index a1ef352056d6a..4767f57de764c 100644
--- a/x-pack/plugins/security/server/plugin.test.ts
+++ b/x-pack/plugins/security/server/plugin.test.ts
@@ -26,6 +26,7 @@ describe('Security Plugin', () => {
           lifespan: null,
         },
         authc: {
+          selector: { enabled: false },
           providers: ['saml', 'token'],
           saml: { realm: 'saml1', maxRedirectURLSize: new ByteSizeValue(2048) },
           http: { enabled: true, autoSchemesEnabled: true, schemes: ['apikey'] },
@@ -49,9 +50,6 @@ describe('Security Plugin', () => {
       await expect(plugin.setup(mockCoreSetup, mockDependencies)).resolves.toMatchInlineSnapshot(`
               Object {
                 "__legacyCompat": Object {
-                  "config": Object {
-                    "secureCookies": true,
-                  },
                   "license": Object {
                     "features$": Observable {
                       "_isScalar": false,
@@ -74,15 +72,16 @@ describe('Security Plugin', () => {
                   "createAPIKey": [Function],
                   "getCurrentUser": [Function],
                   "getSessionInfo": [Function],
+                  "grantAPIKeyAsInternalUser": [Function],
                   "invalidateAPIKey": [Function],
+                  "invalidateAPIKeyAsInternalUser": [Function],
                   "isAuthenticated": [Function],
-                  "isProviderEnabled": [Function],
+                  "isProviderTypeEnabled": [Function],
                   "login": [Function],
                   "logout": [Function],
                 },
                 "authz": Object {
                   "actions": Actions {
-                    "allHack": "allHack:",
                     "api": ApiActions {
                       "prefix": "api:version:",
                     },
diff --git a/x-pack/plugins/security/server/plugin.ts b/x-pack/plugins/security/server/plugin.ts
index 13300ee55eba0..032d231fe798f 100644
--- a/x-pack/plugins/security/server/plugin.ts
+++ b/x-pack/plugins/security/server/plugin.ts
@@ -5,13 +5,13 @@
  */
 
 import { combineLatest } from 'rxjs';
-import { first } from 'rxjs/operators';
+import { first, map } from 'rxjs/operators';
+import { TypeOf } from '@kbn/config-schema';
 import {
   ICustomClusterClient,
   CoreSetup,
   Logger,
   PluginInitializerContext,
-  RecursiveReadonly,
 } from '../../../../src/core/server';
 import { deepFreeze } from '../../../../src/core/utils';
 import { SpacesPluginSetup } from '../../spaces/server';
@@ -20,7 +20,7 @@ import { LicensingPluginSetup } from '../../licensing/server';
 
 import { Authentication, setupAuthentication } from './authentication';
 import { Authorization, setupAuthorization } from './authorization';
-import { createConfig$ } from './config';
+import { ConfigSchema, createConfig } from './config';
 import { defineRoutes } from './routes';
 import { SecurityLicenseService, SecurityLicense } from '../common/licensing';
 import { setupSavedObjects } from './saved_objects';
@@ -65,7 +65,6 @@ export interface SecurityPluginSetup {
     registerLegacyAPI: (legacyAPI: LegacyAPI) => void;
     registerPrivilegesWithCluster: () => void;
     license: SecurityLicense;
-    config: RecursiveReadonly<{ secureCookies: boolean }>;
   };
 }
 
@@ -106,7 +105,13 @@ export class Plugin {
 
   public async setup(core: CoreSetup, { features, licensing }: PluginSetupDependencies) {
     const [config, legacyConfig] = await combineLatest([
-      createConfig$(this.initializerContext, core.http.isTlsEnabled),
+      this.initializerContext.config.create<TypeOf<typeof ConfigSchema>>().pipe(
+        map(rawConfig =>
+          createConfig(rawConfig, this.initializerContext.logger.get('config'), {
+            isTLSEnabled: core.http.isTlsEnabled,
+          })
+        )
+      ),
       this.initializerContext.config.legacy.globalConfig$,
     ])
       .pipe(first())
@@ -183,11 +188,6 @@ export class Plugin {
         registerPrivilegesWithCluster: async () => await authz.registerPrivilegesWithCluster(),
 
         license,
-
-        // We should stop exposing this config as soon as only new platform plugin consumes it.
-        // This is only currently required because we use legacy code to inject this as metadata
-        // for consumption by public code in the new platform.
-        config: { secureCookies: config.secureCookies },
       },
     });
   }
diff --git a/x-pack/plugins/security/server/routes/authentication/basic.test.ts b/x-pack/plugins/security/server/routes/authentication/basic.test.ts
index cd3b871671551..3c114978f26d2 100644
--- a/x-pack/plugins/security/server/routes/authentication/basic.test.ts
+++ b/x-pack/plugins/security/server/routes/authentication/basic.test.ts
@@ -29,7 +29,7 @@ describe('Basic authentication routes', () => {
     router = routeParamsMock.router;
 
     authc = routeParamsMock.authc;
-    authc.isProviderEnabled.mockImplementation(provider => provider === 'basic');
+    authc.isProviderTypeEnabled.mockImplementation(provider => provider === 'basic');
 
     mockContext = ({
       licensing: {
@@ -108,7 +108,7 @@ describe('Basic authentication routes', () => {
       expect(response.status).toBe(500);
       expect(response.payload).toEqual(unhandledException);
       expect(authc.login).toHaveBeenCalledWith(mockRequest, {
-        provider: 'basic',
+        provider: { type: 'basic' },
         value: { username: 'user', password: 'password' },
       });
     });
@@ -122,7 +122,7 @@ describe('Basic authentication routes', () => {
       expect(response.status).toBe(401);
       expect(response.payload).toEqual(failureReason);
       expect(authc.login).toHaveBeenCalledWith(mockRequest, {
-        provider: 'basic',
+        provider: { type: 'basic' },
         value: { username: 'user', password: 'password' },
       });
     });
@@ -135,7 +135,7 @@ describe('Basic authentication routes', () => {
       expect(response.status).toBe(401);
       expect(response.payload).toEqual('Unauthorized');
       expect(authc.login).toHaveBeenCalledWith(mockRequest, {
-        provider: 'basic',
+        provider: { type: 'basic' },
         value: { username: 'user', password: 'password' },
       });
     });
@@ -149,14 +149,14 @@ describe('Basic authentication routes', () => {
         expect(response.status).toBe(204);
         expect(response.payload).toBeUndefined();
         expect(authc.login).toHaveBeenCalledWith(mockRequest, {
-          provider: 'basic',
+          provider: { type: 'basic' },
           value: { username: 'user', password: 'password' },
         });
       });
 
       it('prefers `token` authentication provider if it is enabled', async () => {
         authc.login.mockResolvedValue(AuthenticationResult.succeeded(mockAuthenticatedUser()));
-        authc.isProviderEnabled.mockImplementation(
+        authc.isProviderTypeEnabled.mockImplementation(
           provider => provider === 'token' || provider === 'basic'
         );
 
@@ -165,7 +165,7 @@ describe('Basic authentication routes', () => {
         expect(response.status).toBe(204);
         expect(response.payload).toBeUndefined();
         expect(authc.login).toHaveBeenCalledWith(mockRequest, {
-          provider: 'token',
+          provider: { type: 'token' },
           value: { username: 'user', password: 'password' },
         });
       });
diff --git a/x-pack/plugins/security/server/routes/authentication/basic.ts b/x-pack/plugins/security/server/routes/authentication/basic.ts
index db36e45fc07e8..ccc6a8df24d6e 100644
--- a/x-pack/plugins/security/server/routes/authentication/basic.ts
+++ b/x-pack/plugins/security/server/routes/authentication/basic.ts
@@ -26,9 +26,10 @@ export function defineBasicRoutes({ router, authc, config }: RouteDefinitionPara
     },
     createLicensedRouteHandler(async (context, request, response) => {
       // We should prefer `token` over `basic` if possible.
-      const loginAttempt = authc.isProviderEnabled('token')
-        ? { provider: 'token', value: request.body }
-        : { provider: 'basic', value: request.body };
+      const loginAttempt = {
+        provider: { type: authc.isProviderTypeEnabled('token') ? 'token' : 'basic' },
+        value: request.body,
+      };
 
       try {
         const authenticationResult = await authc.login(request, loginAttempt);
diff --git a/x-pack/plugins/security/server/routes/authentication/common.test.ts b/x-pack/plugins/security/server/routes/authentication/common.test.ts
index b611ffffee935..e2f9593bc09ee 100644
--- a/x-pack/plugins/security/server/routes/authentication/common.test.ts
+++ b/x-pack/plugins/security/server/routes/authentication/common.test.ts
@@ -13,7 +13,13 @@ import {
   RouteConfig,
 } from '../../../../../../src/core/server';
 import { LICENSE_CHECK_STATE } from '../../../../licensing/server';
-import { Authentication, DeauthenticationResult } from '../../authentication';
+import {
+  Authentication,
+  AuthenticationResult,
+  DeauthenticationResult,
+  OIDCLogin,
+  SAMLLogin,
+} from '../../authentication';
 import { defineCommonRoutes } from './common';
 
 import { httpServerMock } from '../../../../../../src/core/server/mocks';
@@ -172,4 +178,260 @@ describe('Common authentication routes', () => {
       expect(authc.getCurrentUser).toHaveBeenCalledWith(mockRequest);
     });
   });
+
+  describe('login_with', () => {
+    let routeHandler: RequestHandler<any, any, any>;
+    let routeConfig: RouteConfig<any, any, any, any>;
+    beforeEach(() => {
+      const [acsRouteConfig, acsRouteHandler] = router.post.mock.calls.find(
+        ([{ path }]) => path === '/internal/security/login_with'
+      )!;
+
+      routeConfig = acsRouteConfig;
+      routeHandler = acsRouteHandler;
+    });
+
+    it('correctly defines route.', () => {
+      expect(routeConfig.options).toEqual({ authRequired: false });
+      expect(routeConfig.validate).toEqual({
+        body: expect.any(Type),
+        query: undefined,
+        params: undefined,
+      });
+
+      const bodyValidator = (routeConfig.validate as any).body as Type<any>;
+      expect(
+        bodyValidator.validate({
+          providerType: 'saml',
+          providerName: 'saml1',
+          currentURL: '/some-url',
+        })
+      ).toEqual({
+        providerType: 'saml',
+        providerName: 'saml1',
+        currentURL: '/some-url',
+      });
+
+      expect(
+        bodyValidator.validate({
+          providerType: 'saml',
+          providerName: 'saml1',
+          currentURL: '',
+        })
+      ).toEqual({
+        providerType: 'saml',
+        providerName: 'saml1',
+        currentURL: '',
+      });
+
+      expect(() => bodyValidator.validate({})).toThrowErrorMatchingInlineSnapshot(
+        `"[providerType]: expected value of type [string] but got [undefined]"`
+      );
+
+      expect(() =>
+        bodyValidator.validate({ providerType: 'saml' })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"[providerName]: expected value of type [string] but got [undefined]"`
+      );
+
+      expect(() =>
+        bodyValidator.validate({ providerType: 'saml', providerName: 'saml1' })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"[currentURL]: expected value of type [string] but got [undefined]"`
+      );
+
+      expect(() =>
+        bodyValidator.validate({
+          providerType: 'saml',
+          providerName: 'saml1',
+          currentURL: '/some-url',
+          UnknownArg: 'arg',
+        })
+      ).toThrowErrorMatchingInlineSnapshot(`"[UnknownArg]: definition for this key is missing"`);
+    });
+
+    it('returns 500 if login throws unhandled exception.', async () => {
+      const unhandledException = new Error('Something went wrong.');
+      authc.login.mockRejectedValue(unhandledException);
+
+      const request = httpServerMock.createKibanaRequest({
+        body: { providerType: 'saml', providerName: 'saml1', currentURL: '/some-url' },
+      });
+
+      await expect(routeHandler(mockContext, request, kibanaResponseFactory)).resolves.toEqual({
+        status: 500,
+        payload: 'Internal Error',
+        options: {},
+      });
+    });
+
+    it('returns 401 if login fails.', async () => {
+      const failureReason = new Error('Something went wrong.');
+      authc.login.mockResolvedValue(
+        AuthenticationResult.failed(failureReason, {
+          authResponseHeaders: { 'WWW-Something': 'something' },
+        })
+      );
+
+      const request = httpServerMock.createKibanaRequest({
+        body: { providerType: 'saml', providerName: 'saml1', currentURL: '/some-url' },
+      });
+
+      await expect(routeHandler(mockContext, request, kibanaResponseFactory)).resolves.toEqual({
+        status: 401,
+        payload: failureReason,
+        options: { body: failureReason, headers: { 'WWW-Something': 'something' } },
+      });
+    });
+
+    it('returns 401 if login is not handled.', async () => {
+      authc.login.mockResolvedValue(AuthenticationResult.notHandled());
+
+      const request = httpServerMock.createKibanaRequest({
+        body: { providerType: 'saml', providerName: 'saml1', currentURL: '/some-url' },
+      });
+
+      await expect(routeHandler(mockContext, request, kibanaResponseFactory)).resolves.toEqual({
+        status: 401,
+        payload: 'Unauthorized',
+        options: {},
+      });
+    });
+
+    it('returns redirect location from authentication result if any.', async () => {
+      authc.login.mockResolvedValue(AuthenticationResult.redirectTo('http://redirect-to/path'));
+
+      const request = httpServerMock.createKibanaRequest({
+        body: { providerType: 'saml', providerName: 'saml1', currentURL: '/some-url' },
+      });
+
+      await expect(routeHandler(mockContext, request, kibanaResponseFactory)).resolves.toEqual({
+        status: 200,
+        payload: { location: 'http://redirect-to/path' },
+        options: { body: { location: 'http://redirect-to/path' } },
+      });
+    });
+
+    it('returns location extracted from `next` parameter if authentication result does not specify any.', async () => {
+      authc.login.mockResolvedValue(AuthenticationResult.succeeded(mockAuthenticatedUser()));
+
+      const request = httpServerMock.createKibanaRequest({
+        body: {
+          providerType: 'saml',
+          providerName: 'saml1',
+          currentURL: 'https://kibana.com/?next=/mock-server-basepath/some-url#/app/nav',
+        },
+      });
+
+      await expect(routeHandler(mockContext, request, kibanaResponseFactory)).resolves.toEqual({
+        status: 200,
+        payload: { location: '/mock-server-basepath/some-url#/app/nav' },
+        options: { body: { location: '/mock-server-basepath/some-url#/app/nav' } },
+      });
+    });
+
+    it('returns base path if location cannot be extracted from `currentURL` parameter and authentication result does not specify any.', async () => {
+      authc.login.mockResolvedValue(AuthenticationResult.succeeded(mockAuthenticatedUser()));
+
+      const invalidCurrentURLs = [
+        'https://kibana.com/?next=https://evil.com/mock-server-basepath/some-url#/app/nav',
+        'https://kibana.com/?next=https://kibana.com:9000/mock-server-basepath/some-url#/app/nav',
+        'https://kibana.com/?next=kibana.com/mock-server-basepath/some-url#/app/nav',
+        'https://kibana.com/?next=//mock-server-basepath/some-url#/app/nav',
+        'https://kibana.com/?next=../mock-server-basepath/some-url#/app/nav',
+        'https://kibana.com/?next=/some-url#/app/nav',
+        '',
+      ];
+
+      for (const currentURL of invalidCurrentURLs) {
+        const request = httpServerMock.createKibanaRequest({
+          body: { providerType: 'saml', providerName: 'saml1', currentURL },
+        });
+
+        await expect(routeHandler(mockContext, request, kibanaResponseFactory)).resolves.toEqual({
+          status: 200,
+          payload: { location: '/mock-server-basepath/' },
+          options: { body: { location: '/mock-server-basepath/' } },
+        });
+      }
+    });
+
+    it('correctly performs SAML login.', async () => {
+      authc.login.mockResolvedValue(AuthenticationResult.redirectTo('http://redirect-to/path'));
+
+      const request = httpServerMock.createKibanaRequest({
+        body: {
+          providerType: 'saml',
+          providerName: 'saml1',
+          currentURL: 'https://kibana.com/?next=/mock-server-basepath/some-url#/app/nav',
+        },
+      });
+
+      await expect(routeHandler(mockContext, request, kibanaResponseFactory)).resolves.toEqual({
+        status: 200,
+        payload: { location: 'http://redirect-to/path' },
+        options: { body: { location: 'http://redirect-to/path' } },
+      });
+
+      expect(authc.login).toHaveBeenCalledTimes(1);
+      expect(authc.login).toHaveBeenCalledWith(request, {
+        provider: { name: 'saml1' },
+        value: {
+          type: SAMLLogin.LoginInitiatedByUser,
+          redirectURLPath: '/mock-server-basepath/some-url',
+          redirectURLFragment: '#/app/nav',
+        },
+      });
+    });
+
+    it('correctly performs OIDC login.', async () => {
+      authc.login.mockResolvedValue(AuthenticationResult.redirectTo('http://redirect-to/path'));
+
+      const request = httpServerMock.createKibanaRequest({
+        body: {
+          providerType: 'oidc',
+          providerName: 'oidc1',
+          currentURL: 'https://kibana.com/?next=/mock-server-basepath/some-url#/app/nav',
+        },
+      });
+
+      await expect(routeHandler(mockContext, request, kibanaResponseFactory)).resolves.toEqual({
+        status: 200,
+        payload: { location: 'http://redirect-to/path' },
+        options: { body: { location: 'http://redirect-to/path' } },
+      });
+
+      expect(authc.login).toHaveBeenCalledTimes(1);
+      expect(authc.login).toHaveBeenCalledWith(request, {
+        provider: { name: 'oidc1' },
+        value: {
+          type: OIDCLogin.LoginInitiatedByUser,
+          redirectURLPath: '/mock-server-basepath/some-url',
+        },
+      });
+    });
+
+    it('correctly performs generic login.', async () => {
+      authc.login.mockResolvedValue(AuthenticationResult.redirectTo('http://redirect-to/path'));
+
+      const request = httpServerMock.createKibanaRequest({
+        body: {
+          providerType: 'some-type',
+          providerName: 'some-name',
+          currentURL: 'https://kibana.com/?next=/mock-server-basepath/some-url#/app/nav',
+        },
+      });
+
+      await expect(routeHandler(mockContext, request, kibanaResponseFactory)).resolves.toEqual({
+        status: 200,
+        payload: { location: 'http://redirect-to/path' },
+        options: { body: { location: 'http://redirect-to/path' } },
+      });
+
+      expect(authc.login).toHaveBeenCalledTimes(1);
+      expect(authc.login).toHaveBeenCalledWith(request, {
+        provider: { name: 'some-name' },
+      });
+    });
+  });
 });
diff --git a/x-pack/plugins/security/server/routes/authentication/common.ts b/x-pack/plugins/security/server/routes/authentication/common.ts
index 19d197b63f540..abab67c9cd1d2 100644
--- a/x-pack/plugins/security/server/routes/authentication/common.ts
+++ b/x-pack/plugins/security/server/routes/authentication/common.ts
@@ -5,9 +5,14 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { canRedirectRequest } from '../../authentication';
+import { parseNext } from '../../../common/parse_next';
+import { canRedirectRequest, OIDCLogin, SAMLLogin } from '../../authentication';
 import { wrapIntoCustomErrorResponse } from '../../errors';
 import { createLicensedRouteHandler } from '../licensed_route_handler';
+import {
+  OIDCAuthenticationProvider,
+  SAMLAuthenticationProvider,
+} from '../../authentication/providers';
 import { RouteDefinitionParams } from '..';
 
 /**
@@ -71,4 +76,63 @@ export function defineCommonRoutes({ router, authc, basePath, logger }: RouteDef
       })
     );
   }
+
+  function getLoginAttemptForProviderType(providerType: string, redirectURL: string) {
+    const [redirectURLPath] = redirectURL.split('#');
+    const redirectURLFragment =
+      redirectURL.length > redirectURLPath.length
+        ? redirectURL.substring(redirectURLPath.length)
+        : '';
+
+    if (providerType === SAMLAuthenticationProvider.type) {
+      return { type: SAMLLogin.LoginInitiatedByUser, redirectURLPath, redirectURLFragment };
+    }
+
+    if (providerType === OIDCAuthenticationProvider.type) {
+      return { type: OIDCLogin.LoginInitiatedByUser, redirectURLPath };
+    }
+
+    return undefined;
+  }
+
+  router.post(
+    {
+      path: '/internal/security/login_with',
+      validate: {
+        body: schema.object({
+          providerType: schema.string(),
+          providerName: schema.string(),
+          currentURL: schema.string(),
+        }),
+      },
+      options: { authRequired: false },
+    },
+    createLicensedRouteHandler(async (context, request, response) => {
+      const { providerType, providerName, currentURL } = request.body;
+      logger.info(`Logging in with provider "${providerName}" (${providerType})`);
+
+      const redirectURL = parseNext(currentURL, basePath.serverBasePath);
+      try {
+        const authenticationResult = await authc.login(request, {
+          provider: { name: providerName },
+          value: getLoginAttemptForProviderType(providerType, redirectURL),
+        });
+
+        if (authenticationResult.redirected() || authenticationResult.succeeded()) {
+          return response.ok({
+            body: { location: authenticationResult.redirectURL || redirectURL },
+            headers: authenticationResult.authResponseHeaders,
+          });
+        }
+
+        return response.unauthorized({
+          body: authenticationResult.error,
+          headers: authenticationResult.authResponseHeaders,
+        });
+      } catch (err) {
+        logger.error(err);
+        return response.internalError();
+      }
+    })
+  );
 }
diff --git a/x-pack/plugins/security/server/routes/authentication/index.ts b/x-pack/plugins/security/server/routes/authentication/index.ts
index a774edfb4ab2c..f3082b089faf5 100644
--- a/x-pack/plugins/security/server/routes/authentication/index.ts
+++ b/x-pack/plugins/security/server/routes/authentication/index.ts
@@ -27,15 +27,15 @@ export function defineAuthenticationRoutes(params: RouteDefinitionParams) {
   defineSessionRoutes(params);
   defineCommonRoutes(params);
 
-  if (params.authc.isProviderEnabled('basic') || params.authc.isProviderEnabled('token')) {
+  if (params.authc.isProviderTypeEnabled('basic') || params.authc.isProviderTypeEnabled('token')) {
     defineBasicRoutes(params);
   }
 
-  if (params.authc.isProviderEnabled('saml')) {
+  if (params.authc.isProviderTypeEnabled('saml')) {
     defineSAMLRoutes(params);
   }
 
-  if (params.authc.isProviderEnabled('oidc')) {
+  if (params.authc.isProviderTypeEnabled('oidc')) {
     defineOIDCRoutes(params);
   }
 }
diff --git a/x-pack/plugins/security/server/routes/authentication/oidc.ts b/x-pack/plugins/security/server/routes/authentication/oidc.ts
index 96c36af20e982..d325a453af9d1 100644
--- a/x-pack/plugins/security/server/routes/authentication/oidc.ts
+++ b/x-pack/plugins/security/server/routes/authentication/oidc.ts
@@ -7,11 +7,14 @@
 import { schema } from '@kbn/config-schema';
 import { i18n } from '@kbn/i18n';
 import { KibanaRequest, KibanaResponseFactory } from '../../../../../../src/core/server';
-import { OIDCAuthenticationFlow } from '../../authentication';
+import { OIDCLogin } from '../../authentication';
 import { createCustomResourceResponse } from '.';
 import { createLicensedRouteHandler } from '../licensed_route_handler';
 import { wrapIntoCustomErrorResponse } from '../../errors';
-import { ProviderLoginAttempt } from '../../authentication/providers/oidc';
+import {
+  OIDCAuthenticationProvider,
+  ProviderLoginAttempt,
+} from '../../authentication/providers/oidc';
 import { RouteDefinitionParams } from '..';
 
 /**
@@ -118,7 +121,7 @@ export function defineOIDCRoutes({ router, logger, authc, csp, basePath }: Route
         let loginAttempt: ProviderLoginAttempt | undefined;
         if (request.query.authenticationResponseURI) {
           loginAttempt = {
-            flow: OIDCAuthenticationFlow.Implicit,
+            type: OIDCLogin.LoginWithImplicitFlow,
             authenticationResponseURI: request.query.authenticationResponseURI,
           };
         } else if (request.query.code || request.query.error) {
@@ -133,7 +136,7 @@ export function defineOIDCRoutes({ router, logger, authc, csp, basePath }: Route
           // failed) authentication from an OpenID Connect Provider during authorization code authentication flow.
           // See more details at https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth.
           loginAttempt = {
-            flow: OIDCAuthenticationFlow.AuthorizationCode,
+            type: OIDCLogin.LoginWithAuthorizationCodeFlow,
             //  We pass the path only as we can't be sure of the full URL and Elasticsearch doesn't need it anyway.
             authenticationResponseURI: request.url.path!,
           };
@@ -145,7 +148,7 @@ export function defineOIDCRoutes({ router, logger, authc, csp, basePath }: Route
           // An HTTP GET request with a query parameter named `iss` as part of a 3rd party initiated authentication.
           // See more details at https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin
           loginAttempt = {
-            flow: OIDCAuthenticationFlow.InitiatedBy3rdParty,
+            type: OIDCLogin.LoginInitiatedBy3rdParty,
             iss: request.query.iss,
             loginHint: request.query.login_hint,
           };
@@ -181,7 +184,7 @@ export function defineOIDCRoutes({ router, logger, authc, csp, basePath }: Route
             { unknowns: 'allow' }
           ),
         },
-        options: { authRequired: false },
+        options: { authRequired: false, xsrfRequired: false },
       },
       createLicensedRouteHandler(async (context, request, response) => {
         const serverBasePath = basePath.serverBasePath;
@@ -193,7 +196,7 @@ export function defineOIDCRoutes({ router, logger, authc, csp, basePath }: Route
         }
 
         return performOIDCLogin(request, response, {
-          flow: OIDCAuthenticationFlow.InitiatedBy3rdParty,
+          type: OIDCLogin.LoginInitiatedBy3rdParty,
           iss: request.body.iss,
           loginHint: request.body.login_hint,
         });
@@ -224,7 +227,7 @@ export function defineOIDCRoutes({ router, logger, authc, csp, basePath }: Route
     },
     createLicensedRouteHandler(async (context, request, response) => {
       return performOIDCLogin(request, response, {
-        flow: OIDCAuthenticationFlow.InitiatedBy3rdParty,
+        type: OIDCLogin.LoginInitiatedBy3rdParty,
         iss: request.query.iss,
         loginHint: request.query.login_hint,
       });
@@ -240,7 +243,7 @@ export function defineOIDCRoutes({ router, logger, authc, csp, basePath }: Route
       // We handle the fact that the user might get redirected to Kibana while already having a session
       // Return an error notifying the user they are already logged in.
       const authenticationResult = await authc.login(request, {
-        provider: 'oidc',
+        provider: { type: OIDCAuthenticationProvider.type },
         value: loginAttempt,
       });
 
diff --git a/x-pack/plugins/security/server/routes/authentication/saml.test.ts b/x-pack/plugins/security/server/routes/authentication/saml.test.ts
index ce594e20e39cc..64263d351941c 100644
--- a/x-pack/plugins/security/server/routes/authentication/saml.test.ts
+++ b/x-pack/plugins/security/server/routes/authentication/saml.test.ts
@@ -5,7 +5,7 @@
  */
 
 import { Type } from '@kbn/config-schema';
-import { Authentication, AuthenticationResult, SAMLLoginStep } from '../../authentication';
+import { Authentication, AuthenticationResult, SAMLLogin } from '../../authentication';
 import { defineSAMLRoutes } from './saml';
 import { IRouter, RequestHandler, RouteConfig } from '../../../../../../src/core/server';
 
@@ -46,7 +46,7 @@ describe('SAML authentication routes', () => {
     });
 
     it('correctly defines route.', () => {
-      expect(routeConfig.options).toEqual({ authRequired: false });
+      expect(routeConfig.options).toEqual({ authRequired: false, xsrfRequired: false });
       expect(routeConfig.validate).toEqual({
         body: expect.any(Type),
         query: undefined,
@@ -93,9 +93,9 @@ describe('SAML authentication routes', () => {
       );
 
       expect(authc.login).toHaveBeenCalledWith(request, {
-        provider: 'saml',
+        provider: { type: 'saml' },
         value: {
-          step: SAMLLoginStep.SAMLResponseReceived,
+          type: SAMLLogin.LoginWithSAMLResponse,
           samlResponse: 'saml-response',
         },
       });
@@ -172,9 +172,9 @@ describe('SAML authentication routes', () => {
       );
 
       expect(authc.login).toHaveBeenCalledWith(request, {
-        provider: 'saml',
+        provider: { type: 'saml' },
         value: {
-          step: SAMLLoginStep.SAMLResponseReceived,
+          type: SAMLLogin.LoginWithSAMLResponse,
           samlResponse: 'saml-response',
         },
       });
diff --git a/x-pack/plugins/security/server/routes/authentication/saml.ts b/x-pack/plugins/security/server/routes/authentication/saml.ts
index b5b9f27c2713d..3ea92c0d8c4c1 100644
--- a/x-pack/plugins/security/server/routes/authentication/saml.ts
+++ b/x-pack/plugins/security/server/routes/authentication/saml.ts
@@ -5,7 +5,8 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { SAMLLoginStep } from '../../authentication';
+import { SAMLLogin } from '../../authentication';
+import { SAMLAuthenticationProvider } from '../../authentication/providers';
 import { createCustomResourceResponse } from '.';
 import { RouteDefinitionParams } from '..';
 
@@ -15,7 +16,7 @@ import { RouteDefinitionParams } from '..';
 export function defineSAMLRoutes({ router, logger, authc, csp, basePath }: RouteDefinitionParams) {
   router.get(
     {
-      path: '/api/security/saml/capture-url-fragment',
+      path: '/internal/security/saml/capture-url-fragment',
       validate: false,
       options: { authRequired: false },
     },
@@ -27,7 +28,7 @@ export function defineSAMLRoutes({ router, logger, authc, csp, basePath }: Route
           <!DOCTYPE html>
           <title>Kibana SAML Login</title>
           <link rel="icon" href="data:,">
-          <script src="${basePath.serverBasePath}/api/security/saml/capture-url-fragment.js"></script>
+          <script src="${basePath.serverBasePath}/internal/security/saml/capture-url-fragment.js"></script>
         `,
           'text/html',
           csp.header
@@ -38,7 +39,7 @@ export function defineSAMLRoutes({ router, logger, authc, csp, basePath }: Route
 
   router.get(
     {
-      path: '/api/security/saml/capture-url-fragment.js',
+      path: '/internal/security/saml/capture-url-fragment.js',
       validate: false,
       options: { authRequired: false },
     },
@@ -47,7 +48,7 @@ export function defineSAMLRoutes({ router, logger, authc, csp, basePath }: Route
         createCustomResourceResponse(
           `
           window.location.replace(
-            '${basePath.serverBasePath}/api/security/saml/start?redirectURLFragment=' + encodeURIComponent(window.location.hash)
+            '${basePath.serverBasePath}/internal/security/saml/start?redirectURLFragment=' + encodeURIComponent(window.location.hash)
           );
         `,
           'text/javascript',
@@ -59,7 +60,7 @@ export function defineSAMLRoutes({ router, logger, authc, csp, basePath }: Route
 
   router.get(
     {
-      path: '/api/security/saml/start',
+      path: '/internal/security/saml/start',
       validate: {
         query: schema.object({ redirectURLFragment: schema.string() }),
       },
@@ -68,9 +69,9 @@ export function defineSAMLRoutes({ router, logger, authc, csp, basePath }: Route
     async (context, request, response) => {
       try {
         const authenticationResult = await authc.login(request, {
-          provider: 'saml',
+          provider: { type: SAMLAuthenticationProvider.type },
           value: {
-            step: SAMLLoginStep.RedirectURLFragmentCaptured,
+            type: SAMLLogin.LoginInitiatedByUser,
             redirectURLFragment: request.query.redirectURLFragment,
           },
         });
@@ -100,23 +101,23 @@ export function defineSAMLRoutes({ router, logger, authc, csp, basePath }: Route
             RelayState: schema.maybe(schema.string()),
           }),
         },
-        options: { authRequired: false },
+        options: { authRequired: false, xsrfRequired: false },
       },
       async (context, request, response) => {
-        try {
-          if (path === '/api/security/v1/saml') {
-            const serverBasePath = basePath.serverBasePath;
-            logger.warn(
-              `The "${serverBasePath}${path}" URL is deprecated and will stop working in the next major version, please use "${serverBasePath}/api/security/saml/callback" URL instead.`,
-              { tags: ['deprecation'] }
-            );
-          }
+        if (path === '/api/security/v1/saml') {
+          const serverBasePath = basePath.serverBasePath;
+          logger.warn(
+            `The "${serverBasePath}${path}" URL is deprecated and will stop working in the next major version, please use "${serverBasePath}/api/security/saml/callback" URL instead.`,
+            { tags: ['deprecation'] }
+          );
+        }
 
-          // When authenticating using SAML we _expect_ to redirect to the SAML Identity provider.
+        try {
+          // When authenticating using SAML we _expect_ to redirect to the Kibana target location.
           const authenticationResult = await authc.login(request, {
-            provider: 'saml',
+            provider: { type: SAMLAuthenticationProvider.type },
             value: {
-              step: SAMLLoginStep.SAMLResponseReceived,
+              type: SAMLLogin.LoginWithSAMLResponse,
               samlResponse: request.body.SAMLResponse,
             },
           });
diff --git a/x-pack/plugins/security/server/routes/index.mock.ts b/x-pack/plugins/security/server/routes/index.mock.ts
index 0821ed8b96af9..aaefdad6c221a 100644
--- a/x-pack/plugins/security/server/routes/index.mock.ts
+++ b/x-pack/plugins/security/server/routes/index.mock.ts
@@ -11,17 +11,19 @@ import {
 } from '../../../../../src/core/server/mocks';
 import { authenticationMock } from '../authentication/index.mock';
 import { authorizationMock } from '../authorization/index.mock';
-import { ConfigSchema } from '../config';
+import { ConfigSchema, createConfig } from '../config';
 import { licenseMock } from '../../common/licensing/index.mock';
 
 export const routeDefinitionParamsMock = {
-  create: () => ({
+  create: (config: Record<string, unknown> = {}) => ({
     router: httpServiceMock.createRouter(),
     basePath: httpServiceMock.createBasePath(),
     csp: httpServiceMock.createSetupContract().csp,
     logger: loggingServiceMock.create().get(),
     clusterClient: elasticsearchServiceMock.createClusterClient(),
-    config: { ...ConfigSchema.validate({}), encryptionKey: 'some-enc-key' },
+    config: createConfig(ConfigSchema.validate(config), loggingServiceMock.create().get(), {
+      isTLSEnabled: false,
+    }),
     authc: authenticationMock.create(),
     authz: authorizationMock.create(),
     license: licenseMock.create(),
diff --git a/x-pack/plugins/security/server/routes/users/change_password.test.ts b/x-pack/plugins/security/server/routes/users/change_password.test.ts
index c2db34dc3c33c..bac40202ee6ef 100644
--- a/x-pack/plugins/security/server/routes/users/change_password.test.ts
+++ b/x-pack/plugins/security/server/routes/users/change_password.test.ts
@@ -188,7 +188,7 @@ describe('Change password', () => {
 
       expect(authc.login).toHaveBeenCalledTimes(1);
       expect(authc.login).toHaveBeenCalledWith(mockRequest, {
-        provider: 'basic',
+        provider: { name: 'basic1' },
         value: { username, password: 'new-password' },
       });
     });
@@ -196,7 +196,7 @@ describe('Change password', () => {
     it('successfully changes own password if provided old password is correct for non-basic provider.', async () => {
       const mockUser = mockAuthenticatedUser({
         username: 'user',
-        authentication_provider: 'token',
+        authentication_provider: 'token1',
       });
       authc.getCurrentUser.mockReturnValue(mockUser);
       authc.login.mockResolvedValue(AuthenticationResult.succeeded(mockUser));
@@ -215,7 +215,7 @@ describe('Change password', () => {
 
       expect(authc.login).toHaveBeenCalledTimes(1);
       expect(authc.login).toHaveBeenCalledWith(mockRequest, {
-        provider: 'token',
+        provider: { name: 'token1' },
         value: { username, password: 'new-password' },
       });
     });
diff --git a/x-pack/plugins/security/server/routes/users/change_password.ts b/x-pack/plugins/security/server/routes/users/change_password.ts
index fc3ca4573d500..e915cd8759ff1 100644
--- a/x-pack/plugins/security/server/routes/users/change_password.ts
+++ b/x-pack/plugins/security/server/routes/users/change_password.ts
@@ -8,6 +8,10 @@ import { schema } from '@kbn/config-schema';
 import { canUserChangePassword } from '../../../common/model';
 import { getErrorStatusCode, wrapIntoCustomErrorResponse } from '../../errors';
 import { createLicensedRouteHandler } from '../licensed_route_handler';
+import {
+  HTTPAuthorizationHeader,
+  BasicHTTPAuthorizationHeaderCredentials,
+} from '../../authentication';
 import { RouteDefinitionParams } from '..';
 
 export function defineChangeUserPasswordRoutes({
@@ -43,9 +47,13 @@ export function defineChangeUserPasswordRoutes({
           ? {
               headers: {
                 ...request.headers,
-                authorization: `Basic ${Buffer.from(`${username}:${currentPassword}`).toString(
-                  'base64'
-                )}`,
+                authorization: new HTTPAuthorizationHeader(
+                  'Basic',
+                  new BasicHTTPAuthorizationHeaderCredentials(
+                    username,
+                    currentPassword || ''
+                  ).toString()
+                ).toString(),
               },
             }
           : request
@@ -73,7 +81,7 @@ export function defineChangeUserPasswordRoutes({
       if (isUserChangingOwnPassword && currentSession) {
         try {
           const authenticationResult = await authc.login(request, {
-            provider: currentUser!.authentication_provider,
+            provider: { name: currentUser!.authentication_provider },
             value: { username, password: newPassword },
           });
 
diff --git a/x-pack/plugins/security/server/routes/views/index.test.ts b/x-pack/plugins/security/server/routes/views/index.test.ts
index 63e8a518c6198..80f7f62a5ff43 100644
--- a/x-pack/plugins/security/server/routes/views/index.test.ts
+++ b/x-pack/plugins/security/server/routes/views/index.test.ts
@@ -11,7 +11,7 @@ import { routeDefinitionParamsMock } from '../index.mock';
 describe('View routes', () => {
   it('does not register Login routes if both `basic` and `token` providers are disabled', () => {
     const routeParamsMock = routeDefinitionParamsMock.create();
-    routeParamsMock.authc.isProviderEnabled.mockImplementation(
+    routeParamsMock.authc.isProviderTypeEnabled.mockImplementation(
       provider => provider !== 'basic' && provider !== 'token'
     );
 
@@ -29,7 +29,9 @@ describe('View routes', () => {
 
   it('registers Login routes if `basic` provider is enabled', () => {
     const routeParamsMock = routeDefinitionParamsMock.create();
-    routeParamsMock.authc.isProviderEnabled.mockImplementation(provider => provider !== 'token');
+    routeParamsMock.authc.isProviderTypeEnabled.mockImplementation(
+      provider => provider !== 'token'
+    );
 
     defineViewRoutes(routeParamsMock);
 
@@ -47,7 +49,29 @@ describe('View routes', () => {
 
   it('registers Login routes if `token` provider is enabled', () => {
     const routeParamsMock = routeDefinitionParamsMock.create();
-    routeParamsMock.authc.isProviderEnabled.mockImplementation(provider => provider !== 'basic');
+    routeParamsMock.authc.isProviderTypeEnabled.mockImplementation(
+      provider => provider !== 'basic'
+    );
+
+    defineViewRoutes(routeParamsMock);
+
+    expect(routeParamsMock.router.get.mock.calls.map(([{ path }]) => path)).toMatchInlineSnapshot(`
+      Array [
+        "/login",
+        "/internal/security/login_state",
+        "/security/account",
+        "/security/logged_out",
+        "/logout",
+        "/security/overwritten_session",
+      ]
+    `);
+  });
+
+  it('registers Login routes if Login Selector is enabled even if both `token` and `basic` providers are not enabled', () => {
+    const routeParamsMock = routeDefinitionParamsMock.create({
+      authc: { selector: { enabled: true } },
+    });
+    routeParamsMock.authc.isProviderTypeEnabled.mockReturnValue(false);
 
     defineViewRoutes(routeParamsMock);
 
diff --git a/x-pack/plugins/security/server/routes/views/index.ts b/x-pack/plugins/security/server/routes/views/index.ts
index 91e57aed44ab6..255989dfeb90c 100644
--- a/x-pack/plugins/security/server/routes/views/index.ts
+++ b/x-pack/plugins/security/server/routes/views/index.ts
@@ -12,7 +12,11 @@ import { defineOverwrittenSessionRoutes } from './overwritten_session';
 import { RouteDefinitionParams } from '..';
 
 export function defineViewRoutes(params: RouteDefinitionParams) {
-  if (params.authc.isProviderEnabled('basic') || params.authc.isProviderEnabled('token')) {
+  if (
+    params.config.authc.selector.enabled ||
+    params.authc.isProviderTypeEnabled('basic') ||
+    params.authc.isProviderTypeEnabled('token')
+  ) {
     defineLoginRoutes(params);
   }
 
diff --git a/x-pack/plugins/security/server/routes/views/login.test.ts b/x-pack/plugins/security/server/routes/views/login.test.ts
index d14aa226e17ba..7751f9a952c09 100644
--- a/x-pack/plugins/security/server/routes/views/login.test.ts
+++ b/x-pack/plugins/security/server/routes/views/login.test.ts
@@ -13,21 +13,22 @@ import {
   IRouter,
 } from '../../../../../../src/core/server';
 import { SecurityLicense } from '../../../common/licensing';
-import { Authentication } from '../../authentication';
+import { LoginState } from '../../../common/login_state';
+import { ConfigType } from '../../config';
 import { defineLoginRoutes } from './login';
 
 import { coreMock, httpServerMock } from '../../../../../../src/core/server/mocks';
 import { routeDefinitionParamsMock } from '../index.mock';
 
 describe('Login view routes', () => {
-  let authc: jest.Mocked<Authentication>;
   let router: jest.Mocked<IRouter>;
   let license: jest.Mocked<SecurityLicense>;
+  let config: ConfigType;
   beforeEach(() => {
     const routeParamsMock = routeDefinitionParamsMock.create();
-    authc = routeParamsMock.authc;
     router = routeParamsMock.router;
     license = routeParamsMock.license;
+    config = routeParamsMock.config;
 
     defineLoginRoutes(routeParamsMock);
   });
@@ -45,7 +46,7 @@ describe('Login view routes', () => {
     });
 
     it('correctly defines route.', () => {
-      expect(routeConfig.options).toEqual({ authRequired: false });
+      expect(routeConfig.options).toEqual({ authRequired: 'optional' });
 
       expect(routeConfig.validate).toEqual({
         body: undefined,
@@ -73,7 +74,7 @@ describe('Login view routes', () => {
       );
     });
 
-    it('redirects user to the root page if they have a session already or login is disabled.', async () => {
+    it('redirects user to the root page if they are authenticated or login is disabled.', async () => {
       for (const { query, expectedLocation } of [
         { query: {}, expectedLocation: '/mock-server-basepath/' },
         {
@@ -85,27 +86,27 @@ describe('Login view routes', () => {
           expectedLocation: '/mock-server-basepath/',
         },
       ]) {
-        const request = httpServerMock.createKibanaRequest({ query });
+        // Redirect if user is authenticated even if `showLogin` is `true`.
+        let request = httpServerMock.createKibanaRequest({
+          query,
+          auth: { isAuthenticated: true },
+        });
         (request as any).url = new URL(
           `${request.url.path}${request.url.search}`,
           'https://kibana.co'
         );
-
-        // Redirect if user has an active session even if `showLogin` is `true`.
-        authc.getSessionInfo.mockResolvedValue({
-          provider: 'basic',
-          now: 0,
-          idleTimeoutExpiration: null,
-          lifespanExpiration: null,
-        });
         license.getFeatures.mockReturnValue({ showLogin: true } as any);
         await expect(routeHandler({} as any, request, kibanaResponseFactory)).resolves.toEqual({
           options: { headers: { location: `${expectedLocation}` } },
           status: 302,
         });
 
-        // Redirect if `showLogin` is `false` even if user doesn't have an active session even.
-        authc.getSessionInfo.mockResolvedValue(null);
+        // Redirect if `showLogin` is `false` even if user is not authenticated.
+        request = httpServerMock.createKibanaRequest({ query, auth: { isAuthenticated: false } });
+        (request as any).url = new URL(
+          `${request.url.path}${request.url.search}`,
+          'https://kibana.co'
+        );
         license.getFeatures.mockReturnValue({ showLogin: false } as any);
         await expect(routeHandler({} as any, request, kibanaResponseFactory)).resolves.toEqual({
           options: { headers: { location: `${expectedLocation}` } },
@@ -114,11 +115,10 @@ describe('Login view routes', () => {
       }
     });
 
-    it('renders view if user does not have an active session and login page can be shown.', async () => {
-      authc.getSessionInfo.mockResolvedValue(null);
+    it('renders view if user is not authenticated and login page can be shown.', async () => {
       license.getFeatures.mockReturnValue({ showLogin: true } as any);
 
-      const request = httpServerMock.createKibanaRequest();
+      const request = httpServerMock.createKibanaRequest({ auth: { isAuthenticated: false } });
       const contextMock = coreMock.createRequestHandlerContext();
 
       await expect(
@@ -133,7 +133,6 @@ describe('Login view routes', () => {
         status: 200,
       });
 
-      expect(authc.getSessionInfo).toHaveBeenCalledWith(request);
       expect(contextMock.rendering.render).toHaveBeenCalledWith({ includeUserSettings: false });
     });
   });
@@ -164,17 +163,25 @@ describe('Login view routes', () => {
         layout: 'error-es-unavailable',
         showLinks: false,
         showRoleMappingsManagement: true,
+        allowSubFeaturePrivileges: true,
         showLogin: true,
       });
 
       const request = httpServerMock.createKibanaRequest();
       const contextMock = coreMock.createRequestHandlerContext();
 
+      const expectedPayload = {
+        allowLogin: true,
+        layout: 'error-es-unavailable',
+        showLoginForm: true,
+        requiresSecureConnection: false,
+        selector: { enabled: false, providers: [] },
+      };
       await expect(
         routeHandler({ core: contextMock } as any, request, kibanaResponseFactory)
       ).resolves.toEqual({
-        options: { body: { allowLogin: true, layout: 'error-es-unavailable', showLogin: true } },
-        payload: { allowLogin: true, layout: 'error-es-unavailable', showLogin: true },
+        options: { body: expectedPayload },
+        payload: expectedPayload,
         status: 200,
       });
     });
@@ -185,13 +192,156 @@ describe('Login view routes', () => {
       const request = httpServerMock.createKibanaRequest();
       const contextMock = coreMock.createRequestHandlerContext();
 
+      const expectedPayload = {
+        allowLogin: true,
+        layout: 'form',
+        showLoginForm: true,
+        requiresSecureConnection: false,
+        selector: { enabled: false, providers: [] },
+      };
+      await expect(
+        routeHandler({ core: contextMock } as any, request, kibanaResponseFactory)
+      ).resolves.toEqual({
+        options: { body: expectedPayload },
+        payload: expectedPayload,
+        status: 200,
+      });
+    });
+
+    it('returns `requiresSecureConnection: true` if `secureCookies` is enabled in config.', async () => {
+      license.getFeatures.mockReturnValue({ allowLogin: true, showLogin: true } as any);
+
+      const request = httpServerMock.createKibanaRequest();
+      const contextMock = coreMock.createRequestHandlerContext();
+
+      config.secureCookies = true;
+
+      const expectedPayload = expect.objectContaining({ requiresSecureConnection: true });
       await expect(
         routeHandler({ core: contextMock } as any, request, kibanaResponseFactory)
       ).resolves.toEqual({
-        options: { body: { allowLogin: true, layout: 'form', showLogin: true } },
-        payload: { allowLogin: true, layout: 'form', showLogin: true },
+        options: { body: expectedPayload },
+        payload: expectedPayload,
         status: 200,
       });
     });
+
+    it('returns `showLoginForm: true` only if either `basic` or `token` provider is enabled.', async () => {
+      license.getFeatures.mockReturnValue({ allowLogin: true, showLogin: true } as any);
+
+      const request = httpServerMock.createKibanaRequest();
+      const contextMock = coreMock.createRequestHandlerContext();
+
+      const cases: Array<[boolean, ConfigType['authc']['sortedProviders']]> = [
+        [false, []],
+        [true, [{ type: 'basic', name: 'basic1', options: { order: 0, showInSelector: true } }]],
+        [true, [{ type: 'token', name: 'token1', options: { order: 0, showInSelector: true } }]],
+      ];
+
+      for (const [showLoginForm, sortedProviders] of cases) {
+        config.authc.sortedProviders = sortedProviders;
+
+        const expectedPayload = expect.objectContaining({ showLoginForm });
+        await expect(
+          routeHandler({ core: contextMock } as any, request, kibanaResponseFactory)
+        ).resolves.toEqual({
+          options: { body: expectedPayload },
+          payload: expectedPayload,
+          status: 200,
+        });
+      }
+    });
+
+    it('correctly returns `selector` information.', async () => {
+      license.getFeatures.mockReturnValue({ allowLogin: true, showLogin: true } as any);
+
+      const request = httpServerMock.createKibanaRequest();
+      const contextMock = coreMock.createRequestHandlerContext();
+
+      const cases: Array<[
+        boolean,
+        ConfigType['authc']['sortedProviders'],
+        LoginState['selector']['providers']
+      ]> = [
+        // selector is disabled, providers shouldn't be returned.
+        [
+          false,
+          [
+            { type: 'basic', name: 'basic1', options: { order: 0, showInSelector: true } },
+            { type: 'saml', name: 'saml1', options: { order: 1, showInSelector: true } },
+          ],
+          [],
+        ],
+        // selector is enabled, but only basic/token is available, providers shouldn't be returned.
+        [
+          true,
+          [{ type: 'basic', name: 'basic1', options: { order: 0, showInSelector: true } }],
+          [],
+        ],
+        // selector is enabled, non-basic/token providers should be returned
+        [
+          true,
+          [
+            {
+              type: 'basic',
+              name: 'basic1',
+              options: { order: 0, showInSelector: true, description: 'some-desc1' },
+            },
+            {
+              type: 'saml',
+              name: 'saml1',
+              options: { order: 1, showInSelector: true, description: 'some-desc2' },
+            },
+            {
+              type: 'saml',
+              name: 'saml2',
+              options: { order: 2, showInSelector: true, description: 'some-desc3' },
+            },
+          ],
+          [
+            { type: 'saml', name: 'saml1', description: 'some-desc2' },
+            { type: 'saml', name: 'saml2', description: 'some-desc3' },
+          ],
+        ],
+        // selector is enabled, only non-basic/token providers that are enabled in selector should be returned.
+        [
+          true,
+          [
+            {
+              type: 'basic',
+              name: 'basic1',
+              options: { order: 0, showInSelector: true, description: 'some-desc1' },
+            },
+            {
+              type: 'saml',
+              name: 'saml1',
+              options: { order: 1, showInSelector: false, description: 'some-desc2' },
+            },
+            {
+              type: 'saml',
+              name: 'saml2',
+              options: { order: 2, showInSelector: true, description: 'some-desc3' },
+            },
+          ],
+          [{ type: 'saml', name: 'saml2', description: 'some-desc3' }],
+        ],
+      ];
+
+      for (const [selectorEnabled, sortedProviders, expectedProviders] of cases) {
+        config.authc.selector.enabled = selectorEnabled;
+        config.authc.sortedProviders = sortedProviders;
+
+        const expectedPayload = expect.objectContaining({
+          selector: { enabled: selectorEnabled, providers: expectedProviders },
+        });
+        await expect(
+          routeHandler({ core: contextMock } as any, request, kibanaResponseFactory)
+        ).resolves.toEqual({
+          options: { body: expectedPayload },
+          payload: expectedPayload,
+          status: 200,
+        });
+      }
+    });
   });
 });
diff --git a/x-pack/plugins/security/server/routes/views/login.ts b/x-pack/plugins/security/server/routes/views/login.ts
index ee1fe01ab1b22..4cabd4337971c 100644
--- a/x-pack/plugins/security/server/routes/views/login.ts
+++ b/x-pack/plugins/security/server/routes/views/login.ts
@@ -6,15 +6,16 @@
 
 import { schema } from '@kbn/config-schema';
 import { parseNext } from '../../../common/parse_next';
+import { LoginState } from '../../../common/login_state';
 import { RouteDefinitionParams } from '..';
 
 /**
  * Defines routes required for the Login view.
  */
 export function defineLoginRoutes({
+  config,
   router,
   logger,
-  authc,
   csp,
   basePath,
   license,
@@ -31,15 +32,12 @@ export function defineLoginRoutes({
           { unknowns: 'allow' }
         ),
       },
-      options: { authRequired: false },
+      options: { authRequired: 'optional' },
     },
     async (context, request, response) => {
       // Default to true if license isn't available or it can't be resolved for some reason.
       const shouldShowLogin = license.isEnabled() ? license.getFeatures().showLogin : true;
-
-      // Authentication flow isn't triggered automatically for this route, so we should explicitly
-      // check whether user has an active session already.
-      const isUserAlreadyLoggedIn = (await authc.getSessionInfo(request)) !== null;
+      const isUserAlreadyLoggedIn = request.auth.isAuthenticated;
       if (isUserAlreadyLoggedIn || !shouldShowLogin) {
         logger.debug('User is already authenticated, redirecting...');
         return response.redirected({
@@ -57,8 +55,30 @@ export function defineLoginRoutes({
   router.get(
     { path: '/internal/security/login_state', validate: false, options: { authRequired: false } },
     async (context, request, response) => {
-      const { showLogin, allowLogin, layout = 'form' } = license.getFeatures();
-      return response.ok({ body: { showLogin, allowLogin, layout } });
+      const { allowLogin, layout = 'form' } = license.getFeatures();
+      const { sortedProviders, selector } = config.authc;
+
+      let showLoginForm = false;
+      const providers = [];
+      for (const { type, name, options } of sortedProviders) {
+        if (options.showInSelector) {
+          if (type === 'basic' || type === 'token') {
+            showLoginForm = true;
+          } else if (selector.enabled) {
+            providers.push({ type, name, description: options.description });
+          }
+        }
+      }
+
+      const loginState: LoginState = {
+        allowLogin,
+        layout,
+        requiresSecureConnection: config.secureCookies,
+        showLoginForm,
+        selector: { enabled: selector.enabled, providers },
+      };
+
+      return response.ok({ body: loginState });
     }
   );
 }
diff --git a/x-pack/plugins/spaces/public/management/edit_space/enabled_features/__snapshots__/enabled_features.test.tsx.snap b/x-pack/plugins/spaces/public/management/edit_space/enabled_features/__snapshots__/enabled_features.test.tsx.snap
index 7db3d5456fbd3..6d40ce15fc57f 100644
--- a/x-pack/plugins/spaces/public/management/edit_space/enabled_features/__snapshots__/enabled_features.test.tsx.snap
+++ b/x-pack/plugins/spaces/public/management/edit_space/enabled_features/__snapshots__/enabled_features.test.tsx.snap
@@ -91,14 +91,14 @@ exports[`EnabledFeatures renders as expected 1`] = `
               "icon": "spacesApp",
               "id": "feature-1",
               "name": "Feature 1",
-              "privileges": Object {},
+              "privileges": null,
             },
             Object {
               "app": Array [],
               "icon": "spacesApp",
               "id": "feature-2",
               "name": "Feature 2",
-              "privileges": Object {},
+              "privileges": null,
             },
           ]
         }
diff --git a/x-pack/plugins/spaces/public/management/edit_space/enabled_features/enabled_features.test.tsx b/x-pack/plugins/spaces/public/management/edit_space/enabled_features/enabled_features.test.tsx
index d9282ad0457dd..ca53a9eb17253 100644
--- a/x-pack/plugins/spaces/public/management/edit_space/enabled_features/enabled_features.test.tsx
+++ b/x-pack/plugins/spaces/public/management/edit_space/enabled_features/enabled_features.test.tsx
@@ -10,22 +10,22 @@ import { mountWithIntl, shallowWithIntl } from 'test_utils/enzyme_helpers';
 import { Space } from '../../../../common/model/space';
 import { SectionPanel } from '../section_panel';
 import { EnabledFeatures } from './enabled_features';
-import { Feature } from '../../../../../features/public';
+import { FeatureConfig } from '../../../../../features/public';
 
-const features: Feature[] = [
+const features: FeatureConfig[] = [
   {
     id: 'feature-1',
     name: 'Feature 1',
     icon: 'spacesApp',
     app: [],
-    privileges: {},
+    privileges: null,
   },
   {
     id: 'feature-2',
     name: 'Feature 2',
     icon: 'spacesApp',
     app: [],
-    privileges: {},
+    privileges: null,
   },
 ];
 
diff --git a/x-pack/plugins/spaces/public/management/edit_space/enabled_features/enabled_features.tsx b/x-pack/plugins/spaces/public/management/edit_space/enabled_features/enabled_features.tsx
index 52a0fe8d4d26c..6f0462a6ddcc2 100644
--- a/x-pack/plugins/spaces/public/management/edit_space/enabled_features/enabled_features.tsx
+++ b/x-pack/plugins/spaces/public/management/edit_space/enabled_features/enabled_features.tsx
@@ -8,7 +8,7 @@ import { EuiFlexGroup, EuiFlexItem, EuiLink, EuiSpacer, EuiText, EuiTitle } from
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import React, { Component, Fragment, ReactNode } from 'react';
-import { Feature } from '../../../../../../plugins/features/public';
+import { FeatureConfig } from '../../../../../../plugins/features/public';
 import { Space } from '../../../../common/model/space';
 import { getEnabledFeatures } from '../../lib/feature_utils';
 import { SectionPanel } from '../section_panel';
@@ -16,7 +16,7 @@ import { FeatureTable } from './feature_table';
 
 interface Props {
   space: Partial<Space>;
-  features: Feature[];
+  features: FeatureConfig[];
   securityEnabled: boolean;
   onChange: (space: Partial<Space>) => void;
 }
diff --git a/x-pack/plugins/spaces/public/management/edit_space/enabled_features/feature_table.tsx b/x-pack/plugins/spaces/public/management/edit_space/enabled_features/feature_table.tsx
index 380f151b54a18..880842ed0ae30 100644
--- a/x-pack/plugins/spaces/public/management/edit_space/enabled_features/feature_table.tsx
+++ b/x-pack/plugins/spaces/public/management/edit_space/enabled_features/feature_table.tsx
@@ -9,13 +9,13 @@ import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import _ from 'lodash';
 import React, { ChangeEvent, Component } from 'react';
-import { Feature } from '../../../../../../plugins/features/public';
+import { FeatureConfig } from '../../../../../../plugins/features/public';
 import { Space } from '../../../../common/model/space';
 import { ToggleAllFeatures } from './toggle_all_features';
 
 interface Props {
   space: Partial<Space>;
-  features: Feature[];
+  features: FeatureConfig[];
   onChange: (space: Partial<Space>) => void;
 }
 
@@ -69,7 +69,10 @@ export class FeatureTable extends Component<Props, {}> {
       name: i18n.translate('xpack.spaces.management.enabledSpaceFeaturesFeatureColumnTitle', {
         defaultMessage: 'Feature',
       }),
-      render: (feature: Feature, _item: { feature: Feature; space: Props['space'] }) => {
+      render: (
+        feature: FeatureConfig,
+        _item: { feature: FeatureConfig; space: Props['space'] }
+      ) => {
         return (
           <EuiText>
             <EuiIcon size="m" type={feature.icon as IconType} />
diff --git a/x-pack/plugins/spaces/public/management/edit_space/manage_space_page.test.tsx b/x-pack/plugins/spaces/public/management/edit_space/manage_space_page.test.tsx
index 2aba1522a7e3f..b79bbd0d6ab3f 100644
--- a/x-pack/plugins/spaces/public/management/edit_space/manage_space_page.test.tsx
+++ b/x-pack/plugins/spaces/public/management/edit_space/manage_space_page.test.tsx
@@ -13,7 +13,9 @@ import { ManageSpacePage } from './manage_space_page';
 import { SectionPanel } from './section_panel';
 import { spacesManagerMock } from '../../spaces_manager/mocks';
 import { SpacesManager } from '../../spaces_manager';
-import { httpServiceMock, notificationServiceMock } from 'src/core/public/mocks';
+import { notificationServiceMock } from 'src/core/public/mocks';
+import { featuresPluginMock } from '../../../../features/public/mocks';
+import { Feature } from '../../../../features/public';
 
 const space = {
   id: 'my-space',
@@ -21,19 +23,27 @@ const space = {
   disabledFeatures: [],
 };
 
+const featuresStart = featuresPluginMock.createStart();
+featuresStart.getFeatures.mockResolvedValue([
+  new Feature({
+    id: 'feature-1',
+    name: 'feature 1',
+    icon: 'spacesApp',
+    app: [],
+    privileges: null,
+  }),
+]);
+
 describe('ManageSpacePage', () => {
   it('allows a space to be created', async () => {
     const spacesManager = spacesManagerMock.create();
     spacesManager.createSpace = jest.fn(spacesManager.createSpace);
     spacesManager.getActiveSpace = jest.fn().mockResolvedValue(space);
 
-    const httpStart = httpServiceMock.createStartContract();
-    httpStart.get.mockResolvedValue([{ id: 'feature-1', name: 'feature 1', icon: 'spacesApp' }]);
-
     const wrapper = mountWithIntl(
       <ManageSpacePage
         spacesManager={(spacesManager as unknown) as SpacesManager}
-        http={httpStart}
+        getFeatures={featuresStart.getFeatures}
         notifications={notificationServiceMock.createStartContract()}
         securityEnabled={true}
         capabilities={{
@@ -83,9 +93,6 @@ describe('ManageSpacePage', () => {
     });
     spacesManager.getActiveSpace = jest.fn().mockResolvedValue(space);
 
-    const httpStart = httpServiceMock.createStartContract();
-    httpStart.get.mockResolvedValue([{ id: 'feature-1', name: 'feature 1', icon: 'spacesApp' }]);
-
     const onLoadSpace = jest.fn();
 
     const wrapper = mountWithIntl(
@@ -93,7 +100,7 @@ describe('ManageSpacePage', () => {
         spaceId={'existing-space'}
         spacesManager={(spacesManager as unknown) as SpacesManager}
         onLoadSpace={onLoadSpace}
-        http={httpStart}
+        getFeatures={featuresStart.getFeatures}
         notifications={notificationServiceMock.createStartContract()}
         securityEnabled={true}
         capabilities={{
@@ -130,6 +137,37 @@ describe('ManageSpacePage', () => {
     });
   });
 
+  it('notifies when there is an error retrieving features', async () => {
+    const spacesManager = spacesManagerMock.create();
+    spacesManager.createSpace = jest.fn(spacesManager.createSpace);
+    spacesManager.getActiveSpace = jest.fn().mockResolvedValue(space);
+
+    const error = new Error('something awful happened');
+
+    const notifications = notificationServiceMock.createStartContract();
+
+    const wrapper = mountWithIntl(
+      <ManageSpacePage
+        spacesManager={(spacesManager as unknown) as SpacesManager}
+        getFeatures={() => Promise.reject(error)}
+        notifications={notifications}
+        securityEnabled={true}
+        capabilities={{
+          navLinks: {},
+          management: {},
+          catalogue: {},
+          spaces: { manage: true },
+        }}
+      />
+    );
+
+    await waitForDataLoad(wrapper);
+
+    expect(notifications.toasts.addError).toHaveBeenCalledWith(error, {
+      title: 'Error loading available features',
+    });
+  });
+
   it('warns when updating features in the active space', async () => {
     const spacesManager = spacesManagerMock.create();
     spacesManager.getSpace = jest.fn().mockResolvedValue({
@@ -142,14 +180,11 @@ describe('ManageSpacePage', () => {
     });
     spacesManager.getActiveSpace = jest.fn().mockResolvedValue(space);
 
-    const httpStart = httpServiceMock.createStartContract();
-    httpStart.get.mockResolvedValue([{ id: 'feature-1', name: 'feature 1', icon: 'spacesApp' }]);
-
     const wrapper = mountWithIntl(
       <ManageSpacePage
         spaceId={'my-space'}
         spacesManager={(spacesManager as unknown) as SpacesManager}
-        http={httpStart}
+        getFeatures={featuresStart.getFeatures}
         notifications={notificationServiceMock.createStartContract()}
         securityEnabled={true}
         capabilities={{
@@ -204,14 +239,11 @@ describe('ManageSpacePage', () => {
     });
     spacesManager.getActiveSpace = jest.fn().mockResolvedValue(space);
 
-    const httpStart = httpServiceMock.createStartContract();
-    httpStart.get.mockResolvedValue([{ id: 'feature-1', name: 'feature 1', icon: 'spacesApp' }]);
-
     const wrapper = mountWithIntl(
       <ManageSpacePage
         spaceId={'my-space'}
         spacesManager={(spacesManager as unknown) as SpacesManager}
-        http={httpStart}
+        getFeatures={featuresStart.getFeatures}
         notifications={notificationServiceMock.createStartContract()}
         securityEnabled={true}
         capabilities={{
diff --git a/x-pack/plugins/spaces/public/management/edit_space/manage_space_page.tsx b/x-pack/plugins/spaces/public/management/edit_space/manage_space_page.tsx
index 6be3bfcebffe4..0cb471854f815 100644
--- a/x-pack/plugins/spaces/public/management/edit_space/manage_space_page.tsx
+++ b/x-pack/plugins/spaces/public/management/edit_space/manage_space_page.tsx
@@ -18,8 +18,8 @@ import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import _ from 'lodash';
 import React, { Component, Fragment } from 'react';
-import { Capabilities, HttpStart, NotificationsStart } from 'src/core/public';
-import { Feature } from '../../../../features/public';
+import { Capabilities, NotificationsStart } from 'src/core/public';
+import { Feature, FeaturesPluginStart } from '../../../../features/public';
 import { isReservedSpace } from '../../../common';
 import { Space } from '../../../common/model/space';
 import { SpacesManager } from '../../spaces_manager';
@@ -33,7 +33,7 @@ import { EnabledFeatures } from './enabled_features';
 import { ReservedSpaceBadge } from './reserved_space_badge';
 
 interface Props {
-  http: HttpStart;
+  getFeatures: FeaturesPluginStart['getFeatures'];
   notifications: NotificationsStart;
   spacesManager: SpacesManager;
   spaceId?: string;
@@ -75,15 +75,21 @@ export class ManageSpacePage extends Component<Props, State> {
       return;
     }
 
-    const { spaceId, http } = this.props;
+    const { spaceId, getFeatures, notifications } = this.props;
 
-    const getFeatures = http.get('/api/features');
-
-    if (spaceId) {
-      await this.loadSpace(spaceId, getFeatures);
-    } else {
-      const features = await getFeatures;
-      this.setState({ isLoading: false, features });
+    try {
+      if (spaceId) {
+        await this.loadSpace(spaceId, getFeatures());
+      } else {
+        const features = await getFeatures();
+        this.setState({ isLoading: false, features });
+      }
+    } catch (e) {
+      notifications.toasts.addError(e, {
+        title: i18n.translate('xpack.spaces.management.manageSpacePage.loadErrorTitle', {
+          defaultMessage: 'Error loading available features',
+        }),
+      });
     }
   }
 
@@ -318,7 +324,7 @@ export class ManageSpacePage extends Component<Props, State> {
 
         this.setState({
           space,
-          features: await features,
+          features,
           originalSpace: space,
           isLoading: false,
         });
diff --git a/x-pack/plugins/spaces/public/management/lib/feature_utils.ts b/x-pack/plugins/spaces/public/management/lib/feature_utils.ts
index a1b64eb954403..09dbe886ab191 100644
--- a/x-pack/plugins/spaces/public/management/lib/feature_utils.ts
+++ b/x-pack/plugins/spaces/public/management/lib/feature_utils.ts
@@ -4,10 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { Feature } from '../../../../features/common';
+import { FeatureConfig } from '../../../../features/common';
 
 import { Space } from '../..';
 
-export function getEnabledFeatures(features: Feature[], space: Partial<Space>) {
+export function getEnabledFeatures(features: FeatureConfig[], space: Partial<Space>) {
   return features.filter(feature => !(space.disabledFeatures || []).includes(feature.id));
 }
diff --git a/x-pack/plugins/spaces/public/management/management_service.test.ts b/x-pack/plugins/spaces/public/management/management_service.test.ts
index d4c6bdaea2776..782c261be9664 100644
--- a/x-pack/plugins/spaces/public/management/management_service.test.ts
+++ b/x-pack/plugins/spaces/public/management/management_service.test.ts
@@ -10,6 +10,8 @@ import { spacesManagerMock } from '../spaces_manager/mocks';
 import { managementPluginMock } from '../../../../../src/plugins/management/public/mocks';
 import { ManagementSection } from 'src/plugins/management/public';
 import { Capabilities } from 'kibana/public';
+import { PluginsStart } from '../plugin';
+import { CoreSetup } from 'src/core/public';
 
 describe('ManagementService', () => {
   describe('#setup', () => {
@@ -19,7 +21,9 @@ describe('ManagementService', () => {
       } as unknown) as ManagementSection;
       const deps = {
         management: managementPluginMock.createSetupContract(),
-        getStartServices: coreMock.createSetup().getStartServices,
+        getStartServices: coreMock.createSetup().getStartServices as CoreSetup<
+          PluginsStart
+        >['getStartServices'],
         spacesManager: spacesManagerMock.create(),
       };
 
@@ -43,7 +47,9 @@ describe('ManagementService', () => {
     it('will not crash if the kibana section is missing', () => {
       const deps = {
         management: managementPluginMock.createSetupContract(),
-        getStartServices: coreMock.createSetup().getStartServices,
+        getStartServices: coreMock.createSetup().getStartServices as CoreSetup<
+          PluginsStart
+        >['getStartServices'],
         spacesManager: spacesManagerMock.create(),
       };
 
@@ -61,7 +67,9 @@ describe('ManagementService', () => {
 
       const deps = {
         management: managementPluginMock.createSetupContract(),
-        getStartServices: coreMock.createSetup().getStartServices,
+        getStartServices: coreMock.createSetup().getStartServices as CoreSetup<
+          PluginsStart
+        >['getStartServices'],
         spacesManager: spacesManagerMock.create(),
       };
 
@@ -88,7 +96,9 @@ describe('ManagementService', () => {
 
       const deps = {
         management: managementPluginMock.createSetupContract(),
-        getStartServices: coreMock.createSetup().getStartServices,
+        getStartServices: coreMock.createSetup().getStartServices as CoreSetup<
+          PluginsStart
+        >['getStartServices'],
         spacesManager: spacesManagerMock.create(),
       };
 
@@ -117,7 +127,9 @@ describe('ManagementService', () => {
 
       const deps = {
         management: managementPluginMock.createSetupContract(),
-        getStartServices: coreMock.createSetup().getStartServices,
+        getStartServices: coreMock.createSetup().getStartServices as CoreSetup<
+          PluginsStart
+        >['getStartServices'],
         spacesManager: spacesManagerMock.create(),
       };
 
diff --git a/x-pack/plugins/spaces/public/management/management_service.tsx b/x-pack/plugins/spaces/public/management/management_service.tsx
index c81a3497762a5..cec4bee1373ca 100644
--- a/x-pack/plugins/spaces/public/management/management_service.tsx
+++ b/x-pack/plugins/spaces/public/management/management_service.tsx
@@ -5,7 +5,7 @@
  */
 
 import { ManagementSetup, ManagementApp } from 'src/plugins/management/public';
-import { CoreSetup, Capabilities } from 'src/core/public';
+import { StartServicesAccessor, Capabilities } from 'src/core/public';
 import { SecurityLicense } from '../../../security/public';
 import { SpacesManager } from '../spaces_manager';
 import { PluginsStart } from '../plugin';
@@ -13,7 +13,7 @@ import { spacesManagementApp } from './spaces_management_app';
 
 interface SetupDeps {
   management: ManagementSetup;
-  getStartServices: CoreSetup<PluginsStart>['getStartServices'];
+  getStartServices: StartServicesAccessor<PluginsStart>;
   spacesManager: SpacesManager;
   securityLicense?: SecurityLicense;
 }
diff --git a/x-pack/plugins/spaces/public/management/spaces_grid/spaces_grid_page.tsx b/x-pack/plugins/spaces/public/management/spaces_grid/spaces_grid_page.tsx
index 4cc4190e9591b..ff4be84207832 100644
--- a/x-pack/plugins/spaces/public/management/spaces_grid/spaces_grid_page.tsx
+++ b/x-pack/plugins/spaces/public/management/spaces_grid/spaces_grid_page.tsx
@@ -20,8 +20,8 @@ import {
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
-import { Capabilities, HttpStart, NotificationsStart } from 'src/core/public';
-import { Feature } from '../../../../features/public';
+import { Capabilities, NotificationsStart } from 'src/core/public';
+import { Feature, FeaturesPluginStart } from '../../../../features/public';
 import { isReservedSpace } from '../../../common';
 import { DEFAULT_SPACE_ID } from '../../../common/constants';
 import { Space } from '../../../common/model/space';
@@ -36,7 +36,7 @@ import { getEnabledFeatures } from '../lib/feature_utils';
 interface Props {
   spacesManager: SpacesManager;
   notifications: NotificationsStart;
-  http: HttpStart;
+  getFeatures: FeaturesPluginStart['getFeatures'];
   capabilities: Capabilities;
   securityEnabled: boolean;
 }
@@ -47,7 +47,6 @@ interface State {
   loading: boolean;
   showConfirmDeleteModal: boolean;
   selectedSpace: Space | null;
-  error: Error | null;
 }
 
 export class SpacesGridPage extends Component<Props, State> {
@@ -59,7 +58,6 @@ export class SpacesGridPage extends Component<Props, State> {
       loading: true,
       showConfirmDeleteModal: false,
       selectedSpace: null,
-      error: null,
     };
   }
 
@@ -211,7 +209,7 @@ export class SpacesGridPage extends Component<Props, State> {
   };
 
   public loadGrid = async () => {
-    const { spacesManager, http } = this.props;
+    const { spacesManager, getFeatures, notifications } = this.props;
 
     this.setState({
       loading: true,
@@ -220,10 +218,9 @@ export class SpacesGridPage extends Component<Props, State> {
     });
 
     const getSpaces = spacesManager.getSpaces();
-    const getFeatures = http.get('/api/features');
 
     try {
-      const [spaces, features] = await Promise.all([getSpaces, getFeatures]);
+      const [spaces, features] = await Promise.all([getSpaces, getFeatures()]);
       this.setState({
         loading: false,
         spaces,
@@ -232,7 +229,11 @@ export class SpacesGridPage extends Component<Props, State> {
     } catch (error) {
       this.setState({
         loading: false,
-        error,
+      });
+      notifications.toasts.addError(error, {
+        title: i18n.translate('xpack.spaces.management.spacesGridPage.errorTitle', {
+          defaultMessage: 'Error loading spaces',
+        }),
       });
     }
   };
diff --git a/x-pack/plugins/spaces/public/management/spaces_grid/spaces_grid_pages.test.tsx b/x-pack/plugins/spaces/public/management/spaces_grid/spaces_grid_pages.test.tsx
index 90c7aba65e3d6..9b7dc921b9a25 100644
--- a/x-pack/plugins/spaces/public/management/spaces_grid/spaces_grid_pages.test.tsx
+++ b/x-pack/plugins/spaces/public/management/spaces_grid/spaces_grid_pages.test.tsx
@@ -12,6 +12,8 @@ import { SpacesManager } from '../../spaces_manager';
 import { SpacesGridPage } from './spaces_grid_page';
 import { httpServiceMock } from 'src/core/public/mocks';
 import { notificationServiceMock } from 'src/core/public/mocks';
+import { featuresPluginMock } from '../../../../features/public/mocks';
+import { Feature } from '../../../../features/public';
 
 const spaces = [
   {
@@ -38,6 +40,17 @@ const spaces = [
 const spacesManager = spacesManagerMock.create();
 spacesManager.getSpaces = jest.fn().mockResolvedValue(spaces);
 
+const featuresStart = featuresPluginMock.createStart();
+featuresStart.getFeatures.mockResolvedValue([
+  new Feature({
+    id: 'feature-1',
+    name: 'feature 1',
+    icon: 'spacesApp',
+    app: [],
+    privileges: null,
+  }),
+]);
+
 describe('SpacesGridPage', () => {
   it('renders as expected', () => {
     const httpStart = httpServiceMock.createStartContract();
@@ -47,7 +60,7 @@ describe('SpacesGridPage', () => {
       shallowWithIntl(
         <SpacesGridPage
           spacesManager={(spacesManager as unknown) as SpacesManager}
-          http={httpStart}
+          getFeatures={featuresStart.getFeatures}
           notifications={notificationServiceMock.createStartContract()}
           securityEnabled={true}
           capabilities={{
@@ -68,7 +81,7 @@ describe('SpacesGridPage', () => {
     const wrapper = mountWithIntl(
       <SpacesGridPage
         spacesManager={(spacesManager as unknown) as SpacesManager}
-        http={httpStart}
+        getFeatures={featuresStart.getFeatures}
         notifications={notificationServiceMock.createStartContract()}
         securityEnabled={true}
         capabilities={{
@@ -87,4 +100,72 @@ describe('SpacesGridPage', () => {
     expect(wrapper.find(SpaceAvatar)).toHaveLength(spaces.length);
     expect(wrapper.find(SpaceAvatar)).toMatchSnapshot();
   });
+
+  it('notifies when spaces fail to load', async () => {
+    const httpStart = httpServiceMock.createStartContract();
+    httpStart.get.mockResolvedValue([]);
+
+    const error = new Error('something awful happened');
+    spacesManager.getSpaces.mockRejectedValue(error);
+
+    const notifications = notificationServiceMock.createStartContract();
+
+    const wrapper = mountWithIntl(
+      <SpacesGridPage
+        spacesManager={(spacesManager as unknown) as SpacesManager}
+        getFeatures={featuresStart.getFeatures}
+        notifications={notifications}
+        securityEnabled={true}
+        capabilities={{
+          navLinks: {},
+          management: {},
+          catalogue: {},
+          spaces: { manage: true },
+        }}
+      />
+    );
+
+    // allow spacesManager to load spaces
+    await nextTick();
+    wrapper.update();
+
+    expect(wrapper.find(SpaceAvatar)).toHaveLength(0);
+    expect(notifications.toasts.addError).toHaveBeenCalledWith(error, {
+      title: 'Error loading spaces',
+    });
+  });
+
+  it('notifies when features fail to load', async () => {
+    const httpStart = httpServiceMock.createStartContract();
+    httpStart.get.mockResolvedValue([]);
+
+    const error = new Error('something awful happened');
+
+    const notifications = notificationServiceMock.createStartContract();
+
+    const wrapper = mountWithIntl(
+      <SpacesGridPage
+        spacesManager={(spacesManager as unknown) as SpacesManager}
+        getFeatures={() => Promise.reject(error)}
+        notifications={notifications}
+        securityEnabled={true}
+        capabilities={{
+          navLinks: {},
+          management: {},
+          catalogue: {},
+          spaces: { manage: true },
+        }}
+      />
+    );
+
+    // allow spacesManager to load spaces
+    await nextTick();
+    wrapper.update();
+
+    expect(wrapper.find(SpaceAvatar)).toHaveLength(0);
+    // For end-users, the effect is that spaces won't load, even though this was a request to retrieve features.
+    expect(notifications.toasts.addError).toHaveBeenCalledWith(error, {
+      title: 'Error loading spaces',
+    });
+  });
 });
diff --git a/x-pack/plugins/spaces/public/management/spaces_management_app.test.tsx b/x-pack/plugins/spaces/public/management/spaces_management_app.test.tsx
index 2e274e08ee13b..7738a440cb5e1 100644
--- a/x-pack/plugins/spaces/public/management/spaces_management_app.test.tsx
+++ b/x-pack/plugins/spaces/public/management/spaces_management_app.test.tsx
@@ -23,6 +23,8 @@ import { coreMock } from '../../../../../src/core/public/mocks';
 import { securityMock } from '../../../security/public/mocks';
 import { spacesManagerMock } from '../spaces_manager/mocks';
 import { SecurityLicenseFeatures } from '../../../security/public';
+import { featuresPluginMock } from '../../../features/public/mocks';
+import { PluginsStart } from '../plugin';
 
 async function mountApp(basePath: string, spaceId?: string) {
   const container = document.createElement('div');
@@ -42,11 +44,14 @@ async function mountApp(basePath: string, spaceId?: string) {
     showLinks: true,
   } as SecurityLicenseFeatures);
 
+  const [coreStart, pluginsStart] = await coreMock.createSetup().getStartServices();
+  (pluginsStart as PluginsStart).features = featuresPluginMock.createStart();
+
   const unmount = await spacesManagementApp
     .create({
       spacesManager,
       securityLicense,
-      getStartServices: coreMock.createSetup().getStartServices as any,
+      getStartServices: async () => [coreStart, pluginsStart as PluginsStart],
     })
     .mount({ basePath, element: container, setBreadcrumbs });
 
@@ -81,7 +86,7 @@ describe('spacesManagementApp', () => {
     expect(setBreadcrumbs).toHaveBeenCalledWith([{ href: `#${basePath}`, text: 'Spaces' }]);
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Spaces Page: {"capabilities":{"catalogue":{},"management":{},"navLinks":{}},"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{}},"notifications":{"toasts":{}},"spacesManager":{"onActiveSpaceChange$":{"_isScalar":false}},"securityEnabled":true}
+        Spaces Page: {"capabilities":{"catalogue":{},"management":{},"navLinks":{}},"notifications":{"toasts":{}},"spacesManager":{"onActiveSpaceChange$":{"_isScalar":false}},"securityEnabled":true}
       </div>
     `);
 
@@ -103,7 +108,7 @@ describe('spacesManagementApp', () => {
     ]);
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Spaces Edit Page: {"capabilities":{"catalogue":{},"management":{},"navLinks":{}},"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{}},"notifications":{"toasts":{}},"spacesManager":{"onActiveSpaceChange$":{"_isScalar":false}},"securityEnabled":true}
+        Spaces Edit Page: {"capabilities":{"catalogue":{},"management":{},"navLinks":{}},"notifications":{"toasts":{}},"spacesManager":{"onActiveSpaceChange$":{"_isScalar":false}},"securityEnabled":true}
       </div>
     `);
 
@@ -126,7 +131,7 @@ describe('spacesManagementApp', () => {
     ]);
     expect(container).toMatchInlineSnapshot(`
       <div>
-        Spaces Edit Page: {"capabilities":{"catalogue":{},"management":{},"navLinks":{}},"http":{"basePath":{"basePath":"","serverBasePath":""},"anonymousPaths":{}},"notifications":{"toasts":{}},"spacesManager":{"onActiveSpaceChange$":{"_isScalar":false}},"spaceId":"some-space","securityEnabled":true}
+        Spaces Edit Page: {"capabilities":{"catalogue":{},"management":{},"navLinks":{}},"notifications":{"toasts":{}},"spacesManager":{"onActiveSpaceChange$":{"_isScalar":false}},"spaceId":"some-space","securityEnabled":true}
       </div>
     `);
 
diff --git a/x-pack/plugins/spaces/public/management/spaces_management_app.tsx b/x-pack/plugins/spaces/public/management/spaces_management_app.tsx
index 663237cfc2e8a..92b369807b0da 100644
--- a/x-pack/plugins/spaces/public/management/spaces_management_app.tsx
+++ b/x-pack/plugins/spaces/public/management/spaces_management_app.tsx
@@ -8,7 +8,7 @@ import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { HashRouter as Router, Route, Switch, useParams } from 'react-router-dom';
 import { i18n } from '@kbn/i18n';
-import { CoreSetup } from 'src/core/public';
+import { StartServicesAccessor } from 'src/core/public';
 import { SecurityLicense } from '../../../security/public';
 import { RegisterManagementAppArgs } from '../../../../../src/plugins/management/public';
 import { PluginsStart } from '../plugin';
@@ -18,7 +18,7 @@ import { ManageSpacePage } from './edit_space';
 import { Space } from '..';
 
 interface CreateParams {
-  getStartServices: CoreSetup<PluginsStart>['getStartServices'];
+  getStartServices: StartServicesAccessor<PluginsStart>;
   spacesManager: SpacesManager;
   securityLicense?: SecurityLicense;
 }
@@ -33,7 +33,10 @@ export const spacesManagementApp = Object.freeze({
         defaultMessage: 'Spaces',
       }),
       async mount({ basePath, element, setBreadcrumbs }) {
-        const [{ http, notifications, i18n: i18nStart, application }] = await getStartServices();
+        const [
+          { notifications, i18n: i18nStart, application },
+          { features },
+        ] = await getStartServices();
         const spacesBreadcrumbs = [
           {
             text: i18n.translate('xpack.spaces.management.breadcrumb', {
@@ -48,7 +51,7 @@ export const spacesManagementApp = Object.freeze({
           return (
             <SpacesGridPage
               capabilities={application.capabilities}
-              http={http}
+              getFeatures={features.getFeatures}
               notifications={notifications}
               spacesManager={spacesManager}
               securityEnabled={securityLicense?.getFeatures().showLinks ?? false}
@@ -69,7 +72,7 @@ export const spacesManagementApp = Object.freeze({
           return (
             <ManageSpacePage
               capabilities={application.capabilities}
-              http={http}
+              getFeatures={features.getFeatures}
               notifications={notifications}
               spacesManager={spacesManager}
               securityEnabled={securityLicense?.getFeatures().showLinks ?? false}
@@ -93,7 +96,7 @@ export const spacesManagementApp = Object.freeze({
           return (
             <ManageSpacePage
               capabilities={application.capabilities}
-              http={http}
+              getFeatures={features.getFeatures}
               notifications={notifications}
               spacesManager={spacesManager}
               spaceId={spaceId}
diff --git a/x-pack/plugins/spaces/public/plugin.test.ts b/x-pack/plugins/spaces/public/plugin.test.ts
index 28f8433be6fd9..d879a318fe815 100644
--- a/x-pack/plugins/spaces/public/plugin.test.ts
+++ b/x-pack/plugins/spaces/public/plugin.test.ts
@@ -10,6 +10,7 @@ import { homePluginMock } from '../../../../src/plugins/home/public/mocks';
 import { ManagementSection } from '../../../../src/plugins/management/public';
 import { managementPluginMock } from '../../../../src/plugins/management/public/mocks';
 import { advancedSettingsMock } from '../../../../src/plugins/advanced_settings/public/mocks';
+import { featuresPluginMock } from '../../features/public/mocks';
 
 describe('Spaces plugin', () => {
   describe('#setup', () => {
@@ -101,7 +102,7 @@ describe('Spaces plugin', () => {
       const plugin = new SpacesPlugin();
       plugin.setup(coreSetup, {});
 
-      plugin.start(coreStart, {});
+      plugin.start(coreStart, { features: featuresPluginMock.createStart() });
 
       expect(coreStart.chrome.navControls.registerLeft).toHaveBeenCalled();
     });
diff --git a/x-pack/plugins/spaces/public/plugin.tsx b/x-pack/plugins/spaces/public/plugin.tsx
index 44215ec538002..876ab39df3a1f 100644
--- a/x-pack/plugins/spaces/public/plugin.tsx
+++ b/x-pack/plugins/spaces/public/plugin.tsx
@@ -9,6 +9,7 @@ import { HomePublicPluginSetup } from 'src/plugins/home/public';
 import { SavedObjectsManagementAction } from 'src/legacy/core_plugins/management/public';
 import { ManagementStart, ManagementSetup } from 'src/plugins/management/public';
 import { AdvancedSettingsSetup } from 'src/plugins/advanced_settings/public';
+import { FeaturesPluginStart } from '../../features/public';
 import { SecurityPluginStart, SecurityPluginSetup } from '../../security/public';
 import { SpacesManager } from './spaces_manager';
 import { initSpacesNavControl } from './nav_control';
@@ -26,6 +27,7 @@ export interface PluginsSetup {
 }
 
 export interface PluginsStart {
+  features: FeaturesPluginStart;
   management?: ManagementStart;
   security?: SecurityPluginStart;
 }
@@ -53,7 +55,7 @@ export class SpacesPlugin implements Plugin<SpacesPluginSetup, SpacesPluginStart
       this.managementService = new ManagementService();
       this.managementService.setup({
         management: plugins.management,
-        getStartServices: core.getStartServices,
+        getStartServices: core.getStartServices as CoreSetup<PluginsStart>['getStartServices'],
         spacesManager: this.spacesManager,
         securityLicense: plugins.security?.license,
       });
diff --git a/x-pack/plugins/spaces/public/space_selector/space_selector_app.tsx b/x-pack/plugins/spaces/public/space_selector/space_selector_app.tsx
index 6fab1767e4b6d..048f0e30cd469 100644
--- a/x-pack/plugins/spaces/public/space_selector/space_selector_app.tsx
+++ b/x-pack/plugins/spaces/public/space_selector/space_selector_app.tsx
@@ -4,14 +4,14 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { CoreSetup, AppMountParameters } from 'src/core/public';
+import { StartServicesAccessor, ApplicationSetup, AppMountParameters } from 'src/core/public';
 import { i18n } from '@kbn/i18n';
 import { SpacesManager } from '../spaces_manager';
 
 interface CreateDeps {
-  application: CoreSetup['application'];
+  application: ApplicationSetup;
   spacesManager: SpacesManager;
-  getStartServices: CoreSetup['getStartServices'];
+  getStartServices: StartServicesAccessor;
 }
 
 export const spaceSelectorApp = Object.freeze({
diff --git a/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.test.ts b/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.test.ts
index 3f7b93c754aef..2c1ab26dd3d82 100644
--- a/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.test.ts
+++ b/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.test.ts
@@ -13,12 +13,11 @@ import { featuresPluginMock } from '../../../features/server/mocks';
 import { spacesServiceMock } from '../spaces_service/spaces_service.mock';
 import { PluginsStart } from '../plugin';
 
-const features: Feature[] = [
+const features = ([
   {
     id: 'feature_1',
     name: 'Feature 1',
     app: [],
-    privileges: {},
   },
   {
     id: 'feature_2',
@@ -60,7 +59,7 @@ const features: Feature[] = [
       },
     },
   },
-];
+] as unknown) as Feature[];
 
 const buildCapabilities = () =>
   Object.freeze({
@@ -154,7 +153,7 @@ describe('capabilitiesSwitcher', () => {
     expect(result).toEqual(buildCapabilities());
   });
 
-  it('logs a warning, and does not toggle capabilities if an error is encountered', async () => {
+  it('logs a debug message, and does not toggle capabilities if an error is encountered', async () => {
     const space: Space = {
       id: 'space',
       name: '',
@@ -171,7 +170,7 @@ describe('capabilitiesSwitcher', () => {
     const result = await switcher(request, capabilities);
 
     expect(result).toEqual(buildCapabilities());
-    expect(logger.warn).toHaveBeenCalledWith(
+    expect(logger.debug).toHaveBeenCalledWith(
       `Error toggling capabilities for request to /path: Error: Something terrible happened`
     );
   });
diff --git a/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.ts b/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.ts
index 317cc7fe0e3c3..ddbea91f7268c 100644
--- a/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.ts
+++ b/x-pack/plugins/spaces/server/capabilities/capabilities_switcher.ts
@@ -30,9 +30,10 @@ export function setupCapabilitiesSwitcher(
 
       const registeredFeatures = features.getFeatures();
 
+      // try to retrieve capabilities for authenticated or "maybe authenticated" users
       return toggleCapabilities(registeredFeatures, capabilities, activeSpace);
     } catch (e) {
-      logger.warn(`Error toggling capabilities for request to ${request.url.pathname}: ${e}`);
+      logger.debug(`Error toggling capabilities for request to ${request.url.pathname}: ${e}`);
       return capabilities;
     }
   };
diff --git a/x-pack/plugins/telemetry_collection_xpack/README.md b/x-pack/plugins/telemetry_collection_xpack/README.md
new file mode 100644
index 0000000000000..6c205bb17c663
--- /dev/null
+++ b/x-pack/plugins/telemetry_collection_xpack/README.md
@@ -0,0 +1,9 @@
+# Telemetry collection with X-Pack
+
+Gathers all usage collection, retrieving them from both: OSS and X-Pack plugins.
+
+---
+
+## Development
+
+See the [kibana contributing guide](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md) for instructions on how to set up your development environment.
diff --git a/x-pack/plugins/telemetry_collection_xpack/common/index.ts b/x-pack/plugins/telemetry_collection_xpack/common/index.ts
new file mode 100644
index 0000000000000..2b08ebe2e7bbf
--- /dev/null
+++ b/x-pack/plugins/telemetry_collection_xpack/common/index.ts
@@ -0,0 +1,8 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const PLUGIN_ID = 'telemetryCollectionXpack';
+export const PLUGIN_NAME = 'telemetry_collection_xpack';
diff --git a/x-pack/plugins/telemetry_collection_xpack/kibana.json b/x-pack/plugins/telemetry_collection_xpack/kibana.json
new file mode 100644
index 0000000000000..8499e0258f8ff
--- /dev/null
+++ b/x-pack/plugins/telemetry_collection_xpack/kibana.json
@@ -0,0 +1,10 @@
+{
+  "id": "telemetryCollectionXpack",
+  "version": "kibana",
+  "server": true,
+  "ui": false,
+  "requiredPlugins": [
+    "telemetryCollectionManager"
+  ],
+  "optionalPlugins": []
+}
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/index.ts b/x-pack/plugins/telemetry_collection_xpack/server/index.ts
new file mode 100644
index 0000000000000..249d16c331c39
--- /dev/null
+++ b/x-pack/plugins/telemetry_collection_xpack/server/index.ts
@@ -0,0 +1,15 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PluginInitializerContext } from 'kibana/server';
+import { TelemetryCollectionXpackPlugin } from './plugin';
+
+//  This exports static code and TypeScript types,
+//  as well as, Kibana Platform `plugin()` initializer.
+
+export function plugin(initializerContext: PluginInitializerContext) {
+  return new TelemetryCollectionXpackPlugin(initializerContext);
+}
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/plugin.ts b/x-pack/plugins/telemetry_collection_xpack/server/plugin.ts
new file mode 100644
index 0000000000000..b0afba8852495
--- /dev/null
+++ b/x-pack/plugins/telemetry_collection_xpack/server/plugin.ts
@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { PluginInitializerContext, CoreSetup, CoreStart, Plugin } from 'kibana/server';
+import { TelemetryCollectionManagerPluginSetup } from 'src/plugins/telemetry_collection_manager/server';
+import { getClusterUuids, getLocalLicense } from '../../../../src/plugins/telemetry/server';
+import { getStatsWithXpack } from './telemetry_collection';
+
+interface TelemetryCollectionXpackDepsSetup {
+  telemetryCollectionManager: TelemetryCollectionManagerPluginSetup;
+}
+
+export class TelemetryCollectionXpackPlugin implements Plugin {
+  constructor(initializerContext: PluginInitializerContext) {}
+
+  public setup(core: CoreSetup, { telemetryCollectionManager }: TelemetryCollectionXpackDepsSetup) {
+    telemetryCollectionManager.setCollection({
+      esCluster: core.elasticsearch.dataClient,
+      title: 'local_xpack',
+      priority: 1,
+      statsGetter: getStatsWithXpack,
+      clusterDetailsGetter: getClusterUuids,
+      licenseGetter: getLocalLicense,
+    });
+  }
+
+  public start(core: CoreStart) {}
+}
diff --git a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/__snapshots__/get_stats_with_xpack.test.ts.snap b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/__snapshots__/get_stats_with_xpack.test.ts.snap
similarity index 100%
rename from x-pack/legacy/plugins/xpack_main/server/telemetry_collection/__snapshots__/get_stats_with_xpack.test.ts.snap
rename to x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/__snapshots__/get_stats_with_xpack.test.ts.snap
diff --git a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/__tests__/get_xpack.js b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/__tests__/get_xpack.js
similarity index 100%
rename from x-pack/legacy/plugins/xpack_main/server/telemetry_collection/__tests__/get_xpack.js
rename to x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/__tests__/get_xpack.js
diff --git a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/constants.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/constants.ts
similarity index 100%
rename from x-pack/legacy/plugins/xpack_main/server/telemetry_collection/constants.ts
rename to x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/constants.ts
diff --git a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/get_stats_with_xpack.test.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.test.ts
similarity index 73%
rename from x-pack/legacy/plugins/xpack_main/server/telemetry_collection/get_stats_with_xpack.test.ts
rename to x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.test.ts
index b85cbd9661022..f2a9995098e59 100644
--- a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/get_stats_with_xpack.test.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.test.ts
@@ -4,6 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { coreMock } from '../../../../../src/core/server/mocks';
 import { getStatsWithXpack } from './get_stats_with_xpack';
 
 const kibana = {
@@ -28,26 +29,10 @@ const kibana = {
   snow: { chances: 0 },
 };
 
-const getMockServer = (getCluster = jest.fn()) => ({
-  log(tags: string[], message: string) {
-    // eslint-disable-next-line no-console
-    console.log({ tags, message });
-  },
-  config() {
-    return {
-      get(item: string) {
-        switch (item) {
-          case 'pkg.version':
-            return '8675309-snapshot';
-          default:
-            throw Error(`unexpected config.get('${item}') received.`);
-        }
-      },
-    };
-  },
-  plugins: {
-    elasticsearch: { getCluster },
-  },
+const getContext = () => ({
+  version: '8675309-snapshot',
+  isDev: true,
+  logger: coreMock.createPluginInitializerContext().logger.get('test'),
 });
 
 const mockUsageCollection = (kibanaUsage = kibana) => ({
@@ -72,13 +57,16 @@ describe('Telemetry Collection: Get Aggregated Stats', () => {
       }
     });
     const usageCollection = mockUsageCollection();
-    const server = getMockServer();
+    const context = getContext();
 
-    const stats = await getStatsWithXpack([{ clusterUuid: '1234' }], {
-      callCluster,
-      usageCollection,
-      server,
-    } as any);
+    const stats = await getStatsWithXpack(
+      [{ clusterUuid: '1234' }],
+      {
+        callCluster,
+        usageCollection,
+      } as any,
+      context
+    );
     expect(stats.map(({ timestamp, ...rest }) => rest)).toMatchSnapshot();
   });
 
@@ -101,13 +89,16 @@ describe('Telemetry Collection: Get Aggregated Stats', () => {
       }
     });
     const usageCollection = mockUsageCollection();
-    const server = getMockServer();
+    const context = getContext();
 
-    const stats = await getStatsWithXpack([{ clusterUuid: '1234' }], {
-      callCluster,
-      usageCollection,
-      server,
-    } as any);
+    const stats = await getStatsWithXpack(
+      [{ clusterUuid: '1234' }],
+      {
+        callCluster,
+        usageCollection,
+      } as any,
+      context
+    );
     expect(stats.map(({ timestamp, ...rest }) => rest)).toMatchSnapshot();
   });
 });
diff --git a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/get_stats_with_xpack.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts
similarity index 70%
rename from x-pack/legacy/plugins/xpack_main/server/telemetry_collection/get_stats_with_xpack.ts
rename to x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts
index ea7465f66f120..705b2a11bde5b 100644
--- a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/get_stats_with_xpack.ts
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_stats_with_xpack.ts
@@ -4,23 +4,21 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { StatsGetter } from '../../../../../../src/legacy/core_plugins/telemetry/server/collection_manager';
-import {
-  getLocalStats,
-  TelemetryLocalStats,
-} from '../../../../../../src/legacy/core_plugins/telemetry/server/telemetry_collection/get_local_stats';
+import { TelemetryLocalStats, getLocalStats } from '../../../../../src/plugins/telemetry/server';
+import { StatsGetter } from '../../../../../src/plugins/telemetry_collection_manager/server';
 import { getXPackUsage } from './get_xpack';
 
 export type TelemetryAggregatedStats = TelemetryLocalStats & {
   stack_stats: { xpack?: object };
 };
 
-export const getStatsWithXpack: StatsGetter<TelemetryAggregatedStats> = async function(
+export const getStatsWithXpack: StatsGetter<{}, TelemetryAggregatedStats> = async function(
   clustersDetails,
-  config
+  config,
+  context
 ) {
   const { callCluster } = config;
-  const clustersLocalStats = await getLocalStats(clustersDetails, config);
+  const clustersLocalStats = await getLocalStats(clustersDetails, config, context);
   const xpack = await getXPackUsage(callCluster).catch(() => undefined); // We want to still report something (and do not lose the license) even when this method fails.
 
   return clustersLocalStats.map(localStats => {
diff --git a/x-pack/legacy/plugins/xpack_main/server/telemetry_collection/get_xpack.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_xpack.ts
similarity index 100%
rename from x-pack/legacy/plugins/xpack_main/server/telemetry_collection/get_xpack.ts
rename to x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/get_xpack.ts
diff --git a/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/index.ts b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/index.ts
new file mode 100644
index 0000000000000..553f8dc0c4188
--- /dev/null
+++ b/x-pack/plugins/telemetry_collection_xpack/server/telemetry_collection/index.ts
@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { getStatsWithXpack } from './get_stats_with_xpack';
diff --git a/x-pack/plugins/transform/public/app/common/index.ts b/x-pack/plugins/transform/public/app/common/index.ts
index ee026e2e590a4..f2b31bb5da865 100644
--- a/x-pack/plugins/transform/public/app/common/index.ts
+++ b/x-pack/plugins/transform/public/app/common/index.ts
@@ -40,6 +40,8 @@ export { GetTransformsResponse, PreviewData, PreviewMappings } from './pivot_pre
 export {
   getEsAggFromAggConfig,
   isPivotAggsConfigWithUiSupport,
+  isPivotAggsConfigPercentiles,
+  PERCENTILES_AGG_DEFAULT_PERCENTS,
   PivotAgg,
   PivotAggDict,
   PivotAggsConfig,
diff --git a/x-pack/plugins/transform/public/app/common/pivot_aggs.ts b/x-pack/plugins/transform/public/app/common/pivot_aggs.ts
index 3ea614aaf5c9a..35dad3a8b2153 100644
--- a/x-pack/plugins/transform/public/app/common/pivot_aggs.ts
+++ b/x-pack/plugins/transform/public/app/common/pivot_aggs.ts
@@ -15,10 +15,13 @@ export enum PIVOT_SUPPORTED_AGGS {
   CARDINALITY = 'cardinality',
   MAX = 'max',
   MIN = 'min',
+  PERCENTILES = 'percentiles',
   SUM = 'sum',
   VALUE_COUNT = 'value_count',
 }
 
+export const PERCENTILES_AGG_DEFAULT_PERCENTS = [1, 5, 25, 50, 75, 95, 99];
+
 export const pivotAggsFieldSupport = {
   [KBN_FIELD_TYPES.ATTACHMENT]: [PIVOT_SUPPORTED_AGGS.VALUE_COUNT],
   [KBN_FIELD_TYPES.BOOLEAN]: [PIVOT_SUPPORTED_AGGS.VALUE_COUNT],
@@ -36,6 +39,7 @@ export const pivotAggsFieldSupport = {
     PIVOT_SUPPORTED_AGGS.CARDINALITY,
     PIVOT_SUPPORTED_AGGS.MAX,
     PIVOT_SUPPORTED_AGGS.MIN,
+    PIVOT_SUPPORTED_AGGS.PERCENTILES,
     PIVOT_SUPPORTED_AGGS.SUM,
     PIVOT_SUPPORTED_AGGS.VALUE_COUNT,
   ],
@@ -60,10 +64,17 @@ export interface PivotAggsConfigBase {
   dropDownName: string;
 }
 
-export interface PivotAggsConfigWithUiSupport extends PivotAggsConfigBase {
+interface PivotAggsConfigWithUiBase extends PivotAggsConfigBase {
   field: EsFieldName;
 }
 
+interface PivotAggsConfigPercentiles extends PivotAggsConfigWithUiBase {
+  agg: PIVOT_SUPPORTED_AGGS.PERCENTILES;
+  percents: number[];
+}
+
+export type PivotAggsConfigWithUiSupport = PivotAggsConfigWithUiBase | PivotAggsConfigPercentiles;
+
 export function isPivotAggsConfigWithUiSupport(arg: any): arg is PivotAggsConfigWithUiSupport {
   return (
     arg.hasOwnProperty('agg') &&
@@ -74,6 +85,15 @@ export function isPivotAggsConfigWithUiSupport(arg: any): arg is PivotAggsConfig
   );
 }
 
+export function isPivotAggsConfigPercentiles(arg: any): arg is PivotAggsConfigPercentiles {
+  return (
+    arg.hasOwnProperty('agg') &&
+    arg.hasOwnProperty('field') &&
+    arg.hasOwnProperty('percents') &&
+    arg.agg === PIVOT_SUPPORTED_AGGS.PERCENTILES
+  );
+}
+
 export type PivotAggsConfig = PivotAggsConfigBase | PivotAggsConfigWithUiSupport;
 
 export type PivotAggsConfigWithUiSupportDict = Dictionary<PivotAggsConfigWithUiSupport>;
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/aggregation_list/popover_form.tsx b/x-pack/plugins/transform/public/app/sections/create_transform/components/aggregation_list/popover_form.tsx
index 6c1e119ab38e0..7157586dddda9 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/aggregation_list/popover_form.tsx
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/aggregation_list/popover_form.tsx
@@ -22,8 +22,10 @@ import { dictionaryToArray } from '../../../../../../common/types/common';
 import {
   AggName,
   isAggName,
+  isPivotAggsConfigPercentiles,
   isPivotAggsConfigWithUiSupport,
   getEsAggFromAggConfig,
+  PERCENTILES_AGG_DEFAULT_PERCENTS,
   PivotAggsConfig,
   PivotAggsConfigWithUiSupportDict,
   PIVOT_SUPPORTED_AGGS,
@@ -40,6 +42,33 @@ interface Props {
   onChange(d: PivotAggsConfig): void;
 }
 
+function getDefaultPercents(defaultData: PivotAggsConfig): number[] | undefined {
+  if (isPivotAggsConfigPercentiles(defaultData)) {
+    return defaultData.percents;
+  }
+}
+
+function parsePercentsInput(inputValue: string | undefined) {
+  if (inputValue !== undefined) {
+    const strVals: string[] = inputValue.split(',');
+    const percents: number[] = [];
+    for (const str of strVals) {
+      if (str.trim().length > 0 && isNaN(str as any) === false) {
+        const val = Number(str);
+        if (val >= 0 && val <= 100) {
+          percents.push(val);
+        } else {
+          return [];
+        }
+      }
+    }
+
+    return percents;
+  }
+
+  return [];
+}
+
 export const PopoverForm: React.FC<Props> = ({ defaultData, otherAggNames, onChange, options }) => {
   const isUnsupportedAgg = !isPivotAggsConfigWithUiSupport(defaultData);
 
@@ -48,10 +77,45 @@ export const PopoverForm: React.FC<Props> = ({ defaultData, otherAggNames, onCha
   const [field, setField] = useState(
     isPivotAggsConfigWithUiSupport(defaultData) ? defaultData.field : ''
   );
+  const [percents, setPercents] = useState(getDefaultPercents(defaultData));
 
   const availableFields: SelectOption[] = [];
   const availableAggs: SelectOption[] = [];
 
+  function updateAgg(aggVal: PIVOT_SUPPORTED_AGGS) {
+    setAgg(aggVal);
+    if (aggVal === PIVOT_SUPPORTED_AGGS.PERCENTILES && percents === undefined) {
+      setPercents(PERCENTILES_AGG_DEFAULT_PERCENTS);
+    }
+  }
+
+  function updatePercents(inputValue: string) {
+    setPercents(parsePercentsInput(inputValue));
+  }
+
+  function getUpdatedItem(): PivotAggsConfig {
+    let updatedItem: PivotAggsConfig;
+
+    if (agg !== PIVOT_SUPPORTED_AGGS.PERCENTILES) {
+      updatedItem = {
+        agg,
+        aggName,
+        field,
+        dropDownName: defaultData.dropDownName,
+      };
+    } else {
+      updatedItem = {
+        agg,
+        aggName,
+        field,
+        dropDownName: defaultData.dropDownName,
+        percents,
+      };
+    }
+
+    return updatedItem;
+  }
+
   if (!isUnsupportedAgg) {
     const optionsArr = dictionaryToArray(options);
     optionsArr
@@ -83,7 +147,18 @@ export const PopoverForm: React.FC<Props> = ({ defaultData, otherAggNames, onCha
     });
   }
 
-  const formValid = validAggName;
+  let percentsText;
+  if (percents !== undefined) {
+    percentsText = percents.toString();
+  }
+
+  const validPercents =
+    agg === PIVOT_SUPPORTED_AGGS.PERCENTILES && parsePercentsInput(percentsText).length > 0;
+
+  let formValid = validAggName;
+  if (formValid && agg === PIVOT_SUPPORTED_AGGS.PERCENTILES) {
+    formValid = validPercents;
+  }
 
   return (
     <EuiForm style={{ width: '300px' }}>
@@ -117,7 +192,7 @@ export const PopoverForm: React.FC<Props> = ({ defaultData, otherAggNames, onCha
           <EuiSelect
             options={availableAggs}
             value={agg}
-            onChange={e => setAgg(e.target.value as PIVOT_SUPPORTED_AGGS)}
+            onChange={e => updateAgg(e.target.value as PIVOT_SUPPORTED_AGGS)}
           />
         </EuiFormRow>
       )}
@@ -134,6 +209,26 @@ export const PopoverForm: React.FC<Props> = ({ defaultData, otherAggNames, onCha
           />
         </EuiFormRow>
       )}
+      {agg === PIVOT_SUPPORTED_AGGS.PERCENTILES && (
+        <EuiFormRow
+          label={i18n.translate('xpack.transform.agg.popoverForm.percentsLabel', {
+            defaultMessage: 'Percents',
+          })}
+          error={
+            !validPercents && [
+              i18n.translate('xpack.transform.groupBy.popoverForm.intervalPercents', {
+                defaultMessage: 'Enter a comma-separated list of percentiles',
+              }),
+            ]
+          }
+          isInvalid={!validPercents}
+        >
+          <EuiFieldText
+            defaultValue={percentsText}
+            onChange={e => updatePercents(e.target.value)}
+          />
+        </EuiFormRow>
+      )}
       {isUnsupportedAgg && (
         <EuiCodeEditor
           mode="json"
@@ -147,10 +242,7 @@ export const PopoverForm: React.FC<Props> = ({ defaultData, otherAggNames, onCha
         />
       )}
       <EuiFormRow hasEmptyLabelSpace>
-        <EuiButton
-          isDisabled={!formValid}
-          onClick={() => onChange({ ...defaultData, aggName, agg, field })}
-        >
+        <EuiButton isDisabled={!formValid} onClick={() => onChange(getUpdatedItem())}>
           {i18n.translate('xpack.transform.agg.popoverForm.submitButtonLabel', {
             defaultMessage: 'Apply',
           })}
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common.test.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common.test.ts
index 5db6a233c9134..58ab4a1b8ac33 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common.test.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common.test.ts
@@ -37,6 +37,7 @@ describe('Transform: Define Pivot Common', () => {
             { label: 'cardinality( the-f[i]e>ld )' },
             { label: 'max( the-f[i]e>ld )' },
             { label: 'min( the-f[i]e>ld )' },
+            { label: 'percentiles( the-f[i]e>ld )' },
             { label: 'sum( the-f[i]e>ld )' },
             { label: 'value_count( the-f[i]e>ld )' },
           ],
@@ -67,6 +68,13 @@ describe('Transform: Define Pivot Common', () => {
           aggName: 'the-field.min',
           dropDownName: 'min( the-f[i]e>ld )',
         },
+        'percentiles( the-f[i]e>ld )': {
+          agg: 'percentiles',
+          field: ' the-f[i]e>ld ',
+          aggName: 'the-field.percentiles',
+          dropDownName: 'percentiles( the-f[i]e>ld )',
+          percents: [1, 5, 25, 50, 75, 95, 99],
+        },
         'sum( the-f[i]e>ld )': {
           agg: 'sum',
           field: ' the-f[i]e>ld ',
diff --git a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common.ts b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common.ts
index a9413afb6243e..65cea40276da9 100644
--- a/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common.ts
+++ b/x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common.ts
@@ -12,10 +12,13 @@ import {
   DropDownOption,
   EsFieldName,
   GroupByConfigWithUiSupport,
+  PERCENTILES_AGG_DEFAULT_PERCENTS,
+  PivotAggsConfigWithUiSupport,
   PivotAggsConfigWithUiSupportDict,
   pivotAggsFieldSupport,
   PivotGroupByConfigWithUiSupportDict,
   pivotGroupByFieldSupport,
+  PIVOT_SUPPORTED_AGGS,
   PIVOT_SUPPORTED_GROUP_BY_AGGS,
 } from '../../../../common';
 
@@ -57,6 +60,31 @@ function getDefaultGroupByConfig(
   }
 }
 
+function getDefaultAggregationConfig(
+  aggName: string,
+  dropDownName: string,
+  fieldName: EsFieldName,
+  agg: PIVOT_SUPPORTED_AGGS
+): PivotAggsConfigWithUiSupport {
+  switch (agg) {
+    case PIVOT_SUPPORTED_AGGS.PERCENTILES:
+      return {
+        agg,
+        aggName,
+        dropDownName,
+        field: fieldName,
+        percents: PERCENTILES_AGG_DEFAULT_PERCENTS,
+      };
+    default:
+      return {
+        agg,
+        aggName,
+        dropDownName,
+        field: fieldName,
+      };
+  }
+}
+
 const illegalEsAggNameChars = /[[\]>]/g;
 
 export function getPivotDropdownOptions(indexPattern: IndexPattern) {
@@ -105,7 +133,12 @@ export function getPivotDropdownOptions(indexPattern: IndexPattern) {
         // Option name in the dropdown for the aggregation is in the form of `sum(fieldname)`.
         const dropDownName = `${agg}(${field.name})`;
         aggOption.options.push({ label: dropDownName });
-        aggOptionsData[dropDownName] = { agg, field: field.name, aggName, dropDownName };
+        aggOptionsData[dropDownName] = getDefaultAggregationConfig(
+          aggName,
+          dropDownName,
+          field.name,
+          agg
+        );
       });
     }
     aggOptions.push(aggOption);
diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json
index 4d7bd10307ff8..0e24772ab9ab1 100644
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@@ -464,6 +464,17 @@
     "data.search.searchBar.savedQueryPopoverSavedQueryListItemDescriptionAriaLabel": "{savedQueryName} の説明",
     "data.search.searchBar.savedQueryPopoverSavedQueryListItemSelectedButtonAriaLabel": "選択されたクエリボタン {savedQueryName} を保存しました。変更を破棄するには押してください。",
     "data.search.searchBar.savedQueryPopoverTitleText": "保存されたクエリ",
+    "discover.fieldNameIcons.booleanAriaLabel": "ブールフィールド",
+    "discover.fieldNameIcons.conflictFieldAriaLabel": "矛盾フィールド",
+    "discover.fieldNameIcons.dateFieldAriaLabel": "日付フィールド",
+    "discover.fieldNameIcons.geoPointFieldAriaLabel": "地理ポイント",
+    "discover.fieldNameIcons.geoShapeFieldAriaLabel": "地理情報図形",
+    "discover.fieldNameIcons.ipAddressFieldAriaLabel": "IP アドレスフィールド",
+    "discover.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 フィールド",
+    "discover.fieldNameIcons.numberFieldAriaLabel": "数値フィールド",
+    "discover.fieldNameIcons.sourceFieldAriaLabel": "ソースフィールド",
+    "discover.fieldNameIcons.stringFieldAriaLabel": "文字列フィールド",
+    "discover.fieldNameIcons.unknownFieldAriaLabel": "不明なフィールド",
     "charts.colormaps.bluesText": "青",
     "charts.colormaps.greensText": "緑",
     "charts.colormaps.greenToRedText": "緑から赤",
@@ -1075,17 +1086,6 @@
     "kbn.discover.fieldChooser.searchPlaceHolder": "検索フィールド",
     "kbn.discover.fieldChooser.toggleFieldFilterButtonHideAriaLabel": "フィールド設定を非表示",
     "kbn.discover.fieldChooser.toggleFieldFilterButtonShowAriaLabel": "フィールド設定を表示",
-    "kbn.discover.fieldNameIcons.booleanAriaLabel": "ブールフィールド",
-    "kbn.discover.fieldNameIcons.conflictFieldAriaLabel": "矛盾フィールド",
-    "kbn.discover.fieldNameIcons.dateFieldAriaLabel": "日付フィールド",
-    "kbn.discover.fieldNameIcons.geoPointFieldAriaLabel": "地理ポイント",
-    "kbn.discover.fieldNameIcons.geoShapeFieldAriaLabel": "地理情報図形",
-    "kbn.discover.fieldNameIcons.ipAddressFieldAriaLabel": "IP アドレスフィールド",
-    "kbn.discover.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 フィールド",
-    "kbn.discover.fieldNameIcons.numberFieldAriaLabel": "数値フィールド",
-    "kbn.discover.fieldNameIcons.sourceFieldAriaLabel": "ソースフィールド",
-    "kbn.discover.fieldNameIcons.stringFieldAriaLabel": "文字列フィールド",
-    "kbn.discover.fieldNameIcons.unknownFieldAriaLabel": "不明なフィールド",
     "kbn.discover.histogram.partialData.bucketTooltipText": "選択された時間範囲にはこのバケット全体は含まれていませんが、一部データが含まれている可能性があります。",
     "kbn.discover.histogramOfFoundDocumentsAriaLabel": "発見されたドキュメントのヒストグラム",
     "kbn.discover.hitsPluralTitle": "{hits, plural, one {ヒット} other {ヒット}}",
@@ -2425,7 +2425,6 @@
     "savedObjects.saveDuplicateRejectedDescription": "重複ファイルの保存確認が拒否されました",
     "savedObjects.saveModal.cancelButtonLabel": "キャンセル",
     "savedObjects.saveModal.descriptionLabel": "説明",
-    "savedObjects.saveModal.duplicateTitleDescription": "{confirmSaveLabel} をクリックすると、既存の {objectType} が上書きされます。",
     "savedObjects.saveModal.duplicateTitleLabel": "「{title}」というタイトルの {objectType} が既に存在します",
     "savedObjects.saveModal.saveAsNewLabel": "新規 {objectType} として保存",
     "savedObjects.saveModal.saveButtonLabel": "保存",
@@ -3860,48 +3859,6 @@
     "xpack.apm.servicesTable.transactionsPerMinuteColumnLabel": "1 分あたりのトランザクション",
     "xpack.apm.servicesTable.transactionsPerMinuteUnitLabel": "1分あたりトランザクション数",
     "xpack.apm.servicesTable.UpgradeAssistantLink": "Kibana アップグレードアシスタントで詳細をご覧ください",
-    "xpack.apm.settings.agentConf.allOptionLabel": "すべて",
-    "xpack.apm.settings.agentConf.cancelButtonLabel": "キャンセル",
-    "xpack.apm.settings.agentConf.configTable.appliedTooltipMessage": "1 つまたは複数のエージェントにより適用されました。",
-    "xpack.apm.settings.agentConf.configTable.captureBodyColumnLabel": "キャプチャ本文",
-    "xpack.apm.settings.agentConf.configTable.configTable.failurePromptText": "エージェントの構成一覧を取得できませんでした。ユーザーに十分なパーミッションがない可能性があります。",
-    "xpack.apm.settings.agentConf.configTable.createConfigButtonLabel": "構成の作成",
-    "xpack.apm.settings.agentConf.configTable.editButtonDescription": "この構成を編集します",
-    "xpack.apm.settings.agentConf.configTable.editButtonLabel": "編集",
-    "xpack.apm.settings.agentConf.configTable.emptyPromptText": "変更しましょう。直接 Kibana からエージェント構成を微調整できます。再展開する必要はありません。まず、最初の構成を作成します。",
-    "xpack.apm.settings.agentConf.configTable.emptyPromptTitle": "構成が見つかりません。",
-    "xpack.apm.settings.agentConf.configTable.environmentColumnLabel": "サービス環境",
-    "xpack.apm.settings.agentConf.configTable.lastUpdatedColumnLabel": "最終更新",
-    "xpack.apm.settings.agentConf.configTable.notAppliedTooltipMessage": "まだエージェントにより適用されていません",
-    "xpack.apm.settings.agentConf.configTable.sampleRateColumnLabel": "サンプルレート",
-    "xpack.apm.settings.agentConf.configTable.serviceNameColumnLabel": "サービス名",
-    "xpack.apm.settings.agentConf.configTable.transactionMaxSpansColumnLabel": "トランザクションの最大範囲",
-    "xpack.apm.settings.agentConf.configurationsPanelTitle": "構成",
-    "xpack.apm.settings.agentConf.createConfigButtonLabel": "構成の作成",
-    "xpack.apm.settings.agentConf.createConfigTitle": "構成の作成",
-    "xpack.apm.settings.agentConf.editConfigTitle": "構成の編集",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.buttonLabel": "削除",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigFailedText": "{serviceName} の構成を削除中にエラーが発生しました。エラー「{errorMessage}」",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigFailedTitle": "構成を削除できませんでした",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigSucceededText": "「{serviceName}」の構成が正常に削除されました。エージェントに反映されるまでに少し時間がかかります。",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigSucceededTitle": "構成が削除されました",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.captureBodyInputHelpText": "HTTP リクエストのトランザクションの場合、エージェントはリクエスト本文 (POST 変数など) をキャプチャすることができます。デフォルトは「off」です。",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.captureBodyInputLabel": "本文をキャプチャ",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.captureBodyInputPlaceholderText": "オプションを選択",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputErrorText": "サンプルレートは 0.000 ～ 1 の範囲でなければなりません",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputHelpText": "0.000 ～ 1.0 の範囲のレートを選択してください。デフォルトは 1.0 (トレースの 100%) です。",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputLabel": "トランザクションのサンプルレート",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputPlaceholderText": "サンプルレートを設定",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.title": "オプション",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputErrorText": "0 と 32000 の間でなければなりません",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputHelpText": "トランザクションごとに記録される範囲を制限します。デフォルトは 500 です。",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputLabel": "トランザクションの最大範囲",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputPlaceholderText": "トランザクションの最大範囲を設定",
-    "xpack.apm.settings.agentConf.saveConfig.failed.text": "「{serviceName}」の構成を保存中にエラーが発生しました。エラー「{errorMessage}」",
-    "xpack.apm.settings.agentConf.saveConfig.failed.title": "構成を保存できませんでした",
-    "xpack.apm.settings.agentConf.saveConfig.succeeded.text": "「{serviceName}」の構成が保存されました。エージェントに反映されるまでに少し時間がかかります。",
-    "xpack.apm.settings.agentConf.saveConfig.succeeded.title": "構成が保存されました",
-    "xpack.apm.settings.agentConf.saveConfigurationButtonLabel": "保存",
     "xpack.apm.settingsLinkLabel": "設定",
     "xpack.apm.setupInstructionsButtonLabel": "セットアップの手順",
     "xpack.apm.stacktraceTab.localVariablesToogleButtonLabel": "ローカル変数",
@@ -5744,8 +5701,6 @@
     "xpack.graph.outlinkEncoders.textPlainTitle": "プレインテキスト",
     "xpack.graph.pluginDescription": "Elasticsearch データの関連性のある関係を浮上させ分析します。",
     "xpack.graph.savedWorkspace.workspaceNameTitle": "新規グラフワークスペース",
-    "xpack.graph.savedWorkspaces.graphWorkspaceLabel": "グラフワークスペース",
-    "xpack.graph.savedWorkspaces.graphWorkspacesLabel": "グラフワークスペース",
     "xpack.graph.saveWorkspace.savingErrorMessage": "ワークスペースの保存に失敗しました: {message}",
     "xpack.graph.saveWorkspace.successNotification.noDataSavedText": "構成が保存されましたが、データは保存されませんでした",
     "xpack.graph.saveWorkspace.successNotificationTitle": "「{workspaceTitle}」が保存されました",
@@ -7233,9 +7188,6 @@
     "xpack.maps.source.esGridDescription": "それぞれのグリッド付きセルのメトリックでグリッドにグループ分けされた地理空間データです。",
     "xpack.maps.source.esGridTitle": "グリッド集約",
     "xpack.maps.source.esSearch.convertToGeoJsonErrorMsg": "検索への応答を geoJson 機能コレクションに変換できません。エラー: {errorMsg}",
-    "xpack.maps.source.esSearch.disableFilterByMapBoundsExplainMsg": "インデックス「{indexPatternTitle}」はドキュメント数が少なく、ダイナミックフィルターが必要ありません。",
-    "xpack.maps.source.esSearch.disableFilterByMapBoundsTitle": "ダイナミックデータフィルターは無効です",
-    "xpack.maps.source.esSearch.disableFilterByMapBoundsTurnOnMsg": "ドキュメント数が増えると思われる場合はダイナミックフィルターをオンにしてください。",
     "xpack.maps.source.esSearch.extentFilterLabel": "マップの表示範囲でデータを動的にフィルタリング",
     "xpack.maps.source.esSearch.geofieldLabel": "地理空間フィールド",
     "xpack.maps.source.esSearch.geoFieldLabel": "地理空間フィールド",
@@ -10499,7 +10451,6 @@
     "xpack.security.management.editRole.elasticSearchPrivileges.runAsPrivilegesTitle": "権限として実行",
     "xpack.security.management.editRole.featureTable.enabledRoleFeaturesEnabledColumnTitle": "権限",
     "xpack.security.management.editRole.featureTable.enabledRoleFeaturesFeatureColumnTitle": "機能",
-    "xpack.security.management.editRole.featureTable.excludedFromBasePrivilegsTooltip": "アクセスを許可するには、「カスタム」特権を使用します。{featureName} は基本権限の一部ではありません。",
     "xpack.security.management.editRole.indexPrivilegeForm.deleteSpacePrivilegeAriaLabel": "インデックスの権限を削除",
     "xpack.security.management.editRole.indexPrivilegeForm.grantedDocumentsQueryFormRowLabel": "提供されたドキュメントのクエリ",
     "xpack.security.management.editRole.indexPrivilegeForm.grantReadPrivilegesLabel": "特定のドキュメントの読み込み権限を提供",
@@ -10529,13 +10480,6 @@
     "xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeInput": "読み込み",
     "xpack.security.management.editRole.simplePrivilegeForm.specifyPrivilegeForRoleDescription": "このロールの Kibana の権限を指定します。",
     "xpack.security.management.editRole.simplePrivilegeForm.unsupportedSpacePrivilegesWarning": "このロールはスペースへの権限が定義されていますが、Kibana でスペースが有効ではありません。このロールを保存するとこれらの権限が削除されます。",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.effectivePrivilegeMessage": "{source} で許可されています。",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.globalBasePrivilegeSource": "グローバルベース権限",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.globalFeaturePrivilegeSource": "グローバル機能権限",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.privilegeSupercededMessage": "{supersededPrivilege} のオリジナルの権限は {actualPrivilegeSource} により上書きされています",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.spaceBasePrivilegeSource": "スペースベース権限",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.spaceFeaturePrivilegeSource": "スペース機能権限",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.unknownPrivilegeSource": "**不明**",
     "xpack.security.management.editRole.spaceAwarePrivilegeForm.ensureAccountHasAllPrivilegesGrantedDescription": "{kibanaAdmin} ロールによりアカウントにすべての権限が提供されていることを確認し、再試行してください。",
     "xpack.security.management.editRole.spaceAwarePrivilegeForm.globalSpacesName": "* グローバル (すべてのスペース)",
     "xpack.security.management.editRole.spaceAwarePrivilegeForm.howToViewAllAvailableSpacesDescription": "利用可能なすべてのスペースを表示する権限がありません。",
@@ -10559,15 +10503,9 @@
     "xpack.security.management.editRole.spacePrivilegeForm.readPrivilegeDropdownDisplay": "読み込み",
     "xpack.security.management.editRole.spacePrivilegeForm.spaceSelectorFormLabel": "スペース",
     "xpack.security.management.editRole.spacePrivilegeForm.summaryOfFeaturePrivileges": "機能権限のサマリー",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.basePrivilegeText": "ベース権限",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.basePrivilegeTooltip": "基本権限は自動的にすべての機能に与えられます。",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.closeButton": "閉じる",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.featureColumnTitle": "機能",
     "xpack.security.management.editRole.spacePrivilegeMatrix.globalSpaceName": "グローバル",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.modalTitle": "権限のサマリー",
     "xpack.security.management.editRole.spacePrivilegeMatrix.showAllSpacesLink": "(すべてのスペース)",
     "xpack.security.management.editRole.spacePrivilegeMatrix.showNMoreSpacesLink": "他 {count} 件",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.showSummaryText": "権限サマリーを表示",
     "xpack.security.management.editRole.spacePrivilegeSection.addSpacePrivilegeButton": "スペース権限を追加",
     "xpack.security.management.editRole.spacePrivilegeSection.noAccessToKibanaTitle": "このロールは Kibana へのアクセスを許可しません",
     "xpack.security.management.editRole.spacePrivilegeTable.deletePrivilegesLabel": "次のスペースの権限を削除: {spaceNames}",
@@ -10594,7 +10532,6 @@
     "xpack.security.management.editRoles.indexPrivilegeForm.grantedFieldsFormRowHelpText": "フィールドが提供されていない場合、このロールのユーザーはこのインデックスのデータを表示できません。",
     "xpack.security.management.editRoles.indexPrivilegeForm.grantedFieldsFormRowLabel": "許可されたフィールド",
     "xpack.security.management.editRoles.indexPrivilegeForm.grantFieldPrivilegesLabel": "特定のフィールドへのアクセスを許可",
-    "xpack.security.management.editRolespacePrivilegeForm.cancelButton": "キャンセル",
     "xpack.security.management.editRolespacePrivilegeForm.createGlobalPrivilegeButton": "グローバル権限を作成",
     "xpack.security.management.editRolespacePrivilegeForm.createPrivilegeButton": "スペース権限を作成",
     "xpack.security.management.editRolespacePrivilegeForm.updateGlobalPrivilegeButton": "グローバル特権を更新",
diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json
index e2ee4eea2b304..41a7ee825c7ab 100644
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@@ -464,6 +464,17 @@
     "data.search.searchBar.savedQueryPopoverSavedQueryListItemDescriptionAriaLabel": "{savedQueryName} 描述",
     "data.search.searchBar.savedQueryPopoverSavedQueryListItemSelectedButtonAriaLabel": "已保存查询按钮已选择 {savedQueryName}。按下可清除任何更改。",
     "data.search.searchBar.savedQueryPopoverTitleText": "已保存查询",
+    "discover.fieldNameIcons.booleanAriaLabel": "布尔字段",
+    "discover.fieldNameIcons.conflictFieldAriaLabel": "冲突字段",
+    "discover.fieldNameIcons.dateFieldAriaLabel": "日期字段",
+    "discover.fieldNameIcons.geoPointFieldAriaLabel": "地理位置点字段",
+    "discover.fieldNameIcons.geoShapeFieldAriaLabel": "几何形状字段",
+    "discover.fieldNameIcons.ipAddressFieldAriaLabel": "IP 地址字段",
+    "discover.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 字段",
+    "discover.fieldNameIcons.numberFieldAriaLabel": "数字字段",
+    "discover.fieldNameIcons.sourceFieldAriaLabel": "源字段",
+    "discover.fieldNameIcons.stringFieldAriaLabel": "字符串字段",
+    "discover.fieldNameIcons.unknownFieldAriaLabel": "未知字段",
     "charts.colormaps.bluesText": "蓝色",
     "charts.colormaps.greensText": "绿色",
     "charts.colormaps.greenToRedText": "绿到红",
@@ -1075,17 +1086,6 @@
     "kbn.discover.fieldChooser.searchPlaceHolder": "搜索字段",
     "kbn.discover.fieldChooser.toggleFieldFilterButtonHideAriaLabel": "隐藏字段设置",
     "kbn.discover.fieldChooser.toggleFieldFilterButtonShowAriaLabel": "显示字段设置",
-    "kbn.discover.fieldNameIcons.booleanAriaLabel": "布尔字段",
-    "kbn.discover.fieldNameIcons.conflictFieldAriaLabel": "冲突字段",
-    "kbn.discover.fieldNameIcons.dateFieldAriaLabel": "日期字段",
-    "kbn.discover.fieldNameIcons.geoPointFieldAriaLabel": "地理位置点字段",
-    "kbn.discover.fieldNameIcons.geoShapeFieldAriaLabel": "几何形状字段",
-    "kbn.discover.fieldNameIcons.ipAddressFieldAriaLabel": "IP 地址字段",
-    "kbn.discover.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 字段",
-    "kbn.discover.fieldNameIcons.numberFieldAriaLabel": "数字字段",
-    "kbn.discover.fieldNameIcons.sourceFieldAriaLabel": "源字段",
-    "kbn.discover.fieldNameIcons.stringFieldAriaLabel": "字符串字段",
-    "kbn.discover.fieldNameIcons.unknownFieldAriaLabel": "未知字段",
     "kbn.discover.histogram.partialData.bucketTooltipText": "选定的时间范围不包括此整个存储桶，其可能包含部分数据。",
     "kbn.discover.histogramOfFoundDocumentsAriaLabel": "已找到文档的直方图",
     "kbn.discover.hitsPluralTitle": "{hits, plural, one {次命中} other {次命中}}",
@@ -2426,7 +2426,6 @@
     "savedObjects.saveDuplicateRejectedDescription": "已拒绝使用重复标题保存确认",
     "savedObjects.saveModal.cancelButtonLabel": "取消",
     "savedObjects.saveModal.descriptionLabel": "描述",
-    "savedObjects.saveModal.duplicateTitleDescription": "单击“{confirmSaveLabel}”可覆盖现有 {objectType}。",
     "savedObjects.saveModal.duplicateTitleLabel": "具有标题“{title}”的 {objectType} 已存在",
     "savedObjects.saveModal.saveAsNewLabel": "另存为新的 {objectType}",
     "savedObjects.saveModal.saveButtonLabel": "保存",
@@ -3861,48 +3860,6 @@
     "xpack.apm.servicesTable.transactionsPerMinuteColumnLabel": "每分钟事务数",
     "xpack.apm.servicesTable.transactionsPerMinuteUnitLabel": "tpm",
     "xpack.apm.servicesTable.UpgradeAssistantLink": "通过访问 Kibana 升级助手来了解详情",
-    "xpack.apm.settings.agentConf.allOptionLabel": "全部",
-    "xpack.apm.settings.agentConf.cancelButtonLabel": "取消",
-    "xpack.apm.settings.agentConf.configTable.appliedTooltipMessage": "已至少由一个代理应用",
-    "xpack.apm.settings.agentConf.configTable.captureBodyColumnLabel": "捕获正文",
-    "xpack.apm.settings.agentConf.configTable.configTable.failurePromptText": "无法获取代理配置列表。您的用户可能没有足够的权限。",
-    "xpack.apm.settings.agentConf.configTable.createConfigButtonLabel": "创建配置",
-    "xpack.apm.settings.agentConf.configTable.editButtonDescription": "编辑此配置",
-    "xpack.apm.settings.agentConf.configTable.editButtonLabel": "编辑",
-    "xpack.apm.settings.agentConf.configTable.emptyPromptText": "让我们改动一下！可以直接从 Kibana 微调代理配置，无需重新部署。首先创建您的第一个配置。",
-    "xpack.apm.settings.agentConf.configTable.emptyPromptTitle": "未找到任何配置。",
-    "xpack.apm.settings.agentConf.configTable.environmentColumnLabel": "服务环境",
-    "xpack.apm.settings.agentConf.configTable.lastUpdatedColumnLabel": "最后更新时间",
-    "xpack.apm.settings.agentConf.configTable.notAppliedTooltipMessage": "尚未由任何代理应用",
-    "xpack.apm.settings.agentConf.configTable.sampleRateColumnLabel": "采样速率",
-    "xpack.apm.settings.agentConf.configTable.serviceNameColumnLabel": "服务名称",
-    "xpack.apm.settings.agentConf.configTable.transactionMaxSpansColumnLabel": "事务最大跨度数",
-    "xpack.apm.settings.agentConf.configurationsPanelTitle": "代理远程配置",
-    "xpack.apm.settings.agentConf.createConfigButtonLabel": "创建配置",
-    "xpack.apm.settings.agentConf.createConfigTitle": "创建配置",
-    "xpack.apm.settings.agentConf.editConfigTitle": "编辑配置",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.buttonLabel": "删除",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigFailedText": "为“{serviceName}”删除配置时出现问题。错误：“{errorMessage}”",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigFailedTitle": "配置无法删除",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigSucceededText": "您已成功为“{serviceName}”删除配置。将需要一些时间才能传播到代理。",
-    "xpack.apm.settings.agentConf.flyout.deleteSection.deleteConfigSucceededTitle": "配置已删除",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.captureBodyInputHelpText": "有关属于 HTTP 请求的事务，代理可以选择性地捕获请求正文（例如 POST 变量）。默认为“off”。",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.captureBodyInputLabel": "捕获正文",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.captureBodyInputPlaceholderText": "选择选项",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputErrorText": "采样速率必须介于 0.000 和 1 之间",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputHelpText": "选择 0.000 和 1.0 之间的速率。默认为 1.0（100% 的跟踪）。",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputLabel": "事务采样速率",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.sampleRateConfigurationInputPlaceholderText": "设置采样速率",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.title": "选项",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputErrorText": "必须介于 0 和 32000 之间",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputHelpText": "限制每个事务记录的跨度数量。默认值为 500。",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputLabel": "事务最大跨度数",
-    "xpack.apm.settings.agentConf.flyOut.settingsSection.transactionMaxSpansConfigInputPlaceholderText": "设置事务最大跨度数",
-    "xpack.apm.settings.agentConf.saveConfig.failed.text": "编辑“{serviceName}”的配置时出现问题。错误：“{errorMessage}”",
-    "xpack.apm.settings.agentConf.saveConfig.failed.title": "配置无法编辑",
-    "xpack.apm.settings.agentConf.saveConfig.succeeded.text": "“{serviceName}”的配置已保存。将需要一些时间才能传播到代理。",
-    "xpack.apm.settings.agentConf.saveConfig.succeeded.title": "配置已保存",
-    "xpack.apm.settings.agentConf.saveConfigurationButtonLabel": "保存",
     "xpack.apm.settingsLinkLabel": "璁剧疆",
     "xpack.apm.setupInstructionsButtonLabel": "设置说明",
     "xpack.apm.stacktraceTab.localVariablesToogleButtonLabel": "本地变量",
@@ -5744,8 +5701,6 @@
     "xpack.graph.outlinkEncoders.textPlainTitle": "纯文本",
     "xpack.graph.pluginDescription": "显示并分析 Elasticsearch 数据中的相关关系。",
     "xpack.graph.savedWorkspace.workspaceNameTitle": "新建 Graph 工作空间",
-    "xpack.graph.savedWorkspaces.graphWorkspaceLabel": "Graph 工作空间",
-    "xpack.graph.savedWorkspaces.graphWorkspacesLabel": "Graph 工作空间",
     "xpack.graph.saveWorkspace.savingErrorMessage": "无法保存工作空间：{message}",
     "xpack.graph.saveWorkspace.successNotification.noDataSavedText": "配置会被保存，但不保存数据",
     "xpack.graph.saveWorkspace.successNotificationTitle": "已保存“{workspaceTitle}”",
@@ -7233,9 +7188,6 @@
     "xpack.maps.source.esGridDescription": "地理空间数据在网格中进行分组，每个网格单元格都具有指标",
     "xpack.maps.source.esGridTitle": "网格聚合",
     "xpack.maps.source.esSearch.convertToGeoJsonErrorMsg": "无法将搜索响应转换成 geoJson 功能集合，错误：{errorMsg}",
-    "xpack.maps.source.esSearch.disableFilterByMapBoundsExplainMsg": "索引“{indexPatternTitle}”具有很少数量的文档，不需要动态筛选。",
-    "xpack.maps.source.esSearch.disableFilterByMapBoundsTitle": "动态数据筛选已禁用",
-    "xpack.maps.source.esSearch.disableFilterByMapBoundsTurnOnMsg": "如果预期文档数量会增加，请打开动态筛选。",
     "xpack.maps.source.esSearch.extentFilterLabel": "在可见地图区域中动态筛留数据",
     "xpack.maps.source.esSearch.geofieldLabel": "地理空间字段",
     "xpack.maps.source.esSearch.geoFieldLabel": "地理空间字段",
@@ -10499,7 +10451,6 @@
     "xpack.security.management.editRole.elasticSearchPrivileges.runAsPrivilegesTitle": "运行身份权限",
     "xpack.security.management.editRole.featureTable.enabledRoleFeaturesEnabledColumnTitle": "权限",
     "xpack.security.management.editRole.featureTable.enabledRoleFeaturesFeatureColumnTitle": "功能",
-    "xpack.security.management.editRole.featureTable.excludedFromBasePrivilegsTooltip": "使用“定制”权限来授予权限。{featureName} 不属于基础权限。",
     "xpack.security.management.editRole.indexPrivilegeForm.deleteSpacePrivilegeAriaLabel": "删除索引权限",
     "xpack.security.management.editRole.indexPrivilegeForm.grantedDocumentsQueryFormRowLabel": "已授权文档查询",
     "xpack.security.management.editRole.indexPrivilegeForm.grantReadPrivilegesLabel": "授予特定文档的读取权限",
@@ -10529,13 +10480,6 @@
     "xpack.security.management.editRole.simplePrivilegeForm.readPrivilegeInput": "读取",
     "xpack.security.management.editRole.simplePrivilegeForm.specifyPrivilegeForRoleDescription": "为此角色指定 Kibana 权限。",
     "xpack.security.management.editRole.simplePrivilegeForm.unsupportedSpacePrivilegesWarning": "此角色包含工作区的权限定义，但在 Kibana 中未启用工作区。保存此角色将会移除这些权限。",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.effectivePrivilegeMessage": "已通过 {source} 授予。",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.globalBasePrivilegeSource": "全局基本权限",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.globalFeaturePrivilegeSource": "全局功能权限",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.privilegeSupercededMessage": "{supersededPrivilege} 的原始权限已为 {actualPrivilegeSource} 所覆盖",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.spaceBasePrivilegeSource": "工作区基本权限",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.spaceFeaturePrivilegeSource": "全局功能权限",
-    "xpack.security.management.editRole.spaceAwarePrivilegeDisplay.unknownPrivilegeSource": "**未知**",
     "xpack.security.management.editRole.spaceAwarePrivilegeForm.ensureAccountHasAllPrivilegesGrantedDescription": "请确保您的帐户具有 {kibanaAdmin} 角色授予的所有权限，然后重试。",
     "xpack.security.management.editRole.spaceAwarePrivilegeForm.globalSpacesName": "* 全局（所有工作区）",
     "xpack.security.management.editRole.spaceAwarePrivilegeForm.howToViewAllAvailableSpacesDescription": "您无权查看所有可用工作区。",
@@ -10559,15 +10503,9 @@
     "xpack.security.management.editRole.spacePrivilegeForm.readPrivilegeDropdownDisplay": "读取",
     "xpack.security.management.editRole.spacePrivilegeForm.spaceSelectorFormLabel": "工作区",
     "xpack.security.management.editRole.spacePrivilegeForm.summaryOfFeaturePrivileges": "功能权限的摘要",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.basePrivilegeText": "基本权限",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.basePrivilegeTooltip": "所有功能的基本权限将自动授予。",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.closeButton": "关闭",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.featureColumnTitle": "功能",
     "xpack.security.management.editRole.spacePrivilegeMatrix.globalSpaceName": "全局",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.modalTitle": "权限摘要",
     "xpack.security.management.editRole.spacePrivilegeMatrix.showAllSpacesLink": "（所有工作区）",
     "xpack.security.management.editRole.spacePrivilegeMatrix.showNMoreSpacesLink": "另外 {count} 个",
-    "xpack.security.management.editRole.spacePrivilegeMatrix.showSummaryText": "查看权限摘要",
     "xpack.security.management.editRole.spacePrivilegeSection.addSpacePrivilegeButton": "添加工作区权限",
     "xpack.security.management.editRole.spacePrivilegeSection.noAccessToKibanaTitle": "此角色未授予对 Kibana 的访问权限",
     "xpack.security.management.editRole.spacePrivilegeTable.deletePrivilegesLabel": "删除以下工作区的权限：{spaceNames}。",
@@ -10594,7 +10532,6 @@
     "xpack.security.management.editRoles.indexPrivilegeForm.grantedFieldsFormRowHelpText": "如果未授权任何字段，则分配到此角色的用户将无法查看此索引的任何数据。",
     "xpack.security.management.editRoles.indexPrivilegeForm.grantedFieldsFormRowLabel": "已授权字段",
     "xpack.security.management.editRoles.indexPrivilegeForm.grantFieldPrivilegesLabel": "授予对特定字段的访问权限",
-    "xpack.security.management.editRolespacePrivilegeForm.cancelButton": "取消",
     "xpack.security.management.editRolespacePrivilegeForm.createGlobalPrivilegeButton": "创建全局权限",
     "xpack.security.management.editRolespacePrivilegeForm.createPrivilegeButton": "创建工作区权限",
     "xpack.security.management.editRolespacePrivilegeForm.updateGlobalPrivilegeButton": "更新全局权限",
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.test.tsx
index 49a611167cf16..a7d479f922ed1 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.test.tsx
@@ -58,6 +58,33 @@ describe('connector validation', () => {
     });
   });
 
+  test('connector validation succeeds when connector config is valid with empty user/password', () => {
+    const actionConnector = {
+      secrets: {
+        user: null,
+        password: null,
+      },
+      id: 'test',
+      actionTypeId: '.email',
+      name: 'email',
+      config: {
+        from: 'test@test.com',
+        port: 2323,
+        host: 'localhost',
+        test: 'test',
+      },
+    } as EmailActionConnector;
+
+    expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
+      errors: {
+        from: [],
+        port: [],
+        host: [],
+        user: [],
+        password: [],
+      },
+    });
+  });
   test('connector validation fails when connector config is not valid', () => {
     const actionConnector = {
       secrets: {
@@ -82,6 +109,60 @@ describe('connector validation', () => {
       },
     });
   });
+  test('connector validation fails when user specified but not password', () => {
+    const actionConnector = {
+      secrets: {
+        user: 'user',
+        password: null,
+      },
+      id: 'test',
+      actionTypeId: '.email',
+      name: 'email',
+      config: {
+        from: 'test@test.com',
+        port: 2323,
+        host: 'localhost',
+        test: 'test',
+      },
+    } as EmailActionConnector;
+
+    expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
+      errors: {
+        from: [],
+        port: [],
+        host: [],
+        user: [],
+        password: ['Password is required when username is used.'],
+      },
+    });
+  });
+  test('connector validation fails when password specified but not user', () => {
+    const actionConnector = {
+      secrets: {
+        user: null,
+        password: 'password',
+      },
+      id: 'test',
+      actionTypeId: '.email',
+      name: 'email',
+      config: {
+        from: 'test@test.com',
+        port: 2323,
+        host: 'localhost',
+        test: 'test',
+      },
+    } as EmailActionConnector;
+
+    expect(actionTypeModel.validateConnector(actionConnector)).toEqual({
+      errors: {
+        from: [],
+        port: [],
+        host: [],
+        user: ['Username is required when password is used.'],
+        password: [],
+      },
+    });
+  });
 });
 
 describe('action params validation', () => {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.tsx
index 6c994051ec980..f17180ee74e56 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/email.tsx
@@ -97,22 +97,22 @@ export function getActionType(): ActionTypeModel {
           )
         );
       }
-      if (!action.secrets.user) {
-        errors.user.push(
+      if (action.secrets.user && !action.secrets.password) {
+        errors.password.push(
           i18n.translate(
-            'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredUserText',
+            'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredPasswordText',
             {
-              defaultMessage: 'Username is required.',
+              defaultMessage: 'Password is required when username is used.',
             }
           )
         );
       }
-      if (!action.secrets.password) {
-        errors.password.push(
+      if (!action.secrets.user && action.secrets.password) {
+        errors.user.push(
           i18n.translate(
-            'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredPasswordText',
+            'xpack.triggersActionsUI.components.builtinActionTypes.error.requiredUserText',
             {
-              defaultMessage: 'Password is required.',
+              defaultMessage: 'Username is required when password is used.',
             }
           )
         );
@@ -303,7 +303,7 @@ const EmailActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
             id="emailUser"
             fullWidth
             error={errors.user}
-            isInvalid={errors.user.length > 0 && user !== undefined}
+            isInvalid={errors.user.length > 0}
             label={i18n.translate(
               'xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.userTextFieldLabel',
               {
@@ -313,17 +313,12 @@ const EmailActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
           >
             <EuiFieldText
               fullWidth
-              isInvalid={errors.user.length > 0 && user !== undefined}
+              isInvalid={errors.user.length > 0}
               name="user"
               value={user || ''}
               data-test-subj="emailUserInput"
               onChange={e => {
-                editActionSecrets('user', e.target.value);
-              }}
-              onBlur={() => {
-                if (!user) {
-                  editActionSecrets('user', '');
-                }
+                editActionSecrets('user', nullableString(e.target.value));
               }}
             />
           </EuiFormRow>
@@ -333,7 +328,7 @@ const EmailActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
             id="emailPassword"
             fullWidth
             error={errors.password}
-            isInvalid={errors.password.length > 0 && password !== undefined}
+            isInvalid={errors.password.length > 0}
             label={i18n.translate(
               'xpack.triggersActionsUI.sections.builtinActionTypes.emailAction.passwordFieldLabel',
               {
@@ -343,17 +338,12 @@ const EmailActionConnectorFields: React.FunctionComponent<ActionConnectorFieldsP
           >
             <EuiFieldPassword
               fullWidth
-              isInvalid={errors.password.length > 0 && password !== undefined}
+              isInvalid={errors.password.length > 0}
               name="password"
               value={password || ''}
               data-test-subj="emailPasswordInput"
               onChange={e => {
-                editActionSecrets('password', e.target.value);
-              }}
-              onBlur={() => {
-                if (!password) {
-                  editActionSecrets('password', '');
-                }
+                editActionSecrets('password', nullableString(e.target.value));
               }}
             />
           </EuiFormRow>
@@ -624,3 +614,9 @@ const EmailParamsFields: React.FunctionComponent<ActionParamsProps<EmailActionPa
     </Fragment>
   );
 };
+
+// if the string == null or is empty, return null, else return string
+function nullableString(str: string | null | undefined) {
+  if (str == null || str.trim() === '') return null;
+  return str;
+}
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts
index c0ddd6791e90e..2e0576d933f90 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_action_types/types.ts
@@ -72,8 +72,8 @@ interface EmailConfig {
 }
 
 interface EmailSecrets {
-  user: string;
-  password: string;
+  user: string | null;
+  password: string | null;
 }
 
 export interface EmailActionConnector extends ActionConnector {
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts
index e5693e31c2d66..f8102189c425c 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/capabilities.ts
@@ -10,44 +10,21 @@
  * will possibly go away with https://github.com/elastic/kibana/issues/52300.
  */
 
-export function hasShowAlertsCapability(capabilities: any): boolean {
-  if (capabilities.siem && capabilities.siem['alerting:show']) {
-    return true;
-  }
-  return false;
-}
+type Capabilities = Record<string, any>;
 
-export function hasShowActionsCapability(capabilities: any): boolean {
-  if (capabilities.siem && capabilities.siem['actions:show']) {
-    return true;
-  }
-  return false;
-}
+const apps = ['apm', 'siem'];
 
-export function hasSaveAlertsCapability(capabilities: any): boolean {
-  if (capabilities.siem && capabilities.siem['alerting:save']) {
-    return true;
-  }
-  return false;
+function hasCapability(capabilities: Capabilities, capability: string) {
+  return apps.some(app => capabilities[app]?.[capability]);
 }
 
-export function hasSaveActionsCapability(capabilities: any): boolean {
-  if (capabilities.siem && capabilities.siem['actions:save']) {
-    return true;
-  }
-  return false;
+function createCapabilityCheck(capability: string) {
+  return (capabilities: Capabilities) => hasCapability(capabilities, capability);
 }
 
-export function hasDeleteAlertsCapability(capabilities: any): boolean {
-  if (capabilities.siem && capabilities.siem['alerting:delete']) {
-    return true;
-  }
-  return false;
-}
-
-export function hasDeleteActionsCapability(capabilities: any): boolean {
-  if (capabilities.siem && capabilities.siem['actions:delete']) {
-    return true;
-  }
-  return false;
-}
+export const hasShowAlertsCapability = createCapabilityCheck('alerting:show');
+export const hasShowActionsCapability = createCapabilityCheck('actions:show');
+export const hasSaveAlertsCapability = createCapabilityCheck('alerting:save');
+export const hasSaveActionsCapability = createCapabilityCheck('actions:save');
+export const hasDeleteAlertsCapability = createCapabilityCheck('alerting:delete');
+export const hasDeleteActionsCapability = createCapabilityCheck('actions:delete');
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
index f025b0396f04d..d781e8b761845 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.test.tsx
@@ -8,16 +8,8 @@ import uuid from 'uuid';
 import { shallow } from 'enzyme';
 import { AlertDetails } from './alert_details';
 import { Alert, ActionType } from '../../../../types';
-import {
-  EuiTitle,
-  EuiBadge,
-  EuiFlexItem,
-  EuiButtonEmpty,
-  EuiSwitch,
-  EuiBetaBadge,
-} from '@elastic/eui';
+import { EuiTitle, EuiBadge, EuiFlexItem, EuiSwitch, EuiBetaBadge } from '@elastic/eui';
 import { times, random } from 'lodash';
-import { FormattedMessage } from '@kbn/i18n/react';
 import { i18n } from '@kbn/i18n';
 import { ViewInApp } from './view_in_app';
 
@@ -218,31 +210,6 @@ describe('alert_details', () => {
   });
 
   describe('links', () => {
-    it('links to the Edit flyout', () => {
-      const alert = mockAlert();
-
-      const alertType = {
-        id: '.noop',
-        name: 'No Op',
-        actionGroups: [{ id: 'default', name: 'Default' }],
-        actionVariables: { context: [], state: [] },
-        defaultActionGroupId: 'default',
-      };
-
-      expect(
-        shallow(
-          <AlertDetails alert={alert} alertType={alertType} actionTypes={[]} {...mockAlertApis} />
-        ).containsMatchingElement(
-          <EuiButtonEmpty disabled={true} iconType="pencil">
-            <FormattedMessage
-              id="xpack.triggersActionsUI.sections.alertDetails.editAlertButtonLabel"
-              defaultMessage="Edit"
-            />
-          </EuiButtonEmpty>
-        )
-      ).toBeTruthy();
-    });
-
     it('links to the app that created the alert', () => {
       const alert = mockAlert();
 
@@ -260,31 +227,6 @@ describe('alert_details', () => {
         ).containsMatchingElement(<ViewInApp alert={alert} />)
       ).toBeTruthy();
     });
-
-    it('links to the activity log', () => {
-      const alert = mockAlert();
-
-      const alertType = {
-        id: '.noop',
-        name: 'No Op',
-        actionGroups: [{ id: 'default', name: 'Default' }],
-        actionVariables: { context: [], state: [] },
-        defaultActionGroupId: 'default',
-      };
-
-      expect(
-        shallow(
-          <AlertDetails alert={alert} alertType={alertType} actionTypes={[]} {...mockAlertApis} />
-        ).containsMatchingElement(
-          <EuiButtonEmpty disabled={true} iconType="menuLeft">
-            <FormattedMessage
-              id="xpack.triggersActionsUI.sections.alertDetails.activityLogButtonLabel"
-              defaultMessage="Activity Log"
-            />
-          </EuiButtonEmpty>
-        )
-      ).toBeTruthy();
-    });
   });
 });
 
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
index 49e818ebc7ee4..1f55e61e9ee0d 100644
--- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
+++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx
@@ -17,7 +17,6 @@ import {
   EuiBadge,
   EuiPage,
   EuiPageContentBody,
-  EuiButtonEmpty,
   EuiSwitch,
   EuiCallOut,
   EuiSpacer,
@@ -87,25 +86,9 @@ export const AlertDetails: React.FunctionComponent<AlertDetailsProps> = ({
             </EuiPageContentHeaderSection>
             <EuiPageContentHeaderSection>
               <EuiFlexGroup responsive={false} gutterSize="xs">
-                <EuiFlexItem grow={false}>
-                  <EuiButtonEmpty disabled={true} iconType="pencil">
-                    <FormattedMessage
-                      id="xpack.triggersActionsUI.sections.alertDetails.editAlertButtonLabel"
-                      defaultMessage="Edit"
-                    />
-                  </EuiButtonEmpty>
-                </EuiFlexItem>
                 <EuiFlexItem grow={false}>
                   <ViewInApp alert={alert} />
                 </EuiFlexItem>
-                <EuiFlexItem grow={false}>
-                  <EuiButtonEmpty disabled={true} iconType="menuLeft">
-                    <FormattedMessage
-                      id="xpack.triggersActionsUI.sections.alertDetails.activityLogButtonLabel"
-                      defaultMessage="Activity Log"
-                    />
-                  </EuiButtonEmpty>
-                </EuiFlexItem>
               </EuiFlexGroup>
             </EuiPageContentHeaderSection>
           </EuiPageContentHeader>
diff --git a/x-pack/plugins/triggers_actions_ui/public/index.ts b/x-pack/plugins/triggers_actions_ui/public/index.ts
index 342401c4778d8..96645e856e418 100644
--- a/x-pack/plugins/triggers_actions_ui/public/index.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/index.ts
@@ -23,3 +23,7 @@ export function plugin(ctx: PluginInitializerContext) {
 
 export { Plugin };
 export * from './plugin';
+
+export { TIME_UNITS } from './application/constants';
+export { getTimeUnitLabel } from './common/lib/get_time_unit_label';
+export { ForLastExpression } from './common/expression_items/for_the_last';
diff --git a/x-pack/plugins/upgrade_assistant/common/types.ts b/x-pack/plugins/upgrade_assistant/common/types.ts
index a91ae3a9e1af0..41e2314fc2a5d 100644
--- a/x-pack/plugins/upgrade_assistant/common/types.ts
+++ b/x-pack/plugins/upgrade_assistant/common/types.ts
@@ -30,7 +30,27 @@ export enum ReindexStatus {
 export const REINDEX_OP_TYPE = 'upgrade-assistant-reindex-operation';
 
 export interface QueueSettings extends SavedObjectAttributes {
+  /**
+   * A Unix timestamp of when the reindex operation was enqueued.
+   *
+   * @remark
+   * This is used by the reindexing scheduler to determine execution
+   * order.
+   */
   queuedAt: number;
+
+  /**
+   * A Unix timestamp of when the reindex operation was started.
+   *
+   * @remark
+   * Updating this field is useful for _also_ updating the saved object "updated_at" field
+   * which is used to determine stale or abandoned reindex operations.
+   *
+   * For now this is used by the reindex worker scheduler to determine whether we have
+   * A queue item at the start of the queue.
+   *
+   */
+  startedAt?: number;
 }
 
 export interface ReindexOptions extends SavedObjectAttributes {
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/error.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/error.ts
index f0b3b9146deeb..87b0ddedc69e1 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/error.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/error.ts
@@ -14,6 +14,7 @@ import {
   MultipleReindexJobsFound,
   CannotReindexSystemIndexInCurrent,
   ReindexCannotBeCancelled,
+  ReindexIsNotInQueue,
 } from './error_symbols';
 
 export class ReindexError extends Error {
@@ -34,6 +35,7 @@ export const error = {
   reindexTaskCannotBeDeleted: createErrorFactory(ReindexTaskCannotBeDeleted),
   reindexAlreadyInProgress: createErrorFactory(ReindexAlreadyInProgress),
   reindexSystemIndex: createErrorFactory(CannotReindexSystemIndexInCurrent),
+  reindexIsNotInQueue: createErrorFactory(ReindexIsNotInQueue),
   multipleReindexJobsFound: createErrorFactory(MultipleReindexJobsFound),
   reindexCannotBeCancelled: createErrorFactory(ReindexCannotBeCancelled),
 };
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/error_symbols.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/error_symbols.ts
index 0004ae8520277..f9575eacb6c7f 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/error_symbols.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/error_symbols.ts
@@ -12,6 +12,7 @@ export const ReindexTaskFailed = Symbol('ReindexTaskFailed');
 export const ReindexTaskCannotBeDeleted = Symbol('ReindexTaskCannotBeDeleted');
 export const ReindexAlreadyInProgress = Symbol('ReindexAlreadyInProgress');
 export const CannotReindexSystemIndexInCurrent = Symbol('CannotReindexSystemIndexInCurrent');
+export const ReindexIsNotInQueue = Symbol('ReindexIsNotInQueue');
 export const ReindexCannotBeCancelled = Symbol('ReindexCannotBeCancelled');
 
 export const MultipleReindexJobsFound = Symbol('MultipleReindexJobsFound');
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/op_utils.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/op_utils.ts
index dbed7de13f010..ecba02e0d5466 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/op_utils.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/op_utils.ts
@@ -50,6 +50,9 @@ const orderQueuedReindexOperations = ({
   ),
 });
 
+export const queuedOpHasStarted = (op: ReindexSavedObject) =>
+  Boolean(op.attributes.reindexOptions?.queueSettings?.startedAt);
+
 export const sortAndOrderReindexOperations = flow(
   sortReindexOperations,
   orderQueuedReindexOperations
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.ts
index 8671410f856ca..e5d054af7b1b2 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/reindex_service.ts
@@ -10,7 +10,6 @@ import { LicensingPluginSetup } from '../../../../licensing/server';
 
 import {
   IndexGroup,
-  ReindexOptions,
   ReindexSavedObject,
   ReindexStatus,
   ReindexStep,
@@ -62,7 +61,10 @@ export interface ReindexService {
    * @param indexName
    * @param opts Additional options when creating a new reindex operation
    */
-  createReindexOperation(indexName: string, opts?: ReindexOptions): Promise<ReindexSavedObject>;
+  createReindexOperation(
+    indexName: string,
+    opts?: { enqueue?: boolean }
+  ): Promise<ReindexSavedObject>;
 
   /**
    * Retrieves all reindex operations that have the given status.
@@ -77,6 +79,12 @@ export interface ReindexService {
    */
   findReindexOperation(indexName: string): Promise<ReindexSavedObject | null>;
 
+  /**
+   * Delete reindex operations for completed indices with deprecations.
+   * @param indexNames
+   */
+  cleanupReindexOperations(indexNames: string[]): Promise<void> | null;
+
   /**
    * Process the reindex operation through one step of the state machine and resolves
    * to the updated reindex operation.
@@ -95,7 +103,21 @@ export interface ReindexService {
    * @param indexName
    * @param opts As with {@link createReindexOperation} we support this setting.
    */
-  resumeReindexOperation(indexName: string, opts?: ReindexOptions): Promise<ReindexSavedObject>;
+  resumeReindexOperation(
+    indexName: string,
+    opts?: { enqueue?: boolean }
+  ): Promise<ReindexSavedObject>;
+
+  /**
+   * Update the update_at field on the reindex operation
+   *
+   * @remark
+   * Currently also sets a startedAt field on the SavedObject, not really used
+   * elsewhere, but is an indication that the object has started being processed.
+   *
+   * @param indexName
+   */
+  startQueuedReindexOperation(indexName: string): Promise<ReindexSavedObject>;
 
   /**
    * Cancel an in-progress reindex operation for a given index. Only allowed when the
@@ -564,7 +586,7 @@ export const reindexServiceFactory = (
       }
     },
 
-    async createReindexOperation(indexName: string, opts?: ReindexOptions) {
+    async createReindexOperation(indexName: string, opts?: { enqueue: boolean }) {
       if (isSystemIndex(indexName)) {
         throw error.reindexSystemIndex(
           `Reindexing system indices are not yet supported within this major version. Upgrade to the latest ${CURRENT_MAJOR_VERSION}.x minor version.`
@@ -592,7 +614,10 @@ export const reindexServiceFactory = (
         }
       }
 
-      return actions.createReindexOp(indexName, opts);
+      return actions.createReindexOp(
+        indexName,
+        opts?.enqueue ? { queueSettings: { queuedAt: Date.now() } } : undefined
+      );
     },
 
     async findReindexOperation(indexName: string) {
@@ -610,6 +635,23 @@ export const reindexServiceFactory = (
       return findResponse.saved_objects[0];
     },
 
+    async cleanupReindexOperations(indexNames: string[]) {
+      const performCleanup = async (indexName: string) => {
+        const existingReindexOps = await actions.findReindexOperations(indexName);
+
+        if (existingReindexOps && existingReindexOps.total !== 0) {
+          const existingOp = existingReindexOps.saved_objects[0];
+          if (existingOp.attributes.status === ReindexStatus.completed) {
+            // Delete the existing one if its status is completed, but still contains deprecation warnings
+            // example scenario: index was upgraded, but then deleted and restored with an old snapshot
+            await actions.deleteReindexOp(existingOp);
+          }
+        }
+      };
+
+      await Promise.all(indexNames.map(performCleanup));
+    },
+
     findAllByStatus: actions.findAllByStatus,
 
     async processNextStep(reindexOp: ReindexSavedObject) {
@@ -680,7 +722,7 @@ export const reindexServiceFactory = (
       });
     },
 
-    async resumeReindexOperation(indexName: string, opts?: ReindexOptions) {
+    async resumeReindexOperation(indexName: string, opts?: { enqueue: boolean }) {
       const reindexOp = await this.findReindexOperation(indexName);
 
       if (!reindexOp) {
@@ -694,16 +736,30 @@ export const reindexServiceFactory = (
         } else if (op.attributes.status !== ReindexStatus.paused) {
           throw new Error(`Reindex operation must be paused in order to be resumed.`);
         }
-
-        const reindexOptions: ReindexOptions | undefined = opts
-          ? {
-              ...(op.attributes.reindexOptions ?? {}),
-              ...opts,
-            }
-          : undefined;
+        const queueSettings = opts?.enqueue ? { queuedAt: Date.now() } : undefined;
 
         return actions.updateReindexOp(op, {
           status: ReindexStatus.inProgress,
+          reindexOptions: queueSettings ? { queueSettings } : undefined,
+        });
+      });
+    },
+
+    async startQueuedReindexOperation(indexName: string) {
+      const reindexOp = await this.findReindexOperation(indexName);
+
+      if (!reindexOp) {
+        throw error.indexNotFound(`No reindex operation found for index ${indexName}`);
+      }
+
+      if (!reindexOp.attributes.reindexOptions?.queueSettings) {
+        throw error.reindexIsNotInQueue(`Reindex operation ${indexName} is not in the queue.`);
+      }
+
+      return actions.runWhileLocked(reindexOp, async lockedReindexOp => {
+        const { reindexOptions } = lockedReindexOp.attributes;
+        reindexOptions!.queueSettings!.startedAt = Date.now();
+        return actions.updateReindexOp(lockedReindexOp, {
           reindexOptions,
         });
       });
diff --git a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/worker.ts b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/worker.ts
index b0311358e8f3f..06349d069a813 100644
--- a/x-pack/plugins/upgrade_assistant/server/lib/reindexing/worker.ts
+++ b/x-pack/plugins/upgrade_assistant/server/lib/reindexing/worker.ts
@@ -6,11 +6,11 @@
 import { IClusterClient, Logger, SavedObjectsClientContract, FakeRequest } from 'src/core/server';
 import moment from 'moment';
 import { ReindexSavedObject, ReindexStatus } from '../../../common/types';
-import { CredentialStore } from './credential_store';
+import { Credential, CredentialStore } from './credential_store';
 import { reindexActionsFactory } from './reindex_actions';
 import { ReindexService, reindexServiceFactory } from './reindex_service';
 import { LicensingPluginSetup } from '../../../../licensing/server';
-import { sortAndOrderReindexOperations } from './op_utils';
+import { sortAndOrderReindexOperations, queuedOpHasStarted } from './op_utils';
 
 const POLL_INTERVAL = 30000;
 // If no nodes have been able to update this index in 2 minutes (due to missing credentials), set to paused.
@@ -130,17 +130,40 @@ export class ReindexWorker {
     }
   };
 
+  private getCredentialScopedReindexService = (credential: Credential) => {
+    const fakeRequest: FakeRequest = { headers: credential };
+    const scopedClusterClient = this.clusterClient.asScoped(fakeRequest);
+    const callAsCurrentUser = scopedClusterClient.callAsCurrentUser.bind(scopedClusterClient);
+    const actions = reindexActionsFactory(this.client, callAsCurrentUser);
+    return reindexServiceFactory(
+      callAsCurrentUser,
+      actions,
+      this.log,
+      this.licensing,
+      this.apmIndexPatterns
+    );
+  };
+
   private updateInProgressOps = async () => {
     try {
       const inProgressOps = await this.reindexService.findAllByStatus(ReindexStatus.inProgress);
       const { parallel, queue } = sortAndOrderReindexOperations(inProgressOps);
 
-      const [firstOpInQueue] = queue;
+      let [firstOpInQueue] = queue;
 
-      if (firstOpInQueue) {
+      if (firstOpInQueue && !queuedOpHasStarted(firstOpInQueue)) {
         this.log.debug(
           `Queue detected; current length ${queue.length}, current item ReindexOperation(id: ${firstOpInQueue.id}, indexName: ${firstOpInQueue.attributes.indexName})`
         );
+        const credential = this.credentialStore.get(firstOpInQueue);
+        if (credential) {
+          const service = this.getCredentialScopedReindexService(credential);
+          firstOpInQueue = await service.startQueuedReindexOperation(
+            firstOpInQueue.attributes.indexName
+          );
+          // Re-associate the credentials
+          this.credentialStore.set(firstOpInQueue, credential);
+        }
       }
 
       this.inProgressOps = parallel.concat(firstOpInQueue ? [firstOpInQueue] : []);
diff --git a/x-pack/plugins/upgrade_assistant/server/routes/cluster_checkup.ts b/x-pack/plugins/upgrade_assistant/server/routes/cluster_checkup.ts
index 1a20f2f0c4071..ece8356de18c0 100644
--- a/x-pack/plugins/upgrade_assistant/server/routes/cluster_checkup.ts
+++ b/x-pack/plugins/upgrade_assistant/server/routes/cluster_checkup.ts
@@ -8,8 +8,16 @@ import { getUpgradeAssistantStatus } from '../lib/es_migration_apis';
 import { versionCheckHandlerWrapper } from '../lib/es_version_precheck';
 import { extractIndexPatterns } from '../lib/apm/extract_index_patterns';
 import { RouteDependencies } from '../types';
+import { reindexActionsFactory } from '../lib/reindexing/reindex_actions';
+import { reindexServiceFactory } from '../lib/reindexing';
 
-export function registerClusterCheckupRoutes({ cloud, router, apmOSS }: RouteDependencies) {
+export function registerClusterCheckupRoutes({
+  cloud,
+  router,
+  apmOSS,
+  licensing,
+  log,
+}: RouteDependencies) {
   const isCloudEnabled = Boolean(cloud?.isCloudEnabled);
 
   router.get(
@@ -21,6 +29,7 @@ export function registerClusterCheckupRoutes({ cloud, router, apmOSS }: RouteDep
       async (
         {
           core: {
+            savedObjects: { client: savedObjectsClient },
             elasticsearch: { dataClient },
           },
         },
@@ -30,8 +39,25 @@ export function registerClusterCheckupRoutes({ cloud, router, apmOSS }: RouteDep
         try {
           const apmConfig = await apmOSS.config$.pipe(first()).toPromise();
           const indexPatterns = extractIndexPatterns(apmConfig);
+
+          const status = await getUpgradeAssistantStatus(dataClient, isCloudEnabled, indexPatterns);
+
+          const callAsCurrentUser = dataClient.callAsCurrentUser.bind(dataClient);
+          const reindexActions = reindexActionsFactory(savedObjectsClient, callAsCurrentUser);
+          const reindexService = reindexServiceFactory(
+            callAsCurrentUser,
+            reindexActions,
+            log,
+            licensing
+          );
+          const indexNames = status.indices
+            .filter(({ index }) => typeof index !== 'undefined')
+            .map(({ index }) => index as string);
+
+          await reindexService.cleanupReindexOperations(indexNames);
+
           return response.ok({
-            body: await getUpgradeAssistantStatus(dataClient, isCloudEnabled, indexPatterns),
+            body: status,
           });
         } catch (e) {
           if (e.status === 403) {
diff --git a/x-pack/plugins/upgrade_assistant/server/routes/reindex_indices/reindex_handler.ts b/x-pack/plugins/upgrade_assistant/server/routes/reindex_indices/reindex_handler.ts
index e640d03791cce..74c349d894839 100644
--- a/x-pack/plugins/upgrade_assistant/server/routes/reindex_indices/reindex_handler.ts
+++ b/x-pack/plugins/upgrade_assistant/server/routes/reindex_indices/reindex_handler.ts
@@ -8,7 +8,7 @@ import { IScopedClusterClient, Logger, SavedObjectsClientContract } from 'kibana
 
 import { LicensingPluginSetup } from '../../../../licensing/server';
 
-import { ReindexOperation, ReindexOptions, ReindexStatus } from '../../../common/types';
+import { ReindexOperation, ReindexStatus } from '../../../common/types';
 
 import { reindexActionsFactory } from '../../lib/reindexing/reindex_actions';
 import { reindexServiceFactory } from '../../lib/reindexing';
@@ -53,17 +53,11 @@ export const reindexHandler = async ({
 
   const existingOp = await reindexService.findReindexOperation(indexName);
 
-  const opts: ReindexOptions | undefined = reindexOptions
-    ? {
-        queueSettings: reindexOptions.enqueue ? { queuedAt: Date.now() } : undefined,
-      }
-    : undefined;
-
   // If the reindexOp already exists and it's paused, resume it. Otherwise create a new one.
   const reindexOp =
     existingOp && existingOp.attributes.status === ReindexStatus.paused
-      ? await reindexService.resumeReindexOperation(indexName, opts)
-      : await reindexService.createReindexOperation(indexName, opts);
+      ? await reindexService.resumeReindexOperation(indexName, reindexOptions)
+      : await reindexService.createReindexOperation(indexName, reindexOptions);
 
   // Add users credentials for the worker to use
   credentialStore.set(reindexOp, headers);
diff --git a/x-pack/plugins/upgrade_assistant/server/routes/reindex_indices/reindex_indices.test.ts b/x-pack/plugins/upgrade_assistant/server/routes/reindex_indices/reindex_indices.test.ts
index 30beecd8a5de1..860a6a07f6f2e 100644
--- a/x-pack/plugins/upgrade_assistant/server/routes/reindex_indices/reindex_indices.test.ts
+++ b/x-pack/plugins/upgrade_assistant/server/routes/reindex_indices/reindex_indices.test.ts
@@ -263,7 +263,7 @@ describe('reindex API', () => {
 
   describe('POST /api/upgrade_assistant/reindex/batch', () => {
     const queueSettingsArg = {
-      queueSettings: { queuedAt: expect.any(Number) },
+      enqueue: true,
     };
     it('creates a collection of index operations', async () => {
       mockReindexService.createReindexOperation
diff --git a/x-pack/plugins/uptime/server/graphql/monitor_states/resolvers.ts b/x-pack/plugins/uptime/server/graphql/monitor_states/resolvers.ts
index 08973b217b96c..479c06234ca66 100644
--- a/x-pack/plugins/uptime/server/graphql/monitor_states/resolvers.ts
+++ b/x-pack/plugins/uptime/server/graphql/monitor_states/resolvers.ts
@@ -32,7 +32,7 @@ export const createMonitorStatesResolvers: CreateUMGraphQLResolvers = (
     Query: {
       async getMonitorStates(
         _resolver,
-        { dateRangeStart, dateRangeEnd, filters, pagination, statusFilter },
+        { dateRangeStart, dateRangeEnd, filters, pagination, statusFilter, pageSize },
         { APICaller, savedObjectsClient }
       ): Promise<MonitorSummaryResult> {
         const dynamicSettings = await savedObjectsAdapter.getUptimeDynamicSettings(
@@ -53,6 +53,7 @@ export const createMonitorStatesResolvers: CreateUMGraphQLResolvers = (
             dateRangeStart,
             dateRangeEnd,
             pagination: decodedPagination,
+            pageSize,
             filters,
             // this is added to make typescript happy,
             // this sort of reassignment used to be further downstream but I've moved it here
diff --git a/x-pack/plugins/uptime/server/graphql/monitor_states/schema.gql.ts b/x-pack/plugins/uptime/server/graphql/monitor_states/schema.gql.ts
index d088aed951204..6ab564fdeb532 100644
--- a/x-pack/plugins/uptime/server/graphql/monitor_states/schema.gql.ts
+++ b/x-pack/plugins/uptime/server/graphql/monitor_states/schema.gql.ts
@@ -177,6 +177,7 @@ export const monitorStatesSchema = gql`
       pagination: String
       filters: String
       statusFilter: String
+      pageSize: Int
     ): MonitorSummaryResult
   }
 `;
diff --git a/x-pack/plugins/uptime/server/kibana.index.ts b/x-pack/plugins/uptime/server/kibana.index.ts
index 19506bb316a05..da208e13acdad 100644
--- a/x-pack/plugins/uptime/server/kibana.index.ts
+++ b/x-pack/plugins/uptime/server/kibana.index.ts
@@ -32,12 +32,15 @@ export const initServerWithKibana = (server: UptimeCoreSetup, plugins: UptimeCor
   features.registerFeature({
     id: PLUGIN.ID,
     name: PLUGIN.NAME,
+    order: 1000,
     navLinkId: PLUGIN.ID,
     icon: 'uptimeApp',
     app: ['uptime', 'kibana'],
     catalogue: ['uptime'],
     privileges: {
       all: {
+        app: ['uptime', 'kibana'],
+        catalogue: ['uptime'],
         api: ['uptime-read', 'uptime-write'],
         savedObject: {
           all: [umDynamicSettings.name],
@@ -46,6 +49,8 @@ export const initServerWithKibana = (server: UptimeCoreSetup, plugins: UptimeCor
         ui: ['save', 'configureSettings', 'show'],
       },
       read: {
+        app: ['uptime', 'kibana'],
+        catalogue: ['uptime'],
         api: ['uptime-read'],
         savedObject: {
           all: [],
diff --git a/x-pack/plugins/uptime/server/lib/requests/get_monitor_states.ts b/x-pack/plugins/uptime/server/lib/requests/get_monitor_states.ts
index bfccb34ab94de..d7842d1a0b4aa 100644
--- a/x-pack/plugins/uptime/server/lib/requests/get_monitor_states.ts
+++ b/x-pack/plugins/uptime/server/lib/requests/get_monitor_states.ts
@@ -24,6 +24,7 @@ export interface GetMonitorStatesParams {
   dateRangeStart: string;
   dateRangeEnd: string;
   pagination?: CursorPagination;
+  pageSize: number;
   filters?: string | null;
   statusFilter?: string;
 }
@@ -53,12 +54,12 @@ export const getMonitorStates: UMElasticsearchQueryFn<
   dateRangeStart,
   dateRangeEnd,
   pagination,
+  pageSize,
   filters,
   statusFilter,
 }) => {
   pagination = pagination || CONTEXT_DEFAULTS.CURSOR_PAGINATION;
   statusFilter = statusFilter === null ? undefined : statusFilter;
-  const size = 10;
 
   const queryContext = new QueryContext(
     callES,
@@ -67,7 +68,7 @@ export const getMonitorStates: UMElasticsearchQueryFn<
     dateRangeEnd,
     pagination,
     filters && filters !== '' ? JSON.parse(filters) : null,
-    size,
+    pageSize,
     statusFilter
   );
 
diff --git a/x-pack/scripts/functional_tests.js b/x-pack/scripts/functional_tests.js
index 8de0cb5dcf571..63a16a3245b93 100644
--- a/x-pack/scripts/functional_tests.js
+++ b/x-pack/scripts/functional_tests.js
@@ -27,6 +27,7 @@ require('@kbn/test').runTestsCli([
   require.resolve('../test/oidc_api_integration/config'),
   require.resolve('../test/oidc_api_integration/implicit_flow.config'),
   require.resolve('../test/pki_api_integration/config'),
+  require.resolve('../test/login_selector_api_integration/config'),
   require.resolve('../test/spaces_api_integration/spaces_only/config'),
   require.resolve('../test/spaces_api_integration/security_and_spaces/config_trial'),
   require.resolve('../test/spaces_api_integration/security_and_spaces/config_basic'),
diff --git a/x-pack/test/accessibility/apps/login_page.ts b/x-pack/test/accessibility/apps/login_page.ts
index 5b18b6be9e3a4..8c673bb332d91 100644
--- a/x-pack/test/accessibility/apps/login_page.ts
+++ b/x-pack/test/accessibility/apps/login_page.ts
@@ -28,14 +28,33 @@ export default function({ getService, getPageObjects }: FtrProviderContext) {
         await PageObjects.security.forceLogout();
       });
 
-      it('meets a11y requirements', async () => {
+      it('login page meets a11y requirements', async () => {
         await PageObjects.common.navigateToApp('login');
 
         await retry.waitFor(
           'login page visible',
           async () => await testSubjects.exists('loginSubmit')
         );
+        await a11y.testAppSnapshot();
+      });
+
+      it('User can login with a11y requirements', async () => {
+        await PageObjects.security.login();
+        await a11y.testAppSnapshot();
+      });
+
+      it('Wrong credentials message meets a11y requirements', async () => {
+        await PageObjects.security.loginPage.login('wrong-user', 'wrong-password', {
+          expectSuccess: false,
+        });
+        await PageObjects.security.loginPage.getErrorMessage();
+        await a11y.testAppSnapshot();
+      });
 
+      it('Logout message acknowledges a11y requirements', async () => {
+        await PageObjects.security.login();
+        await PageObjects.security.logout();
+        await testSubjects.getVisibleText('loginInfoMessage');
         await a11y.testAppSnapshot();
       });
     });
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions/index.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions/index.ts
index acd14e8a2bf7b..019b15cc1862a 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions/index.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/actions/index.ts
@@ -57,6 +57,7 @@ export default function(kibana: any) {
         app: ['actions', 'kibana'],
         privileges: {
           all: {
+            app: ['actions', 'kibana'],
             savedObject: {
               all: ['action', 'action_task_params'],
               read: [],
@@ -65,6 +66,7 @@ export default function(kibana: any) {
             api: ['actions-read', 'actions-all'],
           },
           read: {
+            app: ['actions', 'kibana'],
             savedObject: {
               all: ['action_task_params'],
               read: ['action'],
diff --git a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/index.ts b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/index.ts
index 9b4a2d14de9ea..fe0f630830a56 100644
--- a/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/index.ts
+++ b/x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/index.ts
@@ -20,6 +20,7 @@ export default function(kibana: any) {
         app: ['alerting', 'kibana'],
         privileges: {
           all: {
+            app: ['alerting', 'kibana'],
             savedObject: {
               all: ['alert'],
               read: [],
@@ -28,6 +29,7 @@ export default function(kibana: any) {
             api: ['alerting-read', 'alerting-all'],
           },
           read: {
+            app: ['alerting', 'kibana'],
             savedObject: {
               all: [],
               read: ['alert'],
diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
index de856492e12fc..e228f6c1f81c6 100644
--- a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/builtin_action_types/email.ts
@@ -227,5 +227,61 @@ export default function emailTest({ getService }: FtrProviderContext) {
         .expect(200);
       expect(typeof createdAction.id).to.be('string');
     });
+
+    it('should handle an email action with no auth', async () => {
+      const { body: createdAction } = await supertest
+        .post('/api/action')
+        .set('kbn-xsrf', 'foo')
+        .send({
+          name: 'An email action with no auth',
+          actionTypeId: '.email',
+          config: {
+            service: '__json',
+            from: 'jim@example.com',
+          },
+        })
+        .expect(200);
+
+      await supertest
+        .post(`/api/action/${createdAction.id}/_execute`)
+        .set('kbn-xsrf', 'foo')
+        .send({
+          params: {
+            to: ['kibana-action-test@elastic.co'],
+            subject: 'email-subject',
+            message: 'email-message',
+          },
+        })
+        .expect(200)
+        .then((resp: any) => {
+          expect(resp.body.data.message.messageId).to.be.a('string');
+          expect(resp.body.data.messageId).to.be.a('string');
+
+          delete resp.body.data.message.messageId;
+          delete resp.body.data.messageId;
+
+          expect(resp.body.data).to.eql({
+            envelope: {
+              from: 'jim@example.com',
+              to: ['kibana-action-test@elastic.co'],
+            },
+            message: {
+              from: { address: 'jim@example.com', name: '' },
+              to: [
+                {
+                  address: 'kibana-action-test@elastic.co',
+                  name: '',
+                },
+              ],
+              cc: null,
+              bcc: null,
+              subject: 'email-subject',
+              html: '<p>email-message</p>\n',
+              text: 'email-message',
+              headers: {},
+            },
+          });
+        });
+    });
   });
 }
diff --git a/x-pack/test/api_integration/apis/apm/agent_configuration.ts b/x-pack/test/api_integration/apis/apm/agent_configuration.ts
index 959a0c97acfa3..8cabac523791c 100644
--- a/x-pack/test/api_integration/apis/apm/agent_configuration.ts
+++ b/x-pack/test/api_integration/apis/apm/agent_configuration.ts
@@ -5,7 +5,7 @@
  */
 
 import expect from '@kbn/expect';
-import { AgentConfigurationIntake } from '../../../../plugins/apm/server/lib/settings/agent_configuration/configuration_types';
+import { AgentConfigurationIntake } from '../../../../plugins/apm/common/agent_configuration/configuration_types';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function agentConfigurationTests({ getService }: FtrProviderContext) {
@@ -70,7 +70,7 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
     describe('when creating one configuration', () => {
       const newConfig = {
         service: {},
-        settings: { transaction_sample_rate: 0.55 },
+        settings: { transaction_sample_rate: '0.55' },
       };
 
       const searchParams = {
@@ -86,16 +86,16 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
         const { statusCode, body } = await searchConfigurations(searchParams);
         expect(statusCode).to.equal(200);
         expect(body._source.service).to.eql({});
-        expect(body._source.settings).to.eql({ transaction_sample_rate: 0.55 });
+        expect(body._source.settings).to.eql({ transaction_sample_rate: '0.55' });
       });
 
       it('can update the created config', async () => {
-        await updateConfiguration({ service: {}, settings: { transaction_sample_rate: 0.85 } });
+        await updateConfiguration({ service: {}, settings: { transaction_sample_rate: '0.85' } });
 
         const { statusCode, body } = await searchConfigurations(searchParams);
         expect(statusCode).to.equal(200);
         expect(body._source.service).to.eql({});
-        expect(body._source.settings).to.eql({ transaction_sample_rate: 0.85 });
+        expect(body._source.settings).to.eql({ transaction_sample_rate: '0.85' });
       });
 
       it('can delete the created config', async () => {
@@ -109,23 +109,23 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
       const configs = [
         {
           service: {},
-          settings: { transaction_sample_rate: 0.1 },
+          settings: { transaction_sample_rate: '0.1' },
         },
         {
           service: { name: 'my_service' },
-          settings: { transaction_sample_rate: 0.2 },
+          settings: { transaction_sample_rate: '0.2' },
         },
         {
           service: { name: 'my_service', environment: 'development' },
-          settings: { transaction_sample_rate: 0.3 },
+          settings: { transaction_sample_rate: '0.3' },
         },
         {
           service: { environment: 'production' },
-          settings: { transaction_sample_rate: 0.4 },
+          settings: { transaction_sample_rate: '0.4' },
         },
         {
           service: { environment: 'development' },
-          settings: { transaction_sample_rate: 0.5 },
+          settings: { transaction_sample_rate: '0.5' },
         },
       ];
 
@@ -140,27 +140,27 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
       const agentsRequests = [
         {
           service: { name: 'non_existing_service', environment: 'non_existing_env' },
-          expectedSettings: { transaction_sample_rate: 0.1 },
+          expectedSettings: { transaction_sample_rate: '0.1' },
         },
         {
           service: { name: 'my_service', environment: 'non_existing_env' },
-          expectedSettings: { transaction_sample_rate: 0.2 },
+          expectedSettings: { transaction_sample_rate: '0.2' },
         },
         {
           service: { name: 'my_service', environment: 'production' },
-          expectedSettings: { transaction_sample_rate: 0.2 },
+          expectedSettings: { transaction_sample_rate: '0.2' },
         },
         {
           service: { name: 'my_service', environment: 'development' },
-          expectedSettings: { transaction_sample_rate: 0.3 },
+          expectedSettings: { transaction_sample_rate: '0.3' },
         },
         {
           service: { name: 'non_existing_service', environment: 'production' },
-          expectedSettings: { transaction_sample_rate: 0.4 },
+          expectedSettings: { transaction_sample_rate: '0.4' },
         },
         {
           service: { name: 'non_existing_service', environment: 'development' },
-          expectedSettings: { transaction_sample_rate: 0.5 },
+          expectedSettings: { transaction_sample_rate: '0.5' },
         },
       ];
 
@@ -180,8 +180,9 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
     describe('when an agent retrieves a configuration', () => {
       const config = {
         service: { name: 'myservice', environment: 'development' },
-        settings: { transaction_sample_rate: 0.9 },
+        settings: { transaction_sample_rate: '0.9' },
       };
+      let etag: string;
 
       before(async () => {
         log.debug('creating agent configuration');
@@ -192,20 +193,27 @@ export default function agentConfigurationTests({ getService }: FtrProviderConte
         await deleteConfiguration(config);
       });
 
-      it(`should have 'applied_by_agent=false' on first request`, async () => {
-        const { body } = await searchConfigurations({
+      it(`should have 'applied_by_agent=false' before supplying etag`, async () => {
+        const res1 = await searchConfigurations({
           service: { name: 'myservice', environment: 'development' },
-          etag: '7312bdcc34999629a3d39df24ed9b2a7553c0c39',
         });
 
-        expect(body._source.applied_by_agent).to.be(false);
+        etag = res1.body._source.etag;
+
+        const res2 = await searchConfigurations({
+          service: { name: 'myservice', environment: 'development' },
+          etag,
+        });
+
+        expect(res1.body._source.applied_by_agent).to.be(false);
+        expect(res2.body._source.applied_by_agent).to.be(false);
       });
 
-      it(`should have 'applied_by_agent=true' on second request`, async () => {
+      it(`should have 'applied_by_agent=true' after supplying etag`, async () => {
         async function getAppliedByAgent() {
           const { body } = await searchConfigurations({
             service: { name: 'myservice', environment: 'development' },
-            etag: '7312bdcc34999629a3d39df24ed9b2a7553c0c39',
+            etag,
           });
 
           return body._source.applied_by_agent;
diff --git a/x-pack/test/api_integration/apis/apm/feature_controls.ts b/x-pack/test/api_integration/apis/apm/feature_controls.ts
index 3c5314d0d3261..afe68f21d9e39 100644
--- a/x-pack/test/api_integration/apis/apm/feature_controls.ts
+++ b/x-pack/test/api_integration/apis/apm/feature_controls.ts
@@ -244,7 +244,7 @@ export default function featureControlsTests({ getService }: FtrProviderContext)
   describe('apm feature controls', () => {
     const config = {
       service: { name: 'test-service' },
-      settings: { transaction_sample_rate: 0.5 },
+      settings: { transaction_sample_rate: '0.5' },
     };
     before(async () => {
       log.info(`Creating agent configuration`);
diff --git a/x-pack/test/api_integration/apis/endpoint/metadata.ts b/x-pack/test/api_integration/apis/endpoint/metadata.ts
index 5f18bdd9bea02..49e527fa3e7e8 100644
--- a/x-pack/test/api_integration/apis/endpoint/metadata.ts
+++ b/x-pack/test/api_integration/apis/endpoint/metadata.ts
@@ -7,9 +7,9 @@ import expect from '@kbn/expect/expect.js';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 /**
- * The number of alert documents in the es archive.
+ * The number of host documents in the es archive.
  */
-const numberOfEndpointsInFixture = 3;
+const numberOfHostsInFixture = 3;
 
 export default function({ getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
@@ -24,7 +24,7 @@ export default function({ getService }: FtrProviderContext) {
           .send()
           .expect(200);
         expect(body.total).to.eql(0);
-        expect(body.endpoints.length).to.eql(0);
+        expect(body.hosts.length).to.eql(0);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
       });
@@ -33,14 +33,14 @@ export default function({ getService }: FtrProviderContext) {
     describe('POST /api/endpoint/metadata when index is not empty', () => {
       before(() => esArchiver.load('endpoint/metadata/api_feature'));
       after(() => esArchiver.unload('endpoint/metadata/api_feature'));
-      it('metadata api should return one entry for each endpoint with default paging', async () => {
+      it('metadata api should return one entry for each host with default paging', async () => {
         const { body } = await supertest
           .post('/api/endpoint/metadata')
           .set('kbn-xsrf', 'xxx')
           .send()
           .expect(200);
-        expect(body.total).to.eql(numberOfEndpointsInFixture);
-        expect(body.endpoints.length).to.eql(numberOfEndpointsInFixture);
+        expect(body.total).to.eql(numberOfHostsInFixture);
+        expect(body.hosts.length).to.eql(numberOfHostsInFixture);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
       });
@@ -60,8 +60,8 @@ export default function({ getService }: FtrProviderContext) {
             ],
           })
           .expect(200);
-        expect(body.total).to.eql(numberOfEndpointsInFixture);
-        expect(body.endpoints.length).to.eql(1);
+        expect(body.total).to.eql(numberOfHostsInFixture);
+        expect(body.hosts.length).to.eql(1);
         expect(body.request_page_size).to.eql(1);
         expect(body.request_page_index).to.eql(1);
       });
@@ -84,8 +84,8 @@ export default function({ getService }: FtrProviderContext) {
             ],
           })
           .expect(200);
-        expect(body.total).to.eql(numberOfEndpointsInFixture);
-        expect(body.endpoints.length).to.eql(0);
+        expect(body.total).to.eql(numberOfHostsInFixture);
+        expect(body.hosts.length).to.eql(0);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(30);
       });
@@ -115,7 +115,7 @@ export default function({ getService }: FtrProviderContext) {
           .send({ filter: 'not host.ip:10.100.170.247' })
           .expect(200);
         expect(body.total).to.eql(2);
-        expect(body.endpoints.length).to.eql(2);
+        expect(body.hosts.length).to.eql(2);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
       });
@@ -139,7 +139,7 @@ export default function({ getService }: FtrProviderContext) {
           .expect(200);
         expect(body.total).to.eql(2);
         const resultIps: string[] = [].concat(
-          ...body.endpoints.map((metadata: Record<string, any>) => metadata.host.ip)
+          ...body.hosts.map((metadata: Record<string, any>) => metadata.host.ip)
         );
         expect(resultIps).to.eql([
           '10.48.181.222',
@@ -150,7 +150,7 @@ export default function({ getService }: FtrProviderContext) {
           '10.128.235.38',
         ]);
         expect(resultIps).not.include.eql(notIncludedIp);
-        expect(body.endpoints.length).to.eql(2);
+        expect(body.hosts.length).to.eql(2);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
       });
@@ -166,10 +166,10 @@ export default function({ getService }: FtrProviderContext) {
           .expect(200);
         expect(body.total).to.eql(1);
         const resultOsVariantValue: Set<string> = new Set(
-          body.endpoints.map((metadata: Record<string, any>) => metadata.host.os.variant)
+          body.hosts.map((metadata: Record<string, any>) => metadata.host.os.variant)
         );
         expect(Array.from(resultOsVariantValue)).to.eql([variantValue]);
-        expect(body.endpoints.length).to.eql(1);
+        expect(body.hosts.length).to.eql(1);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
       });
@@ -184,17 +184,17 @@ export default function({ getService }: FtrProviderContext) {
           })
           .expect(200);
         expect(body.total).to.eql(1);
-        const resultIp: string = body.endpoints[0].host.ip.filter(
+        const resultIp: string = body.hosts[0].host.ip.filter(
           (ip: string) => ip === targetEndpointIp
         );
         expect(resultIp).to.eql([targetEndpointIp]);
-        expect(body.endpoints[0].event.created).to.eql(1584044335459);
-        expect(body.endpoints.length).to.eql(1);
+        expect(body.hosts[0].event.created).to.eql(1584044335459);
+        expect(body.hosts.length).to.eql(1);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
       });
 
-      it('metadata api should return  all endpoints when filter is empty string', async () => {
+      it('metadata api should return all hosts when filter is empty string', async () => {
         const { body } = await supertest
           .post('/api/endpoint/metadata')
           .set('kbn-xsrf', 'xxx')
@@ -202,8 +202,8 @@ export default function({ getService }: FtrProviderContext) {
             filter: '',
           })
           .expect(200);
-        expect(body.total).to.eql(numberOfEndpointsInFixture);
-        expect(body.endpoints.length).to.eql(numberOfEndpointsInFixture);
+        expect(body.total).to.eql(numberOfHostsInFixture);
+        expect(body.hosts.length).to.eql(numberOfHostsInFixture);
         expect(body.request_page_size).to.eql(10);
         expect(body.request_page_index).to.eql(0);
       });
diff --git a/x-pack/test/api_integration/apis/infra/metrics_alerting.ts b/x-pack/test/api_integration/apis/infra/metrics_alerting.ts
index 09f5a498ddc00..4f17f9db67483 100644
--- a/x-pack/test/api_integration/apis/infra/metrics_alerting.ts
+++ b/x-pack/test/api_integration/apis/infra/metrics_alerting.ts
@@ -13,11 +13,13 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default function({ getService }: FtrProviderContext) {
   const client = getService('legacyEs');
   const index = 'test-index';
-  const baseParams = {
-    metric: 'test.metric',
-    timeUnit: 'm',
-    timeSize: 5,
-  };
+  const getSearchParams = (aggType: string) =>
+    ({
+      aggType,
+      timeUnit: 'm',
+      timeSize: 5,
+      ...(aggType !== 'count' ? { metric: 'test.metric' } : {}),
+    } as MetricExpressionParams);
   describe('Metrics Threshold Alerts', () => {
     before(async () => {
       await client.index({
@@ -30,10 +32,7 @@ export default function({ getService }: FtrProviderContext) {
     describe('querying the entire infrastructure', () => {
       for (const aggType of aggs) {
         it(`should work with the ${aggType} aggregator`, async () => {
-          const searchBody = getElasticsearchMetricQuery({
-            ...baseParams,
-            aggType,
-          } as MetricExpressionParams);
+          const searchBody = getElasticsearchMetricQuery(getSearchParams(aggType));
           const result = await client.search({
             index,
             body: searchBody,
@@ -44,10 +43,7 @@ export default function({ getService }: FtrProviderContext) {
       }
       it('should work with a filterQuery', async () => {
         const searchBody = getElasticsearchMetricQuery(
-          {
-            ...baseParams,
-            aggType: 'avg',
-          } as MetricExpressionParams,
+          getSearchParams('avg'),
           undefined,
           '{"bool":{"should":[{"match_phrase":{"agent.hostname":"foo"}}],"minimum_should_match":1}}'
         );
@@ -62,13 +58,7 @@ export default function({ getService }: FtrProviderContext) {
     describe('querying with a groupBy parameter', () => {
       for (const aggType of aggs) {
         it(`should work with the ${aggType} aggregator`, async () => {
-          const searchBody = getElasticsearchMetricQuery(
-            {
-              ...baseParams,
-              aggType,
-            } as MetricExpressionParams,
-            'agent.id'
-          );
+          const searchBody = getElasticsearchMetricQuery(getSearchParams(aggType), 'agent.id');
           const result = await client.search({
             index,
             body: searchBody,
@@ -79,10 +69,7 @@ export default function({ getService }: FtrProviderContext) {
       }
       it('should work with a filterQuery', async () => {
         const searchBody = getElasticsearchMetricQuery(
-          {
-            ...baseParams,
-            aggType: 'avg',
-          } as MetricExpressionParams,
+          getSearchParams('avg'),
           'agent.id',
           '{"bool":{"should":[{"match_phrase":{"agent.hostname":"foo"}}],"minimum_should_match":1}}'
         );
diff --git a/x-pack/test/api_integration/apis/security/index.js b/x-pack/test/api_integration/apis/security/index.js
index df35ec2195dc5..ad1876cb717f1 100644
--- a/x-pack/test/api_integration/apis/security/index.js
+++ b/x-pack/test/api_integration/apis/security/index.js
@@ -8,6 +8,9 @@ export default function({ loadTestFile }) {
   describe('security', function() {
     this.tags('ciGroup6');
 
+    // Updates here should be mirrored in `./security_basic.ts` if tests
+    // should also run under a basic license.
+
     loadTestFile(require.resolve('./basic_login'));
     loadTestFile(require.resolve('./builtin_es_privileges'));
     loadTestFile(require.resolve('./change_password'));
diff --git a/x-pack/test/api_integration/apis/security/privileges.ts b/x-pack/test/api_integration/apis/security/privileges.ts
index 0b29fc1cac7de..77293ddff3f9f 100644
--- a/x-pack/test/api_integration/apis/security/privileges.ts
+++ b/x-pack/test/api_integration/apis/security/privileges.ts
@@ -5,6 +5,8 @@
  */
 import util from 'util';
 import { isEqual } from 'lodash';
+import expect from '@kbn/expect/expect.js';
+import { RawKibanaPrivileges } from '../../../../plugins/security/common/model';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function({ getService }: FtrProviderContext) {
@@ -18,9 +20,9 @@ export default function({ getService }: FtrProviderContext) {
         // Roles are associated with these privileges, and we shouldn't be removing them in a minor version.
         const expected = {
           features: {
-            discover: ['all', 'read'],
-            visualize: ['all', 'read'],
-            dashboard: ['all', 'read'],
+            discover: ['all', 'read', 'minimal_all', 'minimal_read', 'url_create'],
+            visualize: ['all', 'read', 'minimal_all', 'minimal_read', 'url_create'],
+            dashboard: ['all', 'read', 'minimal_all', 'minimal_read', 'url_create'],
             dev_tools: ['all', 'read'],
             advancedSettings: ['all', 'read'],
             indexPatterns: ['all', 'read'],
@@ -48,13 +50,18 @@ export default function({ getService }: FtrProviderContext) {
           .send()
           .expect(200)
           .expect((res: any) => {
-            // when comparing privileges, the order of the privileges doesn't matter.
+            // when comparing privileges, the order of the features doesn't matter (but the order of the privileges does)
             // supertest uses assert.deepStrictEqual.
             // expect.js doesn't help us here.
             // and lodash's isEqual doesn't know how to compare Sets.
             const success = isEqual(res.body, expected, (value, other, key) => {
               if (Array.isArray(value) && Array.isArray(other)) {
-                return isEqual(value.sort(), other.sort());
+                if (key === 'reserved') {
+                  // order does not matter for the reserved privilege set.
+                  return isEqual(value.sort(), other.sort());
+                }
+                // order matters for the rest, as the UI assumes they are returned in a descending order of permissiveness.
+                return isEqual(value, other);
               }
 
               // Lodash types aren't correct, `undefined` should be supported as a return value here and it
@@ -71,5 +78,70 @@ export default function({ getService }: FtrProviderContext) {
           .expect(200);
       });
     });
+
+    describe('GET /api/security/privileges?includeActions=true', () => {
+      // The UI assumes that no wildcards are present when calculating the effective set of privileges.
+      // If this changes, then the "privilege calculators" will need revisiting to account for these wildcards.
+      it('should return a privilege map with actions which do not include wildcards', async () => {
+        await supertest
+          .get('/api/security/privileges?includeActions=true')
+          .set('kbn-xsrf', 'xxx')
+          .send()
+          .expect(200)
+          .expect((res: any) => {
+            const { features, global, space, reserved } = res.body as RawKibanaPrivileges;
+            expect(features).to.be.an('object');
+            expect(global).to.be.an('object');
+            expect(space).to.be.an('object');
+            expect(reserved).to.be.an('object');
+
+            Object.entries(features).forEach(([featureId, featurePrivs]) => {
+              Object.values(featurePrivs).forEach(actions => {
+                expect(actions).to.be.an('array');
+                actions.forEach(action => {
+                  expect(action).to.be.a('string');
+                  expect(action.indexOf('*')).to.eql(
+                    -1,
+                    `Feature ${featureId} with action ${action} cannot contain a wildcard`
+                  );
+                });
+              });
+            });
+
+            Object.entries(global).forEach(([privilegeId, actions]) => {
+              expect(actions).to.be.an('array');
+              actions.forEach(action => {
+                expect(action).to.be.a('string');
+                expect(action.indexOf('*')).to.eql(
+                  -1,
+                  `Global privilege ${privilegeId} with action ${action} cannot contain a wildcard`
+                );
+              });
+            });
+
+            Object.entries(space).forEach(([privilegeId, actions]) => {
+              expect(actions).to.be.an('array');
+              actions.forEach(action => {
+                expect(action).to.be.a('string');
+                expect(action.indexOf('*')).to.eql(
+                  -1,
+                  `Space privilege ${privilegeId} with action ${action} cannot contain a wildcard`
+                );
+              });
+            });
+
+            Object.entries(reserved).forEach(([privilegeId, actions]) => {
+              expect(actions).to.be.an('array');
+              actions.forEach(action => {
+                expect(action).to.be.a('string');
+                expect(action.indexOf('*')).to.eql(
+                  -1,
+                  `Reserved privilege ${privilegeId} with action ${action} cannot contain a wildcard`
+                );
+              });
+            });
+          });
+      });
+    });
   });
 }
diff --git a/x-pack/test/api_integration/apis/security/privileges_basic.ts b/x-pack/test/api_integration/apis/security/privileges_basic.ts
new file mode 100644
index 0000000000000..0b29fc1cac7de
--- /dev/null
+++ b/x-pack/test/api_integration/apis/security/privileges_basic.ts
@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import util from 'util';
+import { isEqual } from 'lodash';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function({ getService }: FtrProviderContext) {
+  const supertest = getService('supertest');
+
+  describe('Privileges', () => {
+    describe('GET /api/security/privileges', () => {
+      it('should return a privilege map with all known privileges, without actions', async () => {
+        // If you're adding a privilege to the following, that's great!
+        // If you're removing a privilege, this breaks backwards compatibility
+        // Roles are associated with these privileges, and we shouldn't be removing them in a minor version.
+        const expected = {
+          features: {
+            discover: ['all', 'read'],
+            visualize: ['all', 'read'],
+            dashboard: ['all', 'read'],
+            dev_tools: ['all', 'read'],
+            advancedSettings: ['all', 'read'],
+            indexPatterns: ['all', 'read'],
+            savedObjectsManagement: ['all', 'read'],
+            timelion: ['all', 'read'],
+            graph: ['all', 'read'],
+            maps: ['all', 'read'],
+            canvas: ['all', 'read'],
+            infrastructure: ['all', 'read'],
+            logs: ['all', 'read'],
+            uptime: ['all', 'read'],
+            apm: ['all', 'read'],
+            siem: ['all', 'read'],
+            endpoint: ['all', 'read'],
+            ingestManager: ['all', 'read'],
+          },
+          global: ['all', 'read'],
+          space: ['all', 'read'],
+          reserved: ['ml', 'monitoring'],
+        };
+
+        await supertest
+          .get('/api/security/privileges')
+          .set('kbn-xsrf', 'xxx')
+          .send()
+          .expect(200)
+          .expect((res: any) => {
+            // when comparing privileges, the order of the privileges doesn't matter.
+            // supertest uses assert.deepStrictEqual.
+            // expect.js doesn't help us here.
+            // and lodash's isEqual doesn't know how to compare Sets.
+            const success = isEqual(res.body, expected, (value, other, key) => {
+              if (Array.isArray(value) && Array.isArray(other)) {
+                return isEqual(value.sort(), other.sort());
+              }
+
+              // Lodash types aren't correct, `undefined` should be supported as a return value here and it
+              // has special meaning.
+              return undefined as any;
+            });
+
+            if (!success) {
+              throw new Error(
+                `Expected ${util.inspect(res.body)} to equal ${util.inspect(expected)}`
+              );
+            }
+          })
+          .expect(200);
+      });
+    });
+  });
+}
diff --git a/x-pack/test/api_integration/apis/security/security_basic.ts b/x-pack/test/api_integration/apis/security/security_basic.ts
new file mode 100644
index 0000000000000..dcbdb17724249
--- /dev/null
+++ b/x-pack/test/api_integration/apis/security/security_basic.ts
@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function({ loadTestFile }: FtrProviderContext) {
+  describe('security (basic license)', function() {
+    this.tags('ciGroup6');
+
+    // Updates here should be mirrored in `./index.js` if tests
+    // should also run under a trial/platinum license.
+
+    loadTestFile(require.resolve('./basic_login'));
+    loadTestFile(require.resolve('./builtin_es_privileges'));
+    loadTestFile(require.resolve('./change_password'));
+    loadTestFile(require.resolve('./index_fields'));
+    loadTestFile(require.resolve('./roles'));
+    loadTestFile(require.resolve('./privileges_basic'));
+    loadTestFile(require.resolve('./session'));
+  });
+}
diff --git a/x-pack/test/api_integration/apis/siem/tls.ts b/x-pack/test/api_integration/apis/siem/tls.ts
index 949ed530e9b27..8467308d709af 100644
--- a/x-pack/test/api_integration/apis/siem/tls.ts
+++ b/x-pack/test/api_integration/apis/siem/tls.ts
@@ -16,17 +16,16 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 
 const FROM = new Date('2000-01-01T00:00:00.000Z').valueOf();
 const TO = new Date('3000-01-01T00:00:00.000Z').valueOf();
-const SOURCE_IP = '157.230.208.30';
-const DESTINATION_IP = '91.189.92.20';
+const SOURCE_IP = '10.128.0.35';
+const DESTINATION_IP = '74.125.129.95';
 
 const expectedResult = {
   __typename: 'TlsNode',
-  _id: '61749734b3246f1584029deb4f5276c64da00ada',
-  alternativeNames: ['api.snapcraft.io'],
-  commonNames: ['api.snapcraft.io'],
-  issuerNames: ['DigiCert SHA2 Secure Server CA'],
-  ja3: ['839868ad711dc55bde0d37a87f14740d'],
-  notAfter: ['2019-05-22T12:00:00.000Z'],
+  _id: '16989191B1A93ECECD5FE9E63EBD4B5C3B606D26',
+  subjects: ['CN=edgecert.googleapis.com,O=Google LLC,L=Mountain View,ST=California,C=US'],
+  issuers: ['CN=GTS CA 1O1,O=Google Trust Services,C=US'],
+  ja3: [],
+  notAfter: ['2020-05-06T11:52:15.000Z'],
 };
 
 const expectedOverviewDestinationResult = {
@@ -36,27 +35,29 @@ const expectedOverviewDestinationResult = {
       __typename: 'TlsEdges',
       cursor: {
         __typename: 'CursorType',
-        value: '61749734b3246f1584029deb4f5276c64da00ada',
+        value: 'EB4E81DD7C55BA9715652ECF5647FB8877E55A8F',
       },
       node: {
         __typename: 'TlsNode',
-        _id: '61749734b3246f1584029deb4f5276c64da00ada',
-        alternativeNames: ['api.snapcraft.io'],
-        commonNames: ['api.snapcraft.io'],
-        issuerNames: ['DigiCert SHA2 Secure Server CA'],
-        ja3: ['839868ad711dc55bde0d37a87f14740d'],
-        notAfter: ['2019-05-22T12:00:00.000Z'],
+        _id: 'EB4E81DD7C55BA9715652ECF5647FB8877E55A8F',
+        subjects: [
+          'CN=*.cdn.mozilla.net,OU=Cloud Services,O=Mozilla Corporation,L=Mountain View,ST=California,C=US',
+        ],
+        issuers: ['CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US'],
+        ja3: [],
+        notAfter: ['2020-12-09T12:00:00.000Z'],
       },
     },
   ],
   pageInfo: {
     __typename: 'PageInfoPaginated',
     activePage: 0,
-    fakeTotalCount: 1,
+    fakeTotalCount: 3,
     showMorePagesIndicator: false,
   },
-  totalCount: 1,
+  totalCount: 3,
 };
+
 const expectedOverviewSourceResult = {
   __typename: 'TlsData',
   edges: [
@@ -64,26 +65,27 @@ const expectedOverviewSourceResult = {
       __typename: 'TlsEdges',
       cursor: {
         __typename: 'CursorType',
-        value: '61749734b3246f1584029deb4f5276c64da00ada',
+        value: 'EB4E81DD7C55BA9715652ECF5647FB8877E55A8F',
       },
       node: {
         __typename: 'TlsNode',
-        _id: '61749734b3246f1584029deb4f5276c64da00ada',
-        alternativeNames: ['api.snapcraft.io'],
-        commonNames: ['api.snapcraft.io'],
-        issuerNames: ['DigiCert SHA2 Secure Server CA'],
-        ja3: ['839868ad711dc55bde0d37a87f14740d'],
-        notAfter: ['2019-05-22T12:00:00.000Z'],
+        _id: 'EB4E81DD7C55BA9715652ECF5647FB8877E55A8F',
+        subjects: [
+          'CN=*.cdn.mozilla.net,OU=Cloud Services,O=Mozilla Corporation,L=Mountain View,ST=California,C=US',
+        ],
+        issuers: ['CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US'],
+        ja3: [],
+        notAfter: ['2020-12-09T12:00:00.000Z'],
       },
     },
   ],
   pageInfo: {
     __typename: 'PageInfoPaginated',
     activePage: 0,
-    fakeTotalCount: 1,
+    fakeTotalCount: 3,
     showMorePagesIndicator: false,
   },
-  totalCount: 1,
+  totalCount: 3,
 };
 
 export default function({ getService }: FtrProviderContext) {
@@ -91,8 +93,8 @@ export default function({ getService }: FtrProviderContext) {
   const client = getService('siemGraphQLClient');
   describe('Tls Test with Packetbeat', () => {
     describe('Tls Test', () => {
-      before(() => esArchiver.load('packetbeat/default'));
-      after(() => esArchiver.unload('packetbeat/default'));
+      before(() => esArchiver.load('packetbeat/tls'));
+      after(() => esArchiver.unload('packetbeat/tls'));
 
       it('Ensure data is returned for FlowTarget.Source', () => {
         return client
@@ -160,8 +162,8 @@ export default function({ getService }: FtrProviderContext) {
     });
 
     describe('Tls Overview Test', () => {
-      before(() => esArchiver.load('packetbeat/default'));
-      after(() => esArchiver.unload('packetbeat/default'));
+      before(() => esArchiver.load('packetbeat/tls'));
+      after(() => esArchiver.unload('packetbeat/tls'));
 
       it('Ensure data is returned for FlowTarget.Source', () => {
         return client
@@ -189,7 +191,8 @@ export default function({ getService }: FtrProviderContext) {
           })
           .then(resp => {
             const tls = resp.data.source.Tls;
-            expect(tls).to.eql(expectedOverviewSourceResult);
+            expect(tls.pageInfo).to.eql(expectedOverviewSourceResult.pageInfo);
+            expect(tls.edges[0]).to.eql(expectedOverviewSourceResult.edges[0]);
           });
       });
 
@@ -219,7 +222,8 @@ export default function({ getService }: FtrProviderContext) {
           })
           .then(resp => {
             const tls = resp.data.source.Tls;
-            expect(tls).to.eql(expectedOverviewDestinationResult);
+            expect(tls.pageInfo).to.eql(expectedOverviewDestinationResult.pageInfo);
+            expect(tls.edges[0]).to.eql(expectedOverviewDestinationResult.edges[0]);
           });
       });
     });
diff --git a/x-pack/test/api_integration/apis/telemetry/telemetry_optin_notice_seen.ts b/x-pack/test/api_integration/apis/telemetry/telemetry_optin_notice_seen.ts
index 582864795015c..c25ea403ce364 100644
--- a/x-pack/test/api_integration/apis/telemetry/telemetry_optin_notice_seen.ts
+++ b/x-pack/test/api_integration/apis/telemetry/telemetry_optin_notice_seen.ts
@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { Client, DeleteDocumentParams, GetParams, GetResponse } from 'elasticsearch';
-import { TelemetrySavedObjectAttributes } from '../../../../../src/legacy/core_plugins/telemetry/server/telemetry_repository';
+import { TelemetrySavedObjectAttributes } from '../../../../../src/plugins/telemetry/server/telemetry_repository';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
 export default function optInTest({ getService }: FtrProviderContext) {
diff --git a/x-pack/test/api_integration/apis/uptime/graphql/monitor_states.ts b/x-pack/test/api_integration/apis/uptime/graphql/monitor_states.ts
index 511cdb6d004fa..a293426195d23 100644
--- a/x-pack/test/api_integration/apis/uptime/graphql/monitor_states.ts
+++ b/x-pack/test/api_integration/apis/uptime/graphql/monitor_states.ts
@@ -22,6 +22,7 @@ export default function({ getService }: FtrProviderContext) {
       variables: {
         dateRangeStart,
         dateRangeEnd,
+        pageSize: 10,
         ...variables,
       },
     };
diff --git a/x-pack/test/api_integration/apis/uptime/rest/index.ts b/x-pack/test/api_integration/apis/uptime/rest/index.ts
index 712a8bc40c41c..b2236e1bb6308 100644
--- a/x-pack/test/api_integration/apis/uptime/rest/index.ts
+++ b/x-pack/test/api_integration/apis/uptime/rest/index.ts
@@ -17,15 +17,20 @@ export default function({ getService, loadTestFile }: FtrProviderContext) {
   describe('uptime REST endpoints', () => {
     beforeEach('clear settings', async () => {
       try {
-        server.savedObjects.delete({
+        await server.savedObjects.delete({
           type: settingsObjectType,
           id: settingsObjectId,
         });
       } catch (e) {
         // a 404 just means the doc is already missing
-        if (e.statuscode !== 404) {
+        if (e.response.status !== 404) {
+          const { status, statusText, data, headers, config } = e.response;
           throw new Error(
-            `error attempting to delete settings (${e.statuscode}): ${JSON.stringify(e)}`
+            `error attempting to delete settings:\n${JSON.stringify(
+              { status, statusText, data, headers, config },
+              null,
+              2
+            )}`
           );
         }
       }
diff --git a/x-pack/test/api_integration/config_security_basic.js b/x-pack/test/api_integration/config_security_basic.js
index c427bf7fa8f28..d21bfa4d7031a 100644
--- a/x-pack/test/api_integration/config_security_basic.js
+++ b/x-pack/test/api_integration/config_security_basic.js
@@ -14,7 +14,7 @@ export default async function({ readConfigFile }) {
       'xpack.license.self_generated.type=basic',
       'xpack.security.enabled=true',
     ];
-    config.testFiles = [require.resolve('./apis/security')];
+    config.testFiles = [require.resolve('./apis/security/security_basic')];
     return config;
   });
 }
diff --git a/x-pack/test/functional/apps/dashboard/feature_controls/dashboard_security.ts b/x-pack/test/functional/apps/dashboard/feature_controls/dashboard_security.ts
index b966d37becc3f..de68ec0c64c17 100644
--- a/x-pack/test/functional/apps/dashboard/feature_controls/dashboard_security.ts
+++ b/x-pack/test/functional/apps/dashboard/feature_controls/dashboard_security.ts
@@ -338,6 +338,115 @@ export default function({ getPageObjects, getService }: FtrProviderContext) {
       });
     });
 
+    describe('global dashboard read-only with url_create privileges', () => {
+      before(async () => {
+        await security.role.create('global_dashboard_read_url_create_role', {
+          elasticsearch: {
+            indices: [{ names: ['logstash-*'], privileges: ['read', 'view_index_metadata'] }],
+          },
+          kibana: [
+            {
+              feature: {
+                dashboard: ['read', 'url_create'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        });
+
+        await security.user.create('global_dashboard_read_url_create_user', {
+          password: 'global_dashboard_read_url_create_user-password',
+          roles: ['global_dashboard_read_url_create_role'],
+          full_name: 'test user',
+        });
+
+        await PageObjects.security.login(
+          'global_dashboard_read_url_create_user',
+          'global_dashboard_read_url_create_user-password',
+          {
+            expectSpaceSelector: false,
+          }
+        );
+      });
+
+      after(async () => {
+        await security.role.delete('global_dashboard_read_url_create_role');
+        await security.user.delete('global_dashboard_read_url_create_user');
+      });
+
+      it('shows dashboard navlink', async () => {
+        const navLinks = (await appsMenu.readLinks()).map(link => link.text);
+        expect(navLinks).to.eql(['Dashboard', 'Management']);
+      });
+
+      it(`landing page doesn't show "Create new Dashboard" button`, async () => {
+        await PageObjects.common.navigateToActualUrl(
+          'kibana',
+          DashboardConstants.LANDING_PAGE_PATH,
+          {
+            ensureCurrentUrl: false,
+            shouldLoginIfPrompted: false,
+          }
+        );
+        await testSubjects.existOrFail('dashboardLandingPage', { timeout: 10000 });
+        await testSubjects.missingOrFail('newItemButton');
+      });
+
+      it(`shows read-only badge`, async () => {
+        await globalNav.badgeExistsOrFail('Read only');
+      });
+
+      it(`create new dashboard redirects to the home page`, async () => {
+        await PageObjects.common.navigateToActualUrl(
+          'kibana',
+          DashboardConstants.CREATE_NEW_DASHBOARD_URL,
+          {
+            ensureCurrentUrl: false,
+            shouldLoginIfPrompted: false,
+          }
+        );
+        await testSubjects.existOrFail('homeApp', { timeout: 20000 });
+      });
+
+      it(`can view existing Dashboard`, async () => {
+        await PageObjects.common.navigateToActualUrl('kibana', createDashboardEditUrl('i-exist'), {
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+        await testSubjects.existOrFail('embeddablePanelHeading-APie', { timeout: 10000 });
+      });
+
+      it(`Permalinks shows create short-url button`, async () => {
+        await PageObjects.share.openShareMenuItem('Permalinks');
+        await PageObjects.share.createShortUrlExistOrFail();
+      });
+
+      it('allows loading a saved query via the saved query management component', async () => {
+        await savedQueryManagementComponent.loadSavedQuery('OKJpgs');
+        const queryString = await queryBar.getQueryString();
+        expect(queryString).to.eql('response:200');
+      });
+
+      it('does not allow saving via the saved query management component popover with no query loaded', async () => {
+        await savedQueryManagementComponent.saveNewQueryMissingOrFail();
+      });
+
+      it('does not allow saving changes to saved query from the saved query management component', async () => {
+        await savedQueryManagementComponent.loadSavedQuery('OKJpgs');
+        await queryBar.setQuery('response:404');
+        await savedQueryManagementComponent.updateCurrentlyLoadedQueryMissingOrFail();
+      });
+
+      it('does not allow deleting a saved query from the saved query management component', async () => {
+        await savedQueryManagementComponent.deleteSavedQueryMissingOrFail('OKJpgs');
+      });
+
+      it('allows clearing the currently loaded saved query', async () => {
+        await savedQueryManagementComponent.loadSavedQuery('OKJpgs');
+        await savedQueryManagementComponent.clearCurrentlyLoadedQuery();
+      });
+    });
+
     describe('no dashboard privileges', () => {
       before(async () => {
         await security.role.create('no_dashboard_privileges_role', {
diff --git a/x-pack/test/functional/apps/discover/feature_controls/discover_security.ts b/x-pack/test/functional/apps/discover/feature_controls/discover_security.ts
index 98ab4c1f15a54..dc8c488460100 100644
--- a/x-pack/test/functional/apps/discover/feature_controls/discover_security.ts
+++ b/x-pack/test/functional/apps/discover/feature_controls/discover_security.ts
@@ -221,6 +221,97 @@ export default function({ getPageObjects, getService }: FtrProviderContext) {
       });
     });
 
+    describe('global discover read-only privileges with url_create', () => {
+      before(async () => {
+        await security.role.create('global_discover_read_url_create_role', {
+          elasticsearch: {
+            indices: [{ names: ['logstash-*'], privileges: ['read', 'view_index_metadata'] }],
+          },
+          kibana: [
+            {
+              feature: {
+                discover: ['read', 'url_create'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        });
+
+        await security.user.create('global_discover_read_url_create_user', {
+          password: 'global_discover_read_url_create_user-password',
+          roles: ['global_discover_read_url_create_role'],
+          full_name: 'test user',
+        });
+
+        await PageObjects.security.login(
+          'global_discover_read_url_create_user',
+          'global_discover_read_url_create_user-password',
+          {
+            expectSpaceSelector: false,
+          }
+        );
+      });
+
+      after(async () => {
+        await security.user.delete('global_discover_read_url_create_user');
+        await security.role.delete('global_discover_read_url_create_role');
+      });
+
+      it('shows discover navlink', async () => {
+        const navLinks = (await appsMenu.readLinks()).map(link => link.text);
+        expect(navLinks).to.eql(['Discover', 'Management']);
+      });
+
+      it(`doesn't show save button`, async () => {
+        await PageObjects.common.navigateToApp('discover');
+        await testSubjects.existOrFail('discoverNewButton', { timeout: 10000 });
+        await testSubjects.missingOrFail('discoverSaveButton');
+      });
+
+      it(`shows read-only badge`, async () => {
+        await globalNav.badgeExistsOrFail('Read only');
+      });
+
+      it(`doesn't show visualize button`, async () => {
+        await PageObjects.common.navigateToApp('discover');
+        await setDiscoverTimeRange();
+        await PageObjects.discover.clickFieldListItem('bytes');
+        await PageObjects.discover.expectMissingFieldListItemVisualize('bytes');
+      });
+
+      it('Permalinks shows create short-url button', async () => {
+        await PageObjects.share.openShareMenuItem('Permalinks');
+        await PageObjects.share.createShortUrlExistOrFail();
+        // close the menu
+        await PageObjects.share.clickShareTopNavButton();
+      });
+
+      it('allows loading a saved query via the saved query management component', async () => {
+        await savedQueryManagementComponent.loadSavedQuery('OKJpgs');
+        const queryString = await queryBar.getQueryString();
+        expect(queryString).to.eql('response:200');
+      });
+
+      it('does not allow saving via the saved query management component popover with no query loaded', async () => {
+        await savedQueryManagementComponent.saveNewQueryMissingOrFail();
+      });
+
+      it('does not allow saving changes to saved query from the saved query management component', async () => {
+        await savedQueryManagementComponent.loadSavedQuery('OKJpgs');
+        await queryBar.setQuery('response:404');
+        await savedQueryManagementComponent.updateCurrentlyLoadedQueryMissingOrFail();
+      });
+
+      it('does not allow deleting a saved query from the saved query management component', async () => {
+        await savedQueryManagementComponent.deleteSavedQueryMissingOrFail('OKJpgs');
+      });
+
+      it('allows clearing the currently loaded saved query', async () => {
+        await savedQueryManagementComponent.loadSavedQuery('OKJpgs');
+        await savedQueryManagementComponent.clearCurrentlyLoadedQuery();
+      });
+    });
+
     describe('discover and visualize privileges', () => {
       before(async () => {
         await security.role.create('global_discover_visualize_read_role', {
diff --git a/x-pack/test/functional/apps/endpoint/feature_controls/endpoint_spaces.ts b/x-pack/test/functional/apps/endpoint/feature_controls/endpoint_spaces.ts
index 287892903dd2b..bf3d642307d8c 100644
--- a/x-pack/test/functional/apps/endpoint/feature_controls/endpoint_spaces.ts
+++ b/x-pack/test/functional/apps/endpoint/feature_controls/endpoint_spaces.ts
@@ -41,18 +41,13 @@ export default function({ getPageObjects, getService }: FtrProviderContext) {
         await testSubjects.existOrFail('welcomeTitle');
       });
 
-      it(`endpoint management shows 'Manage Endpoints'`, async () => {
-        await pageObjects.common.navigateToUrlWithBrowserHistory(
-          'endpoint',
-          '/management',
-          undefined,
-          {
-            basePath: '/s/custom_space',
-            ensureCurrentUrl: false,
-            shouldLoginIfPrompted: false,
-          }
-        );
-        await testSubjects.existOrFail('managementViewTitle');
+      it(`endpoint management shows 'Hosts'`, async () => {
+        await pageObjects.common.navigateToUrlWithBrowserHistory('endpoint', '/hosts', undefined, {
+          basePath: '/s/custom_space',
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+        await testSubjects.existOrFail('hostListTitle');
       });
     });
 
diff --git a/x-pack/test/functional/apps/endpoint/header_nav.ts b/x-pack/test/functional/apps/endpoint/header_nav.ts
index 2368ad077cf64..d1fa7311d61e8 100644
--- a/x-pack/test/functional/apps/endpoint/header_nav.ts
+++ b/x-pack/test/functional/apps/endpoint/header_nav.ts
@@ -19,19 +19,19 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
 
     it('renders the tabs when the app loads', async () => {
       const homeTabText = await testSubjects.getVisibleText('homeEndpointTab');
-      const managementTabText = await testSubjects.getVisibleText('managementEndpointTab');
+      const hostsTabText = await testSubjects.getVisibleText('hostsEndpointTab');
       const alertsTabText = await testSubjects.getVisibleText('alertsEndpointTab');
       const policiesTabText = await testSubjects.getVisibleText('policiesEndpointTab');
 
       expect(homeTabText.trim()).to.be('Home');
-      expect(managementTabText.trim()).to.be('Management');
+      expect(hostsTabText.trim()).to.be('Hosts');
       expect(alertsTabText.trim()).to.be('Alerts');
       expect(policiesTabText.trim()).to.be('Policies');
     });
 
-    it('renders the management page when the Management tab is selected', async () => {
-      await (await testSubjects.find('managementEndpointTab')).click();
-      await testSubjects.existOrFail('managementViewTitle');
+    it('renders the hosts page when the Hosts tab is selected', async () => {
+      await (await testSubjects.find('hostsEndpointTab')).click();
+      await testSubjects.existOrFail('hostListTitle');
     });
 
     it('renders the alerts page when the Alerts tab is selected', async () => {
@@ -45,8 +45,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
     });
 
     it('renders the home page when Home tab is selected after selecting another tab', async () => {
-      await (await testSubjects.find('managementEndpointTab')).click();
-      await testSubjects.existOrFail('managementViewTitle');
+      await (await testSubjects.find('hostsEndpointTab')).click();
+      await testSubjects.existOrFail('hostListTitle');
 
       await (await testSubjects.find('homeEndpointTab')).click();
       await testSubjects.existOrFail('welcomeTitle');
diff --git a/x-pack/test/functional/apps/endpoint/management.ts b/x-pack/test/functional/apps/endpoint/host_list.ts
similarity index 58%
rename from x-pack/test/functional/apps/endpoint/management.ts
rename to x-pack/test/functional/apps/endpoint/host_list.ts
index 640f6264c3a09..baace0f7670e1 100644
--- a/x-pack/test/functional/apps/endpoint/management.ts
+++ b/x-pack/test/functional/apps/endpoint/host_list.ts
@@ -12,15 +12,15 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const esArchiver = getService('esArchiver');
   const testSubjects = getService('testSubjects');
 
-  describe('Endpoint Management List', function() {
+  describe('host list', function() {
     this.tags('ciGroup7');
     before(async () => {
       await esArchiver.load('endpoint/metadata/api_feature');
-      await pageObjects.common.navigateToUrlWithBrowserHistory('endpoint', '/management');
+      await pageObjects.common.navigateToUrlWithBrowserHistory('endpoint', '/hosts');
     });
 
     it('finds title', async () => {
-      const title = await testSubjects.getVisibleText('managementViewTitle');
+      const title = await testSubjects.getVisibleText('hostListTitle');
       expect(title).to.equal('Hosts');
     });
 
@@ -67,21 +67,70 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
           'xxxx',
         ],
       ];
-      const tableData = await pageObjects.endpoint.getEndpointAppTableData('managementListTable');
+      const tableData = await pageObjects.endpoint.getEndpointAppTableData('hostListTable');
       expect(tableData).to.eql(expectedData);
     });
 
-    it('displays no items found', async () => {
+    it('display details flyout when the hostname is clicked on', async () => {
+      await (await testSubjects.find('hostnameCellLink')).click();
+      await testSubjects.existOrFail('hostDetailsUpperList');
+      await testSubjects.existOrFail('hostDetailsLowerList');
+    });
+
+    it('displays no items found when empty', async () => {
       // clear out the data and reload the page
       await esArchiver.unload('endpoint/metadata/api_feature');
-      await pageObjects.common.navigateToUrlWithBrowserHistory('endpoint', '/management');
+      await pageObjects.common.navigateToUrlWithBrowserHistory('endpoint', '/hosts');
       // get the table data and verify no entries appear
-      const tableData = await pageObjects.endpoint.getEndpointAppTableData('managementListTable');
+      const tableData = await pageObjects.endpoint.getEndpointAppTableData('hostListTable');
       expect(tableData[1][0]).to.equal('No items found');
       // reload the data so the other tests continue to pass
       await esArchiver.load('endpoint/metadata/api_feature');
     });
 
+    describe('has a url with a host id', () => {
+      before(async () => {
+        await pageObjects.common.navigateToUrlWithBrowserHistory(
+          'endpoint',
+          '/hosts',
+          'selected_host=cbe80003-6964-4e0f-aba1-f94c32b44e95'
+        );
+      });
+
+      it('shows a flyout', async () => {
+        await testSubjects.existOrFail('hostDetailsFlyout');
+      });
+
+      it('displays details row headers', async () => {
+        const expectedData = [
+          'OS',
+          'Last Seen',
+          'Alerts',
+          'Policy',
+          'Policy Status',
+          'IP Address',
+          'Hostname',
+          'Sensor Version',
+        ];
+        const keys = await pageObjects.endpoint.hostFlyoutDescriptionKeys('hostDetailsFlyout');
+        expect(keys).to.eql(expectedData);
+      });
+
+      it('displays details row descriptions', async () => {
+        const values = await pageObjects.endpoint.hostFlyoutDescriptionValues('hostDetailsFlyout');
+
+        expect(values).to.eql([
+          'Windows Server 2012',
+          '',
+          '0',
+          'C2A9093E-E289-4C0A-AA44-8C32A414FA7A',
+          'active',
+          '10.48.181.22210.116.62.6210.102.83.30',
+          'Host-cxz5glsoup',
+          '6.6.9',
+        ]);
+      });
+    });
     after(async () => {
       await esArchiver.unload('endpoint/metadata/api_feature');
     });
diff --git a/x-pack/test/functional/apps/endpoint/index.ts b/x-pack/test/functional/apps/endpoint/index.ts
index 15ce522ce56ba..4d55b3af4956e 100644
--- a/x-pack/test/functional/apps/endpoint/index.ts
+++ b/x-pack/test/functional/apps/endpoint/index.ts
@@ -12,7 +12,7 @@ export default function({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./feature_controls'));
     loadTestFile(require.resolve('./landing_page'));
     loadTestFile(require.resolve('./header_nav'));
-    loadTestFile(require.resolve('./management'));
+    loadTestFile(require.resolve('./host_list'));
     loadTestFile(require.resolve('./policy_list'));
     loadTestFile(require.resolve('./policy_details'));
     loadTestFile(require.resolve('./alerts'));
diff --git a/x-pack/test/functional/apps/endpoint/policy_details.ts b/x-pack/test/functional/apps/endpoint/policy_details.ts
index 39b6e7a9f4fb7..f251dcd93014e 100644
--- a/x-pack/test/functional/apps/endpoint/policy_details.ts
+++ b/x-pack/test/functional/apps/endpoint/policy_details.ts
@@ -10,7 +10,8 @@ export default function({ getPageObjects, getService }: FtrProviderContext) {
   const pageObjects = getPageObjects(['common', 'endpoint']);
   const testSubjects = getService('testSubjects');
 
-  describe('Endpoint Policy Details', function() {
+  // Skipped until we can figure out how to load data for Ingest
+  describe.skip('Endpoint Policy Details', function() {
     this.tags(['ciGroup7']);
 
     it('loads the Policy Details Page', async () => {
diff --git a/x-pack/test/functional/apps/endpoint/policy_list.ts b/x-pack/test/functional/apps/endpoint/policy_list.ts
index 382963bc2b0c7..c54eafdd8b787 100644
--- a/x-pack/test/functional/apps/endpoint/policy_list.ts
+++ b/x-pack/test/functional/apps/endpoint/policy_list.ts
@@ -10,8 +10,8 @@ export default function({ getPageObjects, getService }: FtrProviderContext) {
   const pageObjects = getPageObjects(['common', 'endpoint']);
   const testSubjects = getService('testSubjects');
 
-  // FLAKY: https://github.com/elastic/kibana/issues/57946
-  describe('Endpoint Policy List', function() {
+  // FIXME: Skipped until we can figure out how to load data for Ingest
+  describe.skip('Endpoint Policy List', function() {
     this.tags(['ciGroup7']);
     before(async () => {
       await pageObjects.common.navigateToUrlWithBrowserHistory('endpoint', '/policy');
diff --git a/x-pack/test/functional/apps/machine_learning/data_frame_analytics/classification_creation.ts b/x-pack/test/functional/apps/machine_learning/data_frame_analytics/classification_creation.ts
index 1bcdeef394c00..a7c92cac2072f 100644
--- a/x-pack/test/functional/apps/machine_learning/data_frame_analytics/classification_creation.ts
+++ b/x-pack/test/functional/apps/machine_learning/data_frame_analytics/classification_creation.ts
@@ -111,7 +111,7 @@ export default function({ getService }: FtrProviderContext) {
 
         it('creates the analytics job', async () => {
           await ml.dataFrameAnalyticsCreation.assertCreateButtonExists();
-          await ml.dataFrameAnalyticsCreation.createAnalyticsJob();
+          await ml.dataFrameAnalyticsCreation.createAnalyticsJob(testData.jobId);
         });
 
         it('starts the analytics job', async () => {
diff --git a/x-pack/test/functional/apps/machine_learning/data_frame_analytics/cloning.ts b/x-pack/test/functional/apps/machine_learning/data_frame_analytics/cloning.ts
index 51155fccc358d..caf382b532273 100644
--- a/x-pack/test/functional/apps/machine_learning/data_frame_analytics/cloning.ts
+++ b/x-pack/test/functional/apps/machine_learning/data_frame_analytics/cloning.ts
@@ -13,8 +13,7 @@ export default function({ getService }: FtrProviderContext) {
   const esArchiver = getService('esArchiver');
   const ml = getService('ml');
 
-  // failing test, see https://github.com/elastic/kibana/issues/60389
-  describe.skip('jobs cloning supported by UI form', function() {
+  describe('jobs cloning supported by UI form', function() {
     this.tags(['smoke']);
 
     const testDataList: Array<{
@@ -173,7 +172,7 @@ export default function({ getService }: FtrProviderContext) {
         });
 
         it('should create a clone job', async () => {
-          await ml.dataFrameAnalyticsCreation.createAnalyticsJob();
+          await ml.dataFrameAnalyticsCreation.createAnalyticsJob(cloneJobId);
         });
 
         it('should start the clone analytics job', async () => {
@@ -186,6 +185,10 @@ export default function({ getService }: FtrProviderContext) {
           await ml.dataFrameAnalyticsCreation.closeCreateAnalyticsJobFlyout();
         });
 
+        it('finishes analytics processing', async () => {
+          await ml.dataFrameAnalytics.waitForAnalyticsCompletion(cloneJobId);
+        });
+
         it('displays the created job in the analytics table', async () => {
           await ml.dataFrameAnalyticsTable.refreshAnalyticsTable();
           await ml.dataFrameAnalyticsTable.filterWithSearchString(cloneJobId);
diff --git a/x-pack/test/functional/apps/machine_learning/data_frame_analytics/outlier_detection_creation.ts b/x-pack/test/functional/apps/machine_learning/data_frame_analytics/outlier_detection_creation.ts
index 173430706f7e7..5481977351d8b 100644
--- a/x-pack/test/functional/apps/machine_learning/data_frame_analytics/outlier_detection_creation.ts
+++ b/x-pack/test/functional/apps/machine_learning/data_frame_analytics/outlier_detection_creation.ts
@@ -107,7 +107,7 @@ export default function({ getService }: FtrProviderContext) {
 
         it('creates the analytics job', async () => {
           await ml.dataFrameAnalyticsCreation.assertCreateButtonExists();
-          await ml.dataFrameAnalyticsCreation.createAnalyticsJob();
+          await ml.dataFrameAnalyticsCreation.createAnalyticsJob(testData.jobId);
         });
 
         it('starts the analytics job', async () => {
diff --git a/x-pack/test/functional/apps/machine_learning/data_frame_analytics/regression_creation.ts b/x-pack/test/functional/apps/machine_learning/data_frame_analytics/regression_creation.ts
index 3bc524a88f787..aa1a133c81187 100644
--- a/x-pack/test/functional/apps/machine_learning/data_frame_analytics/regression_creation.ts
+++ b/x-pack/test/functional/apps/machine_learning/data_frame_analytics/regression_creation.ts
@@ -111,7 +111,7 @@ export default function({ getService }: FtrProviderContext) {
 
         it('creates the analytics job', async () => {
           await ml.dataFrameAnalyticsCreation.assertCreateButtonExists();
-          await ml.dataFrameAnalyticsCreation.createAnalyticsJob();
+          await ml.dataFrameAnalyticsCreation.createAnalyticsJob(testData.jobId);
         });
 
         it('starts the analytics job', async () => {
diff --git a/x-pack/test/functional/apps/maps/es_pew_pew_source.js b/x-pack/test/functional/apps/maps/es_pew_pew_source.js
new file mode 100644
index 0000000000000..45ae1c69640cf
--- /dev/null
+++ b/x-pack/test/functional/apps/maps/es_pew_pew_source.js
@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+
+export default function({ getPageObjects, getService }) {
+  const PageObjects = getPageObjects(['maps']);
+  const inspector = getService('inspector');
+
+  const VECTOR_SOURCE_ID = '67c1de2c-2fc5-4425-8983-094b589afe61';
+
+  describe('point to point source', () => {
+    before(async () => {
+      await PageObjects.maps.loadSavedMap('pew pew demo');
+    });
+
+    it('should request source clusters for destination locations', async () => {
+      await inspector.open();
+      await inspector.openInspectorRequestsView();
+      const requestStats = await inspector.getTableData();
+      const hits = PageObjects.maps.getInspectorStatRowHit(requestStats, 'Hits');
+      const totalHits = PageObjects.maps.getInspectorStatRowHit(requestStats, 'Hits (total)');
+      await inspector.close();
+
+      expect(hits).to.equal('0');
+      expect(totalHits).to.equal('4');
+    });
+
+    it('should render lines', async () => {
+      const mapboxStyle = await PageObjects.maps.getMapboxStyle();
+      const features = mapboxStyle.sources[VECTOR_SOURCE_ID].data.features;
+      expect(features.length).to.equal(2);
+      expect(features[0].geometry.type).to.equal('LineString');
+    });
+  });
+}
diff --git a/x-pack/test/functional/apps/maps/index.js b/x-pack/test/functional/apps/maps/index.js
index ae7de986cf867..58c211724b287 100644
--- a/x-pack/test/functional/apps/maps/index.js
+++ b/x-pack/test/functional/apps/maps/index.js
@@ -41,6 +41,7 @@ export default function({ loadTestFile, getService }) {
     describe('', function() {
       this.tags('ciGroup10');
       loadTestFile(require.resolve('./es_geo_grid_source'));
+      loadTestFile(require.resolve('./es_pew_pew_source'));
       loadTestFile(require.resolve('./joins'));
       loadTestFile(require.resolve('./add_layer_panel'));
       loadTestFile(require.resolve('./import_geojson'));
diff --git a/x-pack/test/functional/apps/transform/creation_index_pattern.ts b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
index 4d1300ffaad06..ae3617db9e517 100644
--- a/x-pack/test/functional/apps/transform/creation_index_pattern.ts
+++ b/x-pack/test/functional/apps/transform/creation_index_pattern.ts
@@ -94,6 +94,60 @@ export default function({ getService }: FtrProviderContext) {
           },
         },
       },
+      {
+        suiteTitle: 'batch transform with terms group and percentiles agg',
+        source: 'ecommerce',
+        groupByEntries: [
+          {
+            identifier: 'terms(geoip.country_iso_code)',
+            label: 'geoip.country_iso_code',
+          } as GroupByEntry,
+        ],
+        aggregationEntries: [
+          {
+            identifier: 'percentiles(products.base_price)',
+            label: 'products.base_price.percentiles',
+          },
+        ],
+        transformId: `ec_2_${Date.now()}`,
+        transformDescription:
+          'ecommerce batch transform with group by terms(geoip.country_iso_code) and aggregation percentiles(products.base_price)',
+        get destinationIndex(): string {
+          return `user-${this.transformId}`;
+        },
+        expected: {
+          pivotAdvancedEditorValue: {
+            group_by: {
+              'geoip.country_iso_code': {
+                terms: {
+                  field: 'geoip.country_iso_code',
+                },
+              },
+            },
+            aggregations: {
+              'products.base_price.percentiles': {
+                percentiles: {
+                  field: 'products.base_price',
+                  percents: [1, 5, 25, 50, 75, 95, 99],
+                },
+              },
+            },
+          },
+          pivotPreview: {
+            column: 0,
+            values: ['AE', 'CO', 'EG', 'FR', 'GB'],
+          },
+          row: {
+            status: 'stopped',
+            mode: 'batch',
+            progress: '100',
+          },
+          sourcePreview: {
+            columns: 45,
+            rows: 5,
+          },
+        },
+      },
     ];
 
     for (const testData of testDataList) {
diff --git a/x-pack/test/functional/apps/uptime/locations.ts b/x-pack/test/functional/apps/uptime/locations.ts
index 7f6932ab50319..96c7fad89a85d 100644
--- a/x-pack/test/functional/apps/uptime/locations.ts
+++ b/x-pack/test/functional/apps/uptime/locations.ts
@@ -10,7 +10,7 @@ import { FtrProviderContext } from '../../ftr_provider_context';
 export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const pageObjects = getPageObjects(['uptime']);
 
-  describe('location', () => {
+  describe.skip('location', () => {
     const start = new Date().toISOString();
     const end = new Date().toISOString();
 
diff --git a/x-pack/test/functional/apps/uptime/overview.ts b/x-pack/test/functional/apps/uptime/overview.ts
index 9a879032fadc1..f3b587b9bc1e2 100644
--- a/x-pack/test/functional/apps/uptime/overview.ts
+++ b/x-pack/test/functional/apps/uptime/overview.ts
@@ -65,10 +65,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         '0018-up',
         '0019-up',
       ]);
-      await retry.tryForTime(12000, async () => {
-        // there should now be pagination data in the URL
-        await pageObjects.uptime.pageUrlContains('pagination');
-      });
+      // there should now be pagination data in the URL
+      await pageObjects.uptime.pageUrlContains('pagination');
       await pageObjects.uptime.setStatusFilter('up');
       await pageObjects.uptime.pageHasExpectedIds([
         '0000-intermittent',
@@ -82,10 +80,86 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
         '0008-up',
         '0009-up',
       ]);
-      await retry.tryForTime(12000, async () => {
-        // ensure that pagination is removed from the URL
-        await pageObjects.uptime.pageUrlContains('pagination', false);
-      });
+      // ensure that pagination is removed from the URL
+      await pageObjects.uptime.pageUrlContains('pagination', false);
+    });
+
+    it('clears pagination parameters when size changes', async () => {
+      await pageObjects.uptime.goToUptimePageAndSetDateRange(DEFAULT_DATE_START, DEFAULT_DATE_END);
+      await pageObjects.uptime.changePage('next');
+      await pageObjects.uptime.pageUrlContains('pagination');
+      await pageObjects.uptime.setMonitorListPageSize(50);
+      // the pagination parameter should be cleared after a size change
+      await pageObjects.uptime.pageUrlContains('pagination', false);
+    });
+
+    it('pagination size updates to reflect current selection', async () => {
+      await pageObjects.uptime.goToUptimePageAndSetDateRange(DEFAULT_DATE_START, DEFAULT_DATE_END);
+      await pageObjects.uptime.pageHasExpectedIds([
+        '0000-intermittent',
+        '0001-up',
+        '0002-up',
+        '0003-up',
+        '0004-up',
+        '0005-up',
+        '0006-up',
+        '0007-up',
+        '0008-up',
+        '0009-up',
+      ]);
+      await pageObjects.uptime.setMonitorListPageSize(50);
+      await pageObjects.uptime.pageHasExpectedIds([
+        '0000-intermittent',
+        '0001-up',
+        '0002-up',
+        '0003-up',
+        '0004-up',
+        '0005-up',
+        '0006-up',
+        '0007-up',
+        '0008-up',
+        '0009-up',
+        '0010-down',
+        '0011-up',
+        '0012-up',
+        '0013-up',
+        '0014-up',
+        '0015-intermittent',
+        '0016-up',
+        '0017-up',
+        '0018-up',
+        '0019-up',
+        '0020-down',
+        '0021-up',
+        '0022-up',
+        '0023-up',
+        '0024-up',
+        '0025-up',
+        '0026-up',
+        '0027-up',
+        '0028-up',
+        '0029-up',
+        '0030-intermittent',
+        '0031-up',
+        '0032-up',
+        '0033-up',
+        '0034-up',
+        '0035-up',
+        '0036-up',
+        '0037-up',
+        '0038-up',
+        '0039-up',
+        '0040-down',
+        '0041-up',
+        '0042-up',
+        '0043-up',
+        '0044-up',
+        '0045-intermittent',
+        '0046-up',
+        '0047-up',
+        '0048-up',
+        '0049-up',
+      ]);
     });
 
     describe('snapshot counts', () => {
diff --git a/x-pack/test/functional/apps/uptime/settings.ts b/x-pack/test/functional/apps/uptime/settings.ts
index 0e804dd161c6b..aafb145a1b9b0 100644
--- a/x-pack/test/functional/apps/uptime/settings.ts
+++ b/x-pack/test/functional/apps/uptime/settings.ts
@@ -16,7 +16,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
   const pageObjects = getPageObjects(['uptime']);
   const es = getService('es');
 
-  describe('uptime settings page', () => {
+  // Flaky https://github.com/elastic/kibana/issues/60866
+  describe.skip('uptime settings page', () => {
     const settingsPage = () => pageObjects.uptime.settings;
     beforeEach('navigate to clean app root', async () => {
       // make 10 checks
diff --git a/x-pack/test/functional/apps/visualize/feature_controls/visualize_security.ts b/x-pack/test/functional/apps/visualize/feature_controls/visualize_security.ts
index e5b6512d1c1b0..9f080a056e91f 100644
--- a/x-pack/test/functional/apps/visualize/feature_controls/visualize_security.ts
+++ b/x-pack/test/functional/apps/visualize/feature_controls/visualize_security.ts
@@ -276,6 +276,113 @@ export default function({ getPageObjects, getService }: FtrProviderContext) {
       });
     });
 
+    describe('global visualize read-only with url_create privileges', () => {
+      before(async () => {
+        await security.role.create('global_visualize_read_url_create_role', {
+          elasticsearch: {
+            indices: [{ names: ['logstash-*'], privileges: ['read', 'view_index_metadata'] }],
+          },
+          kibana: [
+            {
+              feature: {
+                visualize: ['read', 'url_create'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        });
+
+        await security.user.create('global_visualize_read_url_create_user', {
+          password: 'global_visualize_read_url_create_user-password',
+          roles: ['global_visualize_read_url_create_role'],
+          full_name: 'test user',
+        });
+
+        await PageObjects.security.login(
+          'global_visualize_read_url_create_user',
+          'global_visualize_read_url_create_user-password',
+          {
+            expectSpaceSelector: false,
+          }
+        );
+      });
+
+      after(async () => {
+        await PageObjects.security.forceLogout();
+        await security.role.delete('global_visualize_read_url_create_role');
+        await security.user.delete('global_visualize_read_url_create_user');
+      });
+
+      it('shows visualize navlink', async () => {
+        const navLinks = (await appsMenu.readLinks()).map(link => link.text);
+        expect(navLinks).to.eql(['Visualize', 'Management']);
+      });
+
+      it(`landing page shows "Create new Visualization" button`, async () => {
+        await PageObjects.visualize.gotoVisualizationLandingPage();
+        await testSubjects.existOrFail('visualizeLandingPage', { timeout: 10000 });
+        await testSubjects.existOrFail('newItemButton');
+      });
+
+      it(`shows read-only badge`, async () => {
+        await globalNav.badgeExistsOrFail('Read only');
+      });
+
+      it(`can view existing Visualization`, async () => {
+        await PageObjects.common.navigateToActualUrl('visualize', '/visualize/edit/i-exist', {
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+        await testSubjects.existOrFail('visualizationLoader', { timeout: 10000 });
+      });
+
+      it(`can't save existing Visualization`, async () => {
+        await PageObjects.common.navigateToActualUrl('visualize', '/visualize/edit/i-exist', {
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+        await testSubjects.existOrFail('shareTopNavButton', { timeout: 10000 });
+        await testSubjects.missingOrFail('visualizeSaveButton', { timeout: 10000 });
+      });
+
+      it('Embed code shows create short-url button', async () => {
+        await PageObjects.share.openShareMenuItem('Embedcode');
+        await PageObjects.share.createShortUrlExistOrFail();
+      });
+
+      it('Permalinks shows create short-url button', async () => {
+        await PageObjects.share.openShareMenuItem('Permalinks');
+        await PageObjects.share.createShortUrlExistOrFail();
+        // close menu
+        await PageObjects.share.clickShareTopNavButton();
+      });
+
+      it('allows loading a saved query via the saved query management component', async () => {
+        await savedQueryManagementComponent.loadSavedQuery('OKJpgs');
+        const queryString = await queryBar.getQueryString();
+        expect(queryString).to.eql('response:200');
+      });
+
+      it('does not allow saving via the saved query management component popover with no query loaded', async () => {
+        await savedQueryManagementComponent.saveNewQueryMissingOrFail();
+      });
+
+      it('does not allow saving changes to saved query from the saved query management component', async () => {
+        await savedQueryManagementComponent.loadSavedQuery('OKJpgs');
+        await queryBar.setQuery('response:404');
+        await savedQueryManagementComponent.updateCurrentlyLoadedQueryMissingOrFail();
+      });
+
+      it('does not allow deleting a saved query from the saved query management component', async () => {
+        await savedQueryManagementComponent.deleteSavedQueryMissingOrFail('OKJpgs');
+      });
+
+      it('allows clearing the currently loaded saved query', async () => {
+        await savedQueryManagementComponent.loadSavedQuery('OKJpgs');
+        await savedQueryManagementComponent.clearCurrentlyLoadedQuery();
+      });
+    });
+
     describe('no visualize privileges', () => {
       before(async () => {
         await security.role.create('no_visualize_privileges_role', {
diff --git a/x-pack/test/functional/apps/visualize/index.ts b/x-pack/test/functional/apps/visualize/index.ts
index 264e2e807f0fb..60b5a0af52928 100644
--- a/x-pack/test/functional/apps/visualize/index.ts
+++ b/x-pack/test/functional/apps/visualize/index.ts
@@ -13,5 +13,6 @@ export default function visualize({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./feature_controls/visualize_security'));
     loadTestFile(require.resolve('./feature_controls/visualize_spaces'));
     loadTestFile(require.resolve('./hybrid_visualization'));
+    loadTestFile(require.resolve('./precalculated_histogram'));
   });
 }
diff --git a/x-pack/test/functional/apps/visualize/precalculated_histogram.ts b/x-pack/test/functional/apps/visualize/precalculated_histogram.ts
new file mode 100644
index 0000000000000..5d362d29b640c
--- /dev/null
+++ b/x-pack/test/functional/apps/visualize/precalculated_histogram.ts
@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function({ getService, getPageObjects }: FtrProviderContext) {
+  const esArchiver = getService('esArchiver');
+  const PageObjects = getPageObjects(['common', 'visualize', 'discover', 'visChart', 'visEditor']);
+  const kibanaServer = getService('kibanaServer');
+  const log = getService('log');
+
+  describe('pre_calculated_histogram', function() {
+    before(async function() {
+      log.debug('Starting pre_calculated_histogram before method');
+      await esArchiver.load('pre_calculated_histogram');
+      await kibanaServer.uiSettings.replace({ defaultIndex: 'test-histogram' });
+    });
+
+    after(function() {
+      return esArchiver.unload('pre_calculated_histogram');
+    });
+
+    const initHistogramBarChart = async () => {
+      await PageObjects.visualize.navigateToNewVisualization();
+      await PageObjects.visualize.clickVerticalBarChart();
+      await PageObjects.visualize.clickNewSearch('histogram-test');
+      await PageObjects.visChart.waitForVisualization();
+    };
+
+    const getFieldOptionsForAggregation = async (aggregation: string): Promise<string[]> => {
+      await PageObjects.visEditor.clickBucket('Y-axis', 'metrics');
+      await PageObjects.visEditor.selectAggregation(aggregation, 'metrics');
+      const fieldValues = await PageObjects.visEditor.getField();
+      return fieldValues;
+    };
+
+    it('appears correctly in discover', async function() {
+      await PageObjects.common.navigateToApp('discover');
+      const rowData = await PageObjects.discover.getDocTableIndex(1);
+      expect(rowData.includes('"values": [ 0.3, 1, 3, 4.2, 4.8 ]')).to.be.ok();
+    });
+
+    it('appears in the field options of a Percentiles aggregation', async function() {
+      await initHistogramBarChart();
+      const fieldValues: string[] = await getFieldOptionsForAggregation('Percentiles');
+      log.debug('Percentiles Fields = ' + fieldValues);
+      expect(fieldValues[0]).to.be('histogram-content');
+    });
+
+    it('appears in the field options of a Percentile Ranks aggregation', async function() {
+      const fieldValues: string[] = await getFieldOptionsForAggregation('Percentile Ranks');
+      log.debug('Percentile Ranks Fields = ' + fieldValues);
+      expect(fieldValues[0]).to.be('histogram-content');
+    });
+  });
+}
diff --git a/x-pack/test/functional/es_archives/packetbeat/tls/data.json.gz b/x-pack/test/functional/es_archives/packetbeat/tls/data.json.gz
new file mode 100644
index 0000000000000..cf7a5e5f0d446
Binary files /dev/null and b/x-pack/test/functional/es_archives/packetbeat/tls/data.json.gz differ
diff --git a/x-pack/test/functional/es_archives/packetbeat/tls/mappings.json b/x-pack/test/functional/es_archives/packetbeat/tls/mappings.json
new file mode 100644
index 0000000000000..2b5ed05c7e8a9
--- /dev/null
+++ b/x-pack/test/functional/es_archives/packetbeat/tls/mappings.json
@@ -0,0 +1,9583 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "packetbeat-7.6.0": {
+        "is_write_index": false
+      },
+      "packetbeat-tls": {
+        "filter": {
+          "term": {
+            "event.dataset": "tls"
+          }
+        }
+      }
+    },
+    "index": "packetbeat-7.6.0-2020.03.03-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "packetbeat",
+        "version": "7.6.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "amqp.headers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "amqp.headers.*"
+          }
+        },
+        {
+          "cassandra.response.supported": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "cassandra.response.supported.*"
+          }
+        },
+        {
+          "http.request.headers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "http.request.headers.*"
+          }
+        },
+        {
+          "http.response.headers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "http.response.headers.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "amqp": {
+          "properties": {
+            "app-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "arguments": {
+              "type": "object"
+            },
+            "auto-delete": {
+              "type": "boolean"
+            },
+            "class-id": {
+              "type": "long"
+            },
+            "consumer-count": {
+              "type": "long"
+            },
+            "consumer-tag": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "content-encoding": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "content-type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "correlation-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "delivery-mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "delivery-tag": {
+              "type": "long"
+            },
+            "durable": {
+              "type": "boolean"
+            },
+            "exchange": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exchange-type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exclusive": {
+              "type": "boolean"
+            },
+            "expiration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "headers": {
+              "type": "object"
+            },
+            "if-empty": {
+              "type": "boolean"
+            },
+            "if-unused": {
+              "type": "boolean"
+            },
+            "immediate": {
+              "type": "boolean"
+            },
+            "mandatory": {
+              "type": "boolean"
+            },
+            "message-count": {
+              "type": "long"
+            },
+            "message-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "method-id": {
+              "type": "long"
+            },
+            "multiple": {
+              "type": "boolean"
+            },
+            "no-ack": {
+              "type": "boolean"
+            },
+            "no-local": {
+              "type": "boolean"
+            },
+            "no-wait": {
+              "type": "boolean"
+            },
+            "passive": {
+              "type": "boolean"
+            },
+            "priority": {
+              "type": "long"
+            },
+            "queue": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "redelivered": {
+              "type": "boolean"
+            },
+            "reply-code": {
+              "type": "long"
+            },
+            "reply-text": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reply-to": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "routing-key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "timestamp": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "bytes_in": {
+          "path": "source.bytes",
+          "type": "alias"
+        },
+        "bytes_out": {
+          "path": "destination.bytes",
+          "type": "alias"
+        },
+        "cassandra": {
+          "properties": {
+            "no_request": {
+              "type": "boolean"
+            },
+            "request": {
+              "properties": {
+                "headers": {
+                  "properties": {
+                    "flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "length": {
+                      "type": "long"
+                    },
+                    "op": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "stream": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "authentication": {
+                  "properties": {
+                    "class": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "error": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "details": {
+                      "properties": {
+                        "alive": {
+                          "type": "long"
+                        },
+                        "arg_types": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "blockfor": {
+                          "type": "long"
+                        },
+                        "data_present": {
+                          "type": "boolean"
+                        },
+                        "function": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "keyspace": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "num_failures": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "read_consistency": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "received": {
+                          "type": "long"
+                        },
+                        "required": {
+                          "type": "long"
+                        },
+                        "stmt_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "table": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "write_type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "msg": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "event": {
+                  "properties": {
+                    "change": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "host": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "port": {
+                      "type": "long"
+                    },
+                    "schema_change": {
+                      "properties": {
+                        "args": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "change": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "keyspace": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "object": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "table": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "target": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "headers": {
+                  "properties": {
+                    "flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "length": {
+                      "type": "long"
+                    },
+                    "op": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "stream": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "result": {
+                  "properties": {
+                    "keyspace": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "prepared": {
+                      "properties": {
+                        "prepared_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "req_meta": {
+                          "properties": {
+                            "col_count": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "keyspace": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "paging_state": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pkey_columns": {
+                              "type": "long"
+                            },
+                            "table": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "resp_meta": {
+                          "properties": {
+                            "col_count": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "keyspace": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "paging_state": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pkey_columns": {
+                              "type": "long"
+                            },
+                            "table": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "rows": {
+                      "properties": {
+                        "meta": {
+                          "properties": {
+                            "col_count": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "keyspace": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "paging_state": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pkey_columns": {
+                              "type": "long"
+                            },
+                            "table": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "num_rows": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "schema_change": {
+                      "properties": {
+                        "args": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "change": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "keyspace": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "object": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "table": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "target": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "supported": {
+                  "type": "object"
+                },
+                "warnings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "process": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "start": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "working_directory": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dhcpv4": {
+          "properties": {
+            "assigned_ip": {
+              "type": "ip"
+            },
+            "client_ip": {
+              "type": "ip"
+            },
+            "client_mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hardware_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hops": {
+              "type": "long"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "option": {
+              "properties": {
+                "boot_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "broadcast_address": {
+                  "type": "ip"
+                },
+                "class_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dns_servers": {
+                  "type": "ip"
+                },
+                "domain_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hostname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ip_address_lease_time_sec": {
+                  "type": "long"
+                },
+                "max_dhcp_message_size": {
+                  "type": "long"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "message_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ntp_servers": {
+                  "type": "ip"
+                },
+                "parameter_request_list": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rebinding_time_sec": {
+                  "type": "long"
+                },
+                "renewal_time_sec": {
+                  "type": "long"
+                },
+                "requested_ip_address": {
+                  "type": "ip"
+                },
+                "router": {
+                  "type": "ip"
+                },
+                "server_identifier": {
+                  "type": "ip"
+                },
+                "subnet_mask": {
+                  "type": "ip"
+                },
+                "time_servers": {
+                  "type": "ip"
+                },
+                "utc_time_offset_sec": {
+                  "type": "long"
+                },
+                "vendor_identifying_options": {
+                  "type": "object"
+                }
+              }
+            },
+            "relay_ip": {
+              "type": "ip"
+            },
+            "seconds": {
+              "type": "long"
+            },
+            "server_ip": {
+              "type": "ip"
+            },
+            "server_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transaction_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "additionals": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "additionals_count": {
+              "type": "long"
+            },
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "answers_count": {
+              "type": "long"
+            },
+            "authorities": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "authorities_count": {
+              "type": "long"
+            },
+            "flags": {
+              "properties": {
+                "authentic_data": {
+                  "type": "boolean"
+                },
+                "authoritative": {
+                  "type": "boolean"
+                },
+                "checking_disabled": {
+                  "type": "boolean"
+                },
+                "recursion_available": {
+                  "type": "boolean"
+                },
+                "recursion_desired": {
+                  "type": "boolean"
+                },
+                "truncated_response": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "opt": {
+              "properties": {
+                "cookie": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "do": {
+                  "type": "boolean"
+                },
+                "ext_rcode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "udp_size": {
+                  "type": "long"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "etld_plus_one": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fields": {
+          "properties": {
+            "labels": {
+              "properties": {
+                "responsible_human": {
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "flow": {
+          "properties": {
+            "final": {
+              "type": "boolean"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "type": "long"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "properties": {
+                    "content-length": {
+                      "type": "long"
+                    },
+                    "content-type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "properties": {
+                    "content-length": {
+                      "type": "long"
+                    },
+                    "content-type": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "status_code": {
+                  "type": "long"
+                },
+                "status_phrase": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "icmp": {
+          "properties": {
+            "request": {
+              "properties": {
+                "code": {
+                  "type": "long"
+                },
+                "message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "long"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "code": {
+                  "type": "long"
+                },
+                "message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jolokia": {
+          "properties": {
+            "agent": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "secured": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "memcache": {
+          "properties": {
+            "protocol_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "request": {
+              "properties": {
+                "automove": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "cas_unique": {
+                  "type": "long"
+                },
+                "command": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "count_values": {
+                  "type": "long"
+                },
+                "delta": {
+                  "type": "long"
+                },
+                "dest_class": {
+                  "type": "long"
+                },
+                "exptime": {
+                  "type": "long"
+                },
+                "flags": {
+                  "type": "long"
+                },
+                "initial": {
+                  "type": "long"
+                },
+                "line": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "noreply": {
+                  "type": "boolean"
+                },
+                "opaque": {
+                  "type": "long"
+                },
+                "opcode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "opcode_value": {
+                  "type": "long"
+                },
+                "quiet": {
+                  "type": "boolean"
+                },
+                "raw_args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sleep_us": {
+                  "type": "long"
+                },
+                "source_class": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vbucket": {
+                  "type": "long"
+                },
+                "verbosity": {
+                  "type": "long"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                },
+                "cas_unique": {
+                  "type": "long"
+                },
+                "command": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "count_values": {
+                  "type": "long"
+                },
+                "error_msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "flags": {
+                  "type": "long"
+                },
+                "opaque": {
+                  "type": "long"
+                },
+                "opcode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "opcode_value": {
+                  "type": "long"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status_code": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "value": {
+                  "type": "long"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "method": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "mongodb": {
+          "properties": {
+            "cursorId": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "error": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fullCollectionName": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "numberReturned": {
+              "type": "long"
+            },
+            "numberToReturn": {
+              "type": "long"
+            },
+            "numberToSkip": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "returnFieldsSelector": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "selector": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "startingFrom": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "update": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "mysql": {
+          "properties": {
+            "affected_rows": {
+              "type": "long"
+            },
+            "error_code": {
+              "type": "long"
+            },
+            "error_message": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "insert_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_fields": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_rows": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "nfs": {
+          "properties": {
+            "minor_version": {
+              "type": "long"
+            },
+            "opcode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tag": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "type": "long"
+            }
+          }
+        },
+        "notes": {
+          "path": "error.message",
+          "type": "alias"
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "params": {
+          "norms": false,
+          "type": "text"
+        },
+        "path": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "pgsql": {
+          "properties": {
+            "error_code": {
+              "type": "long"
+            },
+            "error_message": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "error_severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_fields": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_rows": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "query": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "redis": {
+          "properties": {
+            "error": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "return_value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "request": {
+          "norms": false,
+          "type": "text"
+        },
+        "resource": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "response": {
+          "norms": false,
+          "type": "text"
+        },
+        "rpc": {
+          "properties": {
+            "auth_flavor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "cred": {
+              "properties": {
+                "gid": {
+                  "type": "long"
+                },
+                "gids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "machinename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "stamp": {
+                  "type": "long"
+                },
+                "uid": {
+                  "type": "long"
+                }
+              }
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "xid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "process": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "start": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "working_directory": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "status": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "thrift": {
+          "properties": {
+            "exceptions": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "params": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "return_value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "alert_types": {
+              "path": "tls.detailed.alert_types",
+              "type": "alias"
+            },
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "client_certificate": {
+              "properties": {
+                "alternative_names": {
+                  "path": "tls.detailed.client_certificate.alternative_names",
+                  "type": "alias"
+                },
+                "issuer": {
+                  "properties": {
+                    "common_name": {
+                      "path": "tls.detailed.client_certificate.issuer.common_name",
+                      "type": "alias"
+                    },
+                    "country": {
+                      "path": "tls.detailed.client_certificate.issuer.country",
+                      "type": "alias"
+                    },
+                    "locality": {
+                      "path": "tls.detailed.client_certificate.issuer.locality",
+                      "type": "alias"
+                    },
+                    "organization": {
+                      "path": "tls.detailed.client_certificate.issuer.organization",
+                      "type": "alias"
+                    },
+                    "organizational_unit": {
+                      "path": "tls.detailed.client_certificate.issuer.organizational_unit",
+                      "type": "alias"
+                    },
+                    "province": {
+                      "path": "tls.detailed.client_certificate.issuer.province",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "not_after": {
+                  "path": "tls.detailed.client_certificate.not_after",
+                  "type": "alias"
+                },
+                "not_before": {
+                  "path": "tls.detailed.client_certificate.not_before",
+                  "type": "alias"
+                },
+                "public_key_algorithm": {
+                  "path": "tls.detailed.client_certificate.public_key_algorithm",
+                  "type": "alias"
+                },
+                "public_key_size": {
+                  "path": "tls.detailed.client_certificate.public_key_size",
+                  "type": "alias"
+                },
+                "serial_number": {
+                  "path": "tls.detailed.client_certificate.serial_number",
+                  "type": "alias"
+                },
+                "signature_algorithm": {
+                  "path": "tls.detailed.client_certificate.signature_algorithm",
+                  "type": "alias"
+                },
+                "subject": {
+                  "properties": {
+                    "common_name": {
+                      "path": "tls.detailed.client_certificate.subject.common_name",
+                      "type": "alias"
+                    },
+                    "country": {
+                      "path": "tls.detailed.client_certificate.subject.country",
+                      "type": "alias"
+                    },
+                    "locality": {
+                      "path": "tls.detailed.client_certificate.subject.locality",
+                      "type": "alias"
+                    },
+                    "organization": {
+                      "path": "tls.detailed.client_certificate.subject.organization",
+                      "type": "alias"
+                    },
+                    "organizational_unit": {
+                      "path": "tls.detailed.client_certificate.subject.organizational_unit",
+                      "type": "alias"
+                    },
+                    "province": {
+                      "path": "tls.detailed.client_certificate.subject.province",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "version": {
+                  "path": "tls.detailed.client_certificate.version",
+                  "type": "alias"
+                }
+              }
+            },
+            "client_certificate_requested": {
+              "path": "tls.detailed.client_certificate_requested",
+              "type": "alias"
+            },
+            "client_hello": {
+              "properties": {
+                "extensions": {
+                  "properties": {
+                    "_unparsed_": {
+                      "path": "tls.detailed.client_hello.extensions._unparsed_",
+                      "type": "alias"
+                    },
+                    "application_layer_protocol_negotiation": {
+                      "path": "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation",
+                      "type": "alias"
+                    },
+                    "ec_points_formats": {
+                      "path": "tls.detailed.client_hello.extensions.ec_points_formats",
+                      "type": "alias"
+                    },
+                    "server_name_indication": {
+                      "path": "tls.detailed.client_hello.extensions.server_name_indication",
+                      "type": "alias"
+                    },
+                    "session_ticket": {
+                      "path": "tls.detailed.client_hello.extensions.session_ticket",
+                      "type": "alias"
+                    },
+                    "signature_algorithms": {
+                      "path": "tls.detailed.client_hello.extensions.signature_algorithms",
+                      "type": "alias"
+                    },
+                    "supported_groups": {
+                      "path": "tls.detailed.client_hello.extensions.supported_groups",
+                      "type": "alias"
+                    },
+                    "supported_versions": {
+                      "path": "tls.detailed.client_hello.extensions.supported_versions",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "session_id": {
+                  "path": "tls.detailed.client_hello.session_id",
+                  "type": "alias"
+                },
+                "supported_ciphers": {
+                  "path": "tls.client.supported_ciphers",
+                  "type": "alias"
+                },
+                "supported_compression_methods": {
+                  "path": "tls.detailed.client_hello.supported_compression_methods",
+                  "type": "alias"
+                },
+                "version": {
+                  "path": "tls.detailed.client_hello.version",
+                  "type": "alias"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "detailed": {
+              "properties": {
+                "alert_types": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "client_certificate": {
+                  "properties": {
+                    "alternative_names": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "issuer": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "not_after": {
+                      "type": "date"
+                    },
+                    "not_before": {
+                      "type": "date"
+                    },
+                    "public_key_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_size": {
+                      "type": "long"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "client_certificate_requested": {
+                  "type": "boolean"
+                },
+                "client_hello": {
+                  "properties": {
+                    "extensions": {
+                      "properties": {
+                        "_unparsed_": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "application_layer_protocol_negotiation": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "ec_points_formats": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "server_name_indication": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "session_ticket": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "signature_algorithms": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "supported_groups": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "supported_versions": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "session_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "supported_compression_methods": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "resumption_method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "server_certificate": {
+                  "properties": {
+                    "alternative_names": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "issuer": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "not_after": {
+                      "type": "date"
+                    },
+                    "not_before": {
+                      "type": "date"
+                    },
+                    "public_key_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_size": {
+                      "type": "long"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "serial_number": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "server_certificate_chain": {
+                  "properties": {
+                    "issuer": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "not_after": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "not_before": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "public_key_size": {
+                      "type": "long"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithm": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "subject": {
+                      "properties": {
+                        "common_name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "country": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "locality": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organization": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "organizational_unit": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "province": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "server_hello": {
+                  "properties": {
+                    "extensions": {
+                      "properties": {
+                        "_unparsed_": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "application_layer_protocol_negotiation": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "ec_points_formats": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "session_ticket": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "supported_versions": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "selected_compression_method": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "session_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "fingerprints": {
+              "properties": {
+                "ja3": {
+                  "path": "tls.client.ja3",
+                  "type": "alias"
+                }
+              }
+            },
+            "handshake_completed": {
+              "path": "tls.established",
+              "type": "alias"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "resumption_method": {
+              "path": "tls.detailed.resumption_method",
+              "type": "alias"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "server_certificate": {
+              "properties": {
+                "alternative_names": {
+                  "path": "tls.detailed.server_certificate.alternative_names",
+                  "type": "alias"
+                },
+                "issuer": {
+                  "properties": {
+                    "common_name": {
+                      "path": "tls.detailed.server_certificate.issuer.common_name",
+                      "type": "alias"
+                    },
+                    "country": {
+                      "path": "tls.detailed.server_certificate.issuer.country",
+                      "type": "alias"
+                    },
+                    "locality": {
+                      "path": "tls.detailed.server_certificate.issuer.locality",
+                      "type": "alias"
+                    },
+                    "organization": {
+                      "path": "tls.detailed.server_certificate.issuer.organization",
+                      "type": "alias"
+                    },
+                    "organizational_unit": {
+                      "path": "tls.detailed.server_certificate.issuer.organizational_unit",
+                      "type": "alias"
+                    },
+                    "province": {
+                      "path": "tls.detailed.server_certificate.issuer.province",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "not_after": {
+                  "path": "tls.detailed.server_certificate.not_after",
+                  "type": "alias"
+                },
+                "not_before": {
+                  "path": "tls.detailed.server_certificate.not_before",
+                  "type": "alias"
+                },
+                "public_key_algorithm": {
+                  "path": "tls.detailed.server_certificate.public_key_algorithm",
+                  "type": "alias"
+                },
+                "public_key_size": {
+                  "path": "tls.detailed.server_certificate.public_key_size",
+                  "type": "alias"
+                },
+                "serial_number": {
+                  "path": "tls.detailed.server_certificate.serial_number",
+                  "type": "alias"
+                },
+                "signature_algorithm": {
+                  "path": "tls.detailed.server_certificate.signature_algorithm",
+                  "type": "alias"
+                },
+                "subject": {
+                  "properties": {
+                    "common_name": {
+                      "path": "tls.detailed.server_certificate.subject.common_name",
+                      "type": "alias"
+                    },
+                    "country": {
+                      "path": "tls.detailed.server_certificate.subject.country",
+                      "type": "alias"
+                    },
+                    "locality": {
+                      "path": "tls.detailed.server_certificate.subject.locality",
+                      "type": "alias"
+                    },
+                    "organization": {
+                      "path": "tls.detailed.server_certificate.subject.organization",
+                      "type": "alias"
+                    },
+                    "organizational_unit": {
+                      "path": "tls.detailed.server_certificate.subject.organizational_unit",
+                      "type": "alias"
+                    },
+                    "province": {
+                      "path": "tls.detailed.server_certificate.subject.province",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "version": {
+                  "path": "tls.detailed.server_certificate.version",
+                  "type": "alias"
+                }
+              }
+            },
+            "server_hello": {
+              "properties": {
+                "extensions": {
+                  "properties": {
+                    "_unparsed_": {
+                      "path": "tls.detailed.server_hello.extensions._unparsed_",
+                      "type": "alias"
+                    },
+                    "application_layer_protocol_negotiation": {
+                      "path": "tls.detailed.server_hello.extensions.application_layer_protocol_negotiation",
+                      "type": "alias"
+                    },
+                    "ec_points_formats": {
+                      "path": "tls.detailed.server_hello.extensions.ec_points_formats",
+                      "type": "alias"
+                    },
+                    "session_ticket": {
+                      "path": "tls.detailed.server_hello.extensions.session_ticket",
+                      "type": "alias"
+                    },
+                    "supported_versions": {
+                      "path": "tls.detailed.server_hello.extensions.supported_versions",
+                      "type": "alias"
+                    }
+                  }
+                },
+                "selected_cipher": {
+                  "path": "tls.cipher",
+                  "type": "alias"
+                },
+                "selected_compression_method": {
+                  "path": "tls.detailed.server_hello.selected_compression_method",
+                  "type": "alias"
+                },
+                "session_id": {
+                  "path": "tls.detailed.server_hello.session_id",
+                  "type": "alias"
+                },
+                "version": {
+                  "path": "tls.detailed.server_hello.version",
+                  "type": "alias"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "type": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "lifecycle": {
+          "indexing_complete": "true",
+          "name": "packetbeat",
+          "rollover_alias": "packetbeat-7.6.0"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "query": {
+          "default_field": [
+            "message",
+            "tags",
+            "agent.ephemeral_id",
+            "agent.id",
+            "agent.name",
+            "agent.type",
+            "agent.version",
+            "as.organization.name",
+            "client.address",
+            "client.as.organization.name",
+            "client.domain",
+            "client.geo.city_name",
+            "client.geo.continent_name",
+            "client.geo.country_iso_code",
+            "client.geo.country_name",
+            "client.geo.name",
+            "client.geo.region_iso_code",
+            "client.geo.region_name",
+            "client.mac",
+            "client.registered_domain",
+            "client.top_level_domain",
+            "client.user.domain",
+            "client.user.email",
+            "client.user.full_name",
+            "client.user.group.domain",
+            "client.user.group.id",
+            "client.user.group.name",
+            "client.user.hash",
+            "client.user.id",
+            "client.user.name",
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "container.id",
+            "container.image.name",
+            "container.image.tag",
+            "container.name",
+            "container.runtime",
+            "destination.address",
+            "destination.as.organization.name",
+            "destination.domain",
+            "destination.geo.city_name",
+            "destination.geo.continent_name",
+            "destination.geo.country_iso_code",
+            "destination.geo.country_name",
+            "destination.geo.name",
+            "destination.geo.region_iso_code",
+            "destination.geo.region_name",
+            "destination.mac",
+            "destination.registered_domain",
+            "destination.top_level_domain",
+            "destination.user.domain",
+            "destination.user.email",
+            "destination.user.full_name",
+            "destination.user.group.domain",
+            "destination.user.group.id",
+            "destination.user.group.name",
+            "destination.user.hash",
+            "destination.user.id",
+            "destination.user.name",
+            "dns.answers.class",
+            "dns.answers.data",
+            "dns.answers.name",
+            "dns.answers.type",
+            "dns.header_flags",
+            "dns.id",
+            "dns.op_code",
+            "dns.question.class",
+            "dns.question.name",
+            "dns.question.registered_domain",
+            "dns.question.subdomain",
+            "dns.question.top_level_domain",
+            "dns.question.type",
+            "dns.response_code",
+            "dns.type",
+            "ecs.version",
+            "error.code",
+            "error.id",
+            "error.message",
+            "error.stack_trace",
+            "error.type",
+            "event.action",
+            "event.category",
+            "event.code",
+            "event.dataset",
+            "event.hash",
+            "event.id",
+            "event.kind",
+            "event.module",
+            "event.original",
+            "event.outcome",
+            "event.provider",
+            "event.timezone",
+            "event.type",
+            "file.device",
+            "file.directory",
+            "file.extension",
+            "file.gid",
+            "file.group",
+            "file.hash.md5",
+            "file.hash.sha1",
+            "file.hash.sha256",
+            "file.hash.sha512",
+            "file.inode",
+            "file.mode",
+            "file.name",
+            "file.owner",
+            "file.path",
+            "file.target_path",
+            "file.type",
+            "file.uid",
+            "geo.city_name",
+            "geo.continent_name",
+            "geo.country_iso_code",
+            "geo.country_name",
+            "geo.name",
+            "geo.region_iso_code",
+            "geo.region_name",
+            "group.domain",
+            "group.id",
+            "group.name",
+            "hash.md5",
+            "hash.sha1",
+            "hash.sha256",
+            "hash.sha512",
+            "host.architecture",
+            "host.geo.city_name",
+            "host.geo.continent_name",
+            "host.geo.country_iso_code",
+            "host.geo.country_name",
+            "host.geo.name",
+            "host.geo.region_iso_code",
+            "host.geo.region_name",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.full",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.type",
+            "host.user.domain",
+            "host.user.email",
+            "host.user.full_name",
+            "host.user.group.domain",
+            "host.user.group.id",
+            "host.user.group.name",
+            "host.user.hash",
+            "host.user.id",
+            "host.user.name",
+            "http.request.body.content",
+            "http.request.method",
+            "http.request.referrer",
+            "http.response.body.content",
+            "http.version",
+            "log.level",
+            "log.logger",
+            "log.origin.file.name",
+            "log.origin.function",
+            "log.original",
+            "log.syslog.facility.name",
+            "log.syslog.severity.name",
+            "network.application",
+            "network.community_id",
+            "network.direction",
+            "network.iana_number",
+            "network.name",
+            "network.protocol",
+            "network.transport",
+            "network.type",
+            "observer.geo.city_name",
+            "observer.geo.continent_name",
+            "observer.geo.country_iso_code",
+            "observer.geo.country_name",
+            "observer.geo.name",
+            "observer.geo.region_iso_code",
+            "observer.geo.region_name",
+            "observer.hostname",
+            "observer.mac",
+            "observer.name",
+            "observer.os.family",
+            "observer.os.full",
+            "observer.os.kernel",
+            "observer.os.name",
+            "observer.os.platform",
+            "observer.os.version",
+            "observer.product",
+            "observer.serial_number",
+            "observer.type",
+            "observer.vendor",
+            "observer.version",
+            "organization.id",
+            "organization.name",
+            "os.family",
+            "os.full",
+            "os.kernel",
+            "os.name",
+            "os.platform",
+            "os.version",
+            "package.architecture",
+            "package.checksum",
+            "package.description",
+            "package.install_scope",
+            "package.license",
+            "package.name",
+            "package.path",
+            "package.version",
+            "process.args",
+            "text",
+            "process.executable",
+            "process.hash.md5",
+            "process.hash.sha1",
+            "process.hash.sha256",
+            "process.hash.sha512",
+            "process.name",
+            "text",
+            "text",
+            "text",
+            "text",
+            "text",
+            "process.thread.name",
+            "process.title",
+            "process.working_directory",
+            "server.address",
+            "server.as.organization.name",
+            "server.domain",
+            "server.geo.city_name",
+            "server.geo.continent_name",
+            "server.geo.country_iso_code",
+            "server.geo.country_name",
+            "server.geo.name",
+            "server.geo.region_iso_code",
+            "server.geo.region_name",
+            "server.mac",
+            "server.registered_domain",
+            "server.top_level_domain",
+            "server.user.domain",
+            "server.user.email",
+            "server.user.full_name",
+            "server.user.group.domain",
+            "server.user.group.id",
+            "server.user.group.name",
+            "server.user.hash",
+            "server.user.id",
+            "server.user.name",
+            "service.ephemeral_id",
+            "service.id",
+            "service.name",
+            "service.node.name",
+            "service.state",
+            "service.type",
+            "service.version",
+            "source.address",
+            "source.as.organization.name",
+            "source.domain",
+            "source.geo.city_name",
+            "source.geo.continent_name",
+            "source.geo.country_iso_code",
+            "source.geo.country_name",
+            "source.geo.name",
+            "source.geo.region_iso_code",
+            "source.geo.region_name",
+            "source.mac",
+            "source.registered_domain",
+            "source.top_level_domain",
+            "source.user.domain",
+            "source.user.email",
+            "source.user.full_name",
+            "source.user.group.domain",
+            "source.user.group.id",
+            "source.user.group.name",
+            "source.user.hash",
+            "source.user.id",
+            "source.user.name",
+            "threat.framework",
+            "threat.tactic.id",
+            "threat.tactic.name",
+            "threat.tactic.reference",
+            "threat.technique.id",
+            "threat.technique.name",
+            "threat.technique.reference",
+            "tracing.trace.id",
+            "tracing.transaction.id",
+            "url.domain",
+            "url.extension",
+            "url.fragment",
+            "url.full",
+            "url.original",
+            "url.password",
+            "url.path",
+            "url.query",
+            "url.registered_domain",
+            "url.scheme",
+            "url.top_level_domain",
+            "url.username",
+            "user.domain",
+            "user.email",
+            "user.full_name",
+            "user.group.domain",
+            "user.group.id",
+            "user.group.name",
+            "user.hash",
+            "user.id",
+            "user.name",
+            "user_agent.device.name",
+            "user_agent.name",
+            "text",
+            "user_agent.original",
+            "user_agent.os.family",
+            "user_agent.os.full",
+            "user_agent.os.kernel",
+            "user_agent.os.name",
+            "user_agent.os.platform",
+            "user_agent.os.version",
+            "user_agent.version",
+            "text",
+            "agent.hostname",
+            "timeseries.instance",
+            "cloud.project.id",
+            "cloud.image.id",
+            "host.os.build",
+            "host.os.codename",
+            "kubernetes.pod.name",
+            "kubernetes.pod.uid",
+            "kubernetes.namespace",
+            "kubernetes.node.name",
+            "kubernetes.replicaset.name",
+            "kubernetes.deployment.name",
+            "kubernetes.statefulset.name",
+            "kubernetes.container.name",
+            "kubernetes.container.image",
+            "jolokia.agent.version",
+            "jolokia.agent.id",
+            "jolokia.server.product",
+            "jolokia.server.version",
+            "jolokia.server.vendor",
+            "jolokia.url",
+            "type",
+            "server.process.name",
+            "server.process.args",
+            "server.process.executable",
+            "server.process.working_directory",
+            "server.process.start",
+            "client.process.name",
+            "client.process.args",
+            "client.process.executable",
+            "client.process.working_directory",
+            "client.process.start",
+            "flow.id",
+            "status",
+            "method",
+            "resource",
+            "path",
+            "query",
+            "params",
+            "request",
+            "response",
+            "amqp.reply-text",
+            "amqp.exchange",
+            "amqp.exchange-type",
+            "amqp.consumer-tag",
+            "amqp.routing-key",
+            "amqp.queue",
+            "amqp.content-type",
+            "amqp.content-encoding",
+            "amqp.delivery-mode",
+            "amqp.correlation-id",
+            "amqp.reply-to",
+            "amqp.expiration",
+            "amqp.message-id",
+            "amqp.timestamp",
+            "amqp.type",
+            "amqp.user-id",
+            "amqp.app-id",
+            "cassandra.request.headers.flags",
+            "cassandra.request.headers.stream",
+            "cassandra.request.headers.op",
+            "cassandra.request.query",
+            "cassandra.response.headers.flags",
+            "cassandra.response.headers.stream",
+            "cassandra.response.headers.op",
+            "cassandra.response.result.type",
+            "cassandra.response.result.rows.meta.keyspace",
+            "cassandra.response.result.rows.meta.table",
+            "cassandra.response.result.rows.meta.flags",
+            "cassandra.response.result.rows.meta.paging_state",
+            "cassandra.response.result.keyspace",
+            "cassandra.response.result.schema_change.change",
+            "cassandra.response.result.schema_change.keyspace",
+            "cassandra.response.result.schema_change.table",
+            "cassandra.response.result.schema_change.object",
+            "cassandra.response.result.schema_change.target",
+            "cassandra.response.result.schema_change.name",
+            "cassandra.response.result.schema_change.args",
+            "cassandra.response.result.prepared.prepared_id",
+            "cassandra.response.result.prepared.req_meta.keyspace",
+            "cassandra.response.result.prepared.req_meta.table",
+            "cassandra.response.result.prepared.req_meta.flags",
+            "cassandra.response.result.prepared.req_meta.paging_state",
+            "cassandra.response.result.prepared.resp_meta.keyspace",
+            "cassandra.response.result.prepared.resp_meta.table",
+            "cassandra.response.result.prepared.resp_meta.flags",
+            "cassandra.response.result.prepared.resp_meta.paging_state",
+            "cassandra.response.authentication.class",
+            "cassandra.response.warnings",
+            "cassandra.response.event.type",
+            "cassandra.response.event.change",
+            "cassandra.response.event.host",
+            "cassandra.response.event.schema_change.change",
+            "cassandra.response.event.schema_change.keyspace",
+            "cassandra.response.event.schema_change.table",
+            "cassandra.response.event.schema_change.object",
+            "cassandra.response.event.schema_change.target",
+            "cassandra.response.event.schema_change.name",
+            "cassandra.response.event.schema_change.args",
+            "cassandra.response.error.msg",
+            "cassandra.response.error.type",
+            "cassandra.response.error.details.read_consistency",
+            "cassandra.response.error.details.write_type",
+            "cassandra.response.error.details.keyspace",
+            "cassandra.response.error.details.table",
+            "cassandra.response.error.details.stmt_id",
+            "cassandra.response.error.details.num_failures",
+            "cassandra.response.error.details.function",
+            "cassandra.response.error.details.arg_types",
+            "dhcpv4.transaction_id",
+            "dhcpv4.flags",
+            "dhcpv4.client_mac",
+            "dhcpv4.server_name",
+            "dhcpv4.op_code",
+            "dhcpv4.hardware_type",
+            "dhcpv4.option.message_type",
+            "dhcpv4.option.parameter_request_list",
+            "dhcpv4.option.class_identifier",
+            "dhcpv4.option.domain_name",
+            "dhcpv4.option.hostname",
+            "dhcpv4.option.message",
+            "dhcpv4.option.boot_file_name",
+            "dns.question.etld_plus_one",
+            "dns.authorities.name",
+            "dns.authorities.type",
+            "dns.authorities.class",
+            "dns.additionals.name",
+            "dns.additionals.type",
+            "dns.additionals.class",
+            "dns.additionals.data",
+            "dns.opt.version",
+            "dns.opt.ext_rcode",
+            "http.response.status_phrase",
+            "icmp.version",
+            "icmp.request.message",
+            "icmp.response.message",
+            "memcache.protocol_type",
+            "memcache.request.line",
+            "memcache.request.command",
+            "memcache.response.command",
+            "memcache.request.type",
+            "memcache.response.type",
+            "memcache.response.error_msg",
+            "memcache.request.opcode",
+            "memcache.response.opcode",
+            "memcache.response.status",
+            "memcache.request.raw_args",
+            "memcache.request.automove",
+            "memcache.response.version",
+            "mongodb.error",
+            "mongodb.fullCollectionName",
+            "mongodb.startingFrom",
+            "mongodb.query",
+            "mongodb.returnFieldsSelector",
+            "mongodb.selector",
+            "mongodb.update",
+            "mongodb.cursorId",
+            "mysql.insert_id",
+            "mysql.num_fields",
+            "mysql.num_rows",
+            "mysql.query",
+            "mysql.error_message",
+            "nfs.tag",
+            "nfs.opcode",
+            "nfs.status",
+            "rpc.xid",
+            "rpc.status",
+            "rpc.auth_flavor",
+            "rpc.cred.gids",
+            "rpc.cred.machinename",
+            "pgsql.error_message",
+            "pgsql.error_severity",
+            "pgsql.num_fields",
+            "pgsql.num_rows",
+            "redis.return_value",
+            "redis.error",
+            "thrift.params",
+            "thrift.service",
+            "thrift.return_value",
+            "thrift.exceptions",
+            "tls.detailed.version",
+            "tls.detailed.resumption_method",
+            "tls.detailed.client_hello.version",
+            "tls.detailed.client_hello.session_id",
+            "tls.detailed.client_hello.supported_compression_methods",
+            "tls.detailed.client_hello.extensions.server_name_indication",
+            "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation",
+            "tls.detailed.client_hello.extensions.session_ticket",
+            "tls.detailed.client_hello.extensions.supported_versions",
+            "tls.detailed.client_hello.extensions.supported_groups",
+            "tls.detailed.client_hello.extensions.signature_algorithms",
+            "tls.detailed.client_hello.extensions.ec_points_formats",
+            "tls.detailed.client_hello.extensions._unparsed_",
+            "tls.detailed.server_hello.version",
+            "tls.detailed.server_hello.selected_compression_method",
+            "tls.detailed.server_hello.session_id",
+            "tls.detailed.server_hello.extensions.application_layer_protocol_negotiation",
+            "tls.detailed.server_hello.extensions.session_ticket",
+            "tls.detailed.server_hello.extensions.supported_versions",
+            "tls.detailed.server_hello.extensions.ec_points_formats",
+            "tls.detailed.server_hello.extensions._unparsed_",
+            "tls.detailed.client_certificate.serial_number",
+            "tls.detailed.client_certificate.public_key_algorithm",
+            "tls.detailed.client_certificate.signature_algorithm",
+            "tls.detailed.client_certificate.alternative_names",
+            "tls.detailed.client_certificate.subject.country",
+            "tls.detailed.client_certificate.subject.organization",
+            "tls.detailed.client_certificate.subject.organizational_unit",
+            "tls.detailed.client_certificate.subject.province",
+            "tls.detailed.client_certificate.subject.common_name",
+            "tls.detailed.client_certificate.subject.locality",
+            "tls.detailed.client_certificate.issuer.country",
+            "tls.detailed.client_certificate.issuer.organization",
+            "tls.detailed.client_certificate.issuer.organizational_unit",
+            "tls.detailed.client_certificate.issuer.province",
+            "tls.detailed.client_certificate.issuer.common_name",
+            "tls.detailed.client_certificate.issuer.locality",
+            "tls.detailed.server_certificate.serial_number",
+            "tls.detailed.server_certificate.public_key_algorithm",
+            "tls.detailed.server_certificate.signature_algorithm",
+            "tls.detailed.server_certificate.alternative_names",
+            "tls.detailed.server_certificate.subject.country",
+            "tls.detailed.server_certificate.subject.organization",
+            "tls.detailed.server_certificate.subject.organizational_unit",
+            "tls.detailed.server_certificate.subject.province",
+            "tls.detailed.server_certificate.subject.common_name",
+            "tls.detailed.server_certificate.subject.locality",
+            "tls.detailed.server_certificate.issuer.country",
+            "tls.detailed.server_certificate.issuer.organization",
+            "tls.detailed.server_certificate.issuer.organizational_unit",
+            "tls.detailed.server_certificate.issuer.province",
+            "tls.detailed.server_certificate.issuer.common_name",
+            "tls.detailed.server_certificate.issuer.locality",
+            "tls.detailed.alert_types",
+            "fields.*"
+          ]
+        },
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "beats": {
+      },
+      "packetbeat-8.0.0": {
+        "is_write_index": true
+      },
+      "packetbeat-tls": {
+        "filter": {
+          "term": {
+            "event.dataset": "tls"
+          }
+        }
+      },
+      "siem-read-alias": {
+      }
+    },
+    "index": "packetbeat-8.0.0-2019.08.29-000010",
+    "mappings": {
+      "_meta": {
+        "beat": "packetbeat",
+        "version": "8.0.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "amqp.headers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "amqp.headers.*"
+          }
+        },
+        {
+          "cassandra.response.supported": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "cassandra.response.supported.*"
+          }
+        },
+        {
+          "http.request.headers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "http.request.headers.*"
+          }
+        },
+        {
+          "http.response.headers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "http.response.headers.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "@version": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "amqp": {
+          "properties": {
+            "app-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "arguments": {
+              "type": "object"
+            },
+            "auto-delete": {
+              "type": "boolean"
+            },
+            "class-id": {
+              "type": "long"
+            },
+            "consumer-count": {
+              "type": "long"
+            },
+            "consumer-tag": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "content-encoding": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "content-type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "correlation-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "delivery-mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "delivery-tag": {
+              "type": "long"
+            },
+            "durable": {
+              "type": "boolean"
+            },
+            "exchange": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exchange-type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exclusive": {
+              "type": "boolean"
+            },
+            "expiration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "headers": {
+              "type": "object"
+            },
+            "if-empty": {
+              "type": "boolean"
+            },
+            "if-unused": {
+              "type": "boolean"
+            },
+            "immediate": {
+              "type": "boolean"
+            },
+            "mandatory": {
+              "type": "boolean"
+            },
+            "message-count": {
+              "type": "long"
+            },
+            "message-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "method-id": {
+              "type": "long"
+            },
+            "multiple": {
+              "type": "boolean"
+            },
+            "no-ack": {
+              "type": "boolean"
+            },
+            "no-local": {
+              "type": "boolean"
+            },
+            "no-wait": {
+              "type": "boolean"
+            },
+            "passive": {
+              "type": "boolean"
+            },
+            "priority": {
+              "type": "long"
+            },
+            "queue": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "redelivered": {
+              "type": "boolean"
+            },
+            "reply-code": {
+              "type": "long"
+            },
+            "reply-text": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reply-to": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "routing-key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "timestamp": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user-id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "bytes_in": {
+          "path": "source.bytes",
+          "type": "alias"
+        },
+        "bytes_out": {
+          "path": "destination.bytes",
+          "type": "alias"
+        },
+        "cassandra": {
+          "properties": {
+            "no_request": {
+              "type": "boolean"
+            },
+            "request": {
+              "properties": {
+                "headers": {
+                  "properties": {
+                    "flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "length": {
+                      "type": "long"
+                    },
+                    "op": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "stream": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "query": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "authentication": {
+                  "properties": {
+                    "class": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "error": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "details": {
+                      "properties": {
+                        "alive": {
+                          "type": "long"
+                        },
+                        "arg_types": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "blockfor": {
+                          "type": "long"
+                        },
+                        "data_present": {
+                          "type": "boolean"
+                        },
+                        "function": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "keyspace": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "num_failures": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "read_consistency": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "received": {
+                          "type": "long"
+                        },
+                        "required": {
+                          "type": "long"
+                        },
+                        "stmt_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "table": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "write_type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "msg": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "event": {
+                  "properties": {
+                    "change": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "host": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "port": {
+                      "type": "long"
+                    },
+                    "schema_change": {
+                      "properties": {
+                        "args": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "change": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "keyspace": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "object": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "table": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "target": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "headers": {
+                  "properties": {
+                    "flags": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "length": {
+                      "type": "long"
+                    },
+                    "op": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "stream": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "result": {
+                  "properties": {
+                    "keyspace": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "prepared": {
+                      "properties": {
+                        "prepared_id": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "req_meta": {
+                          "properties": {
+                            "col_count": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "keyspace": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "paging_state": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pkey_columns": {
+                              "type": "long"
+                            },
+                            "table": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "resp_meta": {
+                          "properties": {
+                            "col_count": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "keyspace": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "paging_state": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pkey_columns": {
+                              "type": "long"
+                            },
+                            "table": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "rows": {
+                      "properties": {
+                        "meta": {
+                          "properties": {
+                            "col_count": {
+                              "type": "long"
+                            },
+                            "flags": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "keyspace": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "paging_state": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            },
+                            "pkey_columns": {
+                              "type": "long"
+                            },
+                            "table": {
+                              "ignore_above": 1024,
+                              "type": "keyword"
+                            }
+                          }
+                        },
+                        "num_rows": {
+                          "type": "long"
+                        }
+                      }
+                    },
+                    "schema_change": {
+                      "properties": {
+                        "args": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "change": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "keyspace": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "object": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "table": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "target": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "supported": {
+                  "type": "object"
+                },
+                "warnings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "process": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "start": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "working_directory": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "domain_top1m_rank": {
+              "type": "long"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "locality": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dhcpv4": {
+          "properties": {
+            "assigned_ip": {
+              "type": "ip"
+            },
+            "client_ip": {
+              "type": "ip"
+            },
+            "client_mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hardware_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hops": {
+              "type": "long"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "option": {
+              "properties": {
+                "boot_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "broadcast_address": {
+                  "type": "ip"
+                },
+                "class_identifier": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dns_servers": {
+                  "type": "ip"
+                },
+                "domain_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hostname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ip_address_lease_time_sec": {
+                  "type": "long"
+                },
+                "max_dhcp_message_size": {
+                  "type": "long"
+                },
+                "message": {
+                  "norms": false,
+                  "type": "text"
+                },
+                "message_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ntp_servers": {
+                  "type": "ip"
+                },
+                "parameter_request_list": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rebinding_time_sec": {
+                  "type": "long"
+                },
+                "renewal_time_sec": {
+                  "type": "long"
+                },
+                "requested_ip_address": {
+                  "type": "ip"
+                },
+                "router": {
+                  "type": "ip"
+                },
+                "server_identifier": {
+                  "type": "ip"
+                },
+                "subnet_mask": {
+                  "type": "ip"
+                },
+                "time_servers": {
+                  "type": "ip"
+                },
+                "utc_time_offset_sec": {
+                  "type": "long"
+                },
+                "vendor_identifying_options": {
+                  "type": "object"
+                }
+              }
+            },
+            "relay_ip": {
+              "type": "ip"
+            },
+            "seconds": {
+              "type": "long"
+            },
+            "server_ip": {
+              "type": "ip"
+            },
+            "server_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transaction_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "additionals": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "additionals_count": {
+              "type": "long"
+            },
+            "answers": {
+              "properties": {
+                "algorithm": {
+                  "type": "keyword"
+                },
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "digest_type": {
+                  "type": "keyword"
+                },
+                "expiration": {
+                  "type": "keyword"
+                },
+                "expire": {
+                  "type": "long"
+                },
+                "flags": {
+                  "type": "keyword"
+                },
+                "inception": {
+                  "type": "keyword"
+                },
+                "key_tag": {
+                  "type": "keyword"
+                },
+                "labels": {
+                  "type": "keyword"
+                },
+                "minimum": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "original_ttl": {
+                  "type": "keyword"
+                },
+                "protocol": {
+                  "type": "keyword"
+                },
+                "refresh": {
+                  "type": "long"
+                },
+                "retry": {
+                  "type": "long"
+                },
+                "rname": {
+                  "type": "keyword"
+                },
+                "serial": {
+                  "type": "long"
+                },
+                "signer_name": {
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type_covered": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "answers_count": {
+              "type": "long"
+            },
+            "authorities": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "expire": {
+                  "type": "long"
+                },
+                "minimum": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "refresh": {
+                  "type": "long"
+                },
+                "retry": {
+                  "type": "long"
+                },
+                "rname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "serial": {
+                  "type": "long"
+                },
+                "ttl": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "authorities_count": {
+              "type": "long"
+            },
+            "flags": {
+              "properties": {
+                "authentic_data": {
+                  "type": "boolean"
+                },
+                "authoritative": {
+                  "type": "boolean"
+                },
+                "checking_disabled": {
+                  "type": "boolean"
+                },
+                "recursion_available": {
+                  "type": "boolean"
+                },
+                "recursion_desired": {
+                  "type": "boolean"
+                },
+                "truncated_response": {
+                  "type": "boolean"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "opt": {
+              "properties": {
+                "do": {
+                  "type": "boolean"
+                },
+                "ext_rcode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "udp_size": {
+                  "type": "long"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "etld_plus_one": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "flow": {
+          "properties": {
+            "final": {
+              "type": "boolean"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "locality": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vlan": {
+              "type": "long"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "properties": {
+                    "content-length": {
+                      "type": "long"
+                    },
+                    "content-type": {
+                      "type": "keyword"
+                    },
+                    "host": {
+                      "type": "keyword"
+                    },
+                    "referer": {
+                      "type": "keyword"
+                    },
+                    "user-agent": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "headers": {
+                  "properties": {
+                    "content-length": {
+                      "type": "long"
+                    },
+                    "content-type": {
+                      "type": "keyword"
+                    },
+                    "host": {
+                      "type": "keyword"
+                    },
+                    "location": {
+                      "type": "keyword"
+                    },
+                    "user-agent": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "status_code": {
+                  "type": "long"
+                },
+                "status_phrase": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "icmp": {
+          "properties": {
+            "request": {
+              "properties": {
+                "code": {
+                  "type": "long"
+                },
+                "message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "long"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "code": {
+                  "type": "long"
+                },
+                "message": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jolokia": {
+          "properties": {
+            "agent": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "secured": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "memcache": {
+          "properties": {
+            "protocol_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "request": {
+              "properties": {
+                "automove": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "cas_unique": {
+                  "type": "long"
+                },
+                "command": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "count_values": {
+                  "type": "long"
+                },
+                "delta": {
+                  "type": "long"
+                },
+                "dest_class": {
+                  "type": "long"
+                },
+                "exptime": {
+                  "type": "long"
+                },
+                "flags": {
+                  "type": "long"
+                },
+                "initial": {
+                  "type": "long"
+                },
+                "line": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "noreply": {
+                  "type": "boolean"
+                },
+                "opaque": {
+                  "type": "long"
+                },
+                "opcode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "opcode_value": {
+                  "type": "long"
+                },
+                "quiet": {
+                  "type": "boolean"
+                },
+                "raw_args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sleep_us": {
+                  "type": "long"
+                },
+                "source_class": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vbucket": {
+                  "type": "long"
+                },
+                "verbosity": {
+                  "type": "long"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "bytes": {
+                  "type": "long"
+                },
+                "cas_unique": {
+                  "type": "long"
+                },
+                "command": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "count_values": {
+                  "type": "long"
+                },
+                "error_msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "flags": {
+                  "type": "long"
+                },
+                "opaque": {
+                  "type": "long"
+                },
+                "opcode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "opcode_value": {
+                  "type": "long"
+                },
+                "status": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "status_code": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "value": {
+                  "type": "long"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "method": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "mongodb": {
+          "properties": {
+            "cursorId": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "error": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fullCollectionName": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "numberReturned": {
+              "type": "long"
+            },
+            "numberToReturn": {
+              "type": "long"
+            },
+            "numberToSkip": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "returnFieldsSelector": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "selector": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "startingFrom": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "update": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "mysql": {
+          "properties": {
+            "affected_rows": {
+              "type": "long"
+            },
+            "error_code": {
+              "type": "long"
+            },
+            "error_message": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "insert_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_fields": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_rows": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "nfs": {
+          "properties": {
+            "minor_version": {
+              "type": "long"
+            },
+            "opcode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tag": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "type": "long"
+            }
+          }
+        },
+        "notes": {
+          "path": "error.message",
+          "type": "alias"
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "params": {
+          "norms": false,
+          "type": "text"
+        },
+        "path": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "pgsql": {
+          "properties": {
+            "error_code": {
+              "type": "long"
+            },
+            "error_message": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "error_severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_fields": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "num_rows": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "query": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "redis": {
+          "properties": {
+            "error": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "return_value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "ip": {
+              "type": "ip"
+            }
+          }
+        },
+        "request": {
+          "norms": false,
+          "type": "text"
+        },
+        "resource": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "response": {
+          "norms": false,
+          "type": "text"
+        },
+        "rpc": {
+          "properties": {
+            "auth_flavor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "cred": {
+              "properties": {
+                "gid": {
+                  "type": "long"
+                },
+                "gids": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "machinename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "stamp": {
+                  "type": "long"
+                },
+                "uid": {
+                  "type": "long"
+                }
+              }
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "xid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "process": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "start": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "working_directory": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "domain_top1m_rank": {
+              "type": "long"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "locality": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "status": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "thrift": {
+          "properties": {
+            "exceptions": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "params": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "return_value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "service": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "alert_types": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "alerts": {
+              "properties": {
+                "code": {
+                  "type": "long"
+                },
+                "severity": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "source": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "client_certificate": {
+              "properties": {
+                "alternative_names": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fingerprint": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "locality": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "province": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "public_key_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "public_key_size": {
+                  "type": "long"
+                },
+                "raw": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "serial_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "signature_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "locality": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "province": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "version": {
+                  "type": "long"
+                }
+              }
+            },
+            "client_certificate_chain": {
+              "properties": {
+                "fingerprint": {
+                  "properties": {
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "not_after": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_before": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "public_key_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "public_key_size": {
+                  "type": "long"
+                },
+                "serial_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "signature_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "version": {
+                  "type": "long"
+                }
+              }
+            },
+            "client_certificate_requested": {
+              "type": "boolean"
+            },
+            "client_hello": {
+              "properties": {
+                "extensions": {
+                  "properties": {
+                    "_unparsed_": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "application_layer_protocol_negotiation": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "ec_points_formats": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "server_name_indication": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "session_ticket": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "signature_algorithms": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "supported_groups": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "supported_versions": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "session_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_compression_methods": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "fingerprints": {
+              "properties": {
+                "ja3": {
+                  "properties": {
+                    "hash": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "str": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "handshake_completed": {
+              "type": "boolean"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "resumption_method": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "server_certificate": {
+              "properties": {
+                "alternative_names": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fingerprint": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "locality": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "province": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "public_key_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "public_key_size": {
+                  "type": "long"
+                },
+                "raw": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "serial_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "signature_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "locality": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "postal_code": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "province": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "serial_number": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "street_address": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "version": {
+                  "type": "long"
+                }
+              }
+            },
+            "server_certificate_chain": {
+              "properties": {
+                "alternative_names": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fingerprint": {
+                  "properties": {
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "locality": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "province": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "not_after": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_before": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "public_key_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "public_key_size": {
+                  "type": "long"
+                },
+                "serial_number": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "signature_algorithm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "properties": {
+                    "common_name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "country": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "locality": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organization": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "organizational_unit": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "province": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "version": {
+                  "type": "long"
+                }
+              }
+            },
+            "server_hello": {
+              "properties": {
+                "extensions": {
+                  "properties": {
+                    "_unparsed_": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "application_layer_protocol_negotiation": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "ec_points_formats": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "session_ticket": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "supported_versions": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "selected_cipher": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "selected_compression_method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "session_id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "type": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "auto_expand_replicas": "0-1",
+        "codec": "best_compression",
+        "lifecycle": {
+          "name": "packetbeat-8.0.0",
+          "rollover_alias": "packetbeat-8.0.0"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "query": {
+          "default_field": [
+            "message",
+            "tags",
+            "agent.ephemeral_id",
+            "agent.id",
+            "agent.name",
+            "agent.type",
+            "agent.version",
+            "as.organization.name",
+            "client.address",
+            "client.as.organization.name",
+            "client.domain",
+            "client.geo.city_name",
+            "client.geo.continent_name",
+            "client.geo.country_iso_code",
+            "client.geo.country_name",
+            "client.geo.name",
+            "client.geo.region_iso_code",
+            "client.geo.region_name",
+            "client.mac",
+            "client.user.domain",
+            "client.user.email",
+            "client.user.full_name",
+            "client.user.group.id",
+            "client.user.group.name",
+            "client.user.hash",
+            "client.user.id",
+            "client.user.name",
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "container.id",
+            "container.image.name",
+            "container.image.tag",
+            "container.name",
+            "container.runtime",
+            "destination.address",
+            "destination.as.organization.name",
+            "destination.domain",
+            "destination.geo.city_name",
+            "destination.geo.continent_name",
+            "destination.geo.country_iso_code",
+            "destination.geo.country_name",
+            "destination.geo.name",
+            "destination.geo.region_iso_code",
+            "destination.geo.region_name",
+            "destination.mac",
+            "destination.user.domain",
+            "destination.user.email",
+            "destination.user.full_name",
+            "destination.user.group.id",
+            "destination.user.group.name",
+            "destination.user.hash",
+            "destination.user.id",
+            "destination.user.name",
+            "dns.answers.class",
+            "dns.answers.data",
+            "dns.answers.name",
+            "dns.answers.type",
+            "dns.header_flags",
+            "dns.id",
+            "dns.op_code",
+            "dns.question.class",
+            "dns.question.name",
+            "dns.question.registered_domain",
+            "dns.question.type",
+            "dns.response_code",
+            "dns.type",
+            "ecs.version",
+            "error.code",
+            "error.id",
+            "error.message",
+            "event.action",
+            "event.category",
+            "event.code",
+            "event.dataset",
+            "event.hash",
+            "event.id",
+            "event.kind",
+            "event.module",
+            "event.original",
+            "event.outcome",
+            "event.provider",
+            "event.timezone",
+            "event.type",
+            "file.device",
+            "file.directory",
+            "file.extension",
+            "file.gid",
+            "file.group",
+            "file.hash.md5",
+            "file.hash.sha1",
+            "file.hash.sha256",
+            "file.hash.sha512",
+            "file.inode",
+            "file.mode",
+            "file.name",
+            "file.owner",
+            "file.path",
+            "file.target_path",
+            "file.type",
+            "file.uid",
+            "geo.city_name",
+            "geo.continent_name",
+            "geo.country_iso_code",
+            "geo.country_name",
+            "geo.name",
+            "geo.region_iso_code",
+            "geo.region_name",
+            "group.id",
+            "group.name",
+            "hash.md5",
+            "hash.sha1",
+            "hash.sha256",
+            "hash.sha512",
+            "host.architecture",
+            "host.geo.city_name",
+            "host.geo.continent_name",
+            "host.geo.country_iso_code",
+            "host.geo.country_name",
+            "host.geo.name",
+            "host.geo.region_iso_code",
+            "host.geo.region_name",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.full",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.type",
+            "host.user.domain",
+            "host.user.email",
+            "host.user.full_name",
+            "host.user.group.id",
+            "host.user.group.name",
+            "host.user.hash",
+            "host.user.id",
+            "host.user.name",
+            "http.request.body.content",
+            "http.request.method",
+            "http.request.referrer",
+            "http.response.body.content",
+            "http.version",
+            "log.level",
+            "log.logger",
+            "log.original",
+            "network.application",
+            "network.community_id",
+            "network.direction",
+            "network.iana_number",
+            "network.name",
+            "network.protocol",
+            "network.transport",
+            "network.type",
+            "observer.geo.city_name",
+            "observer.geo.continent_name",
+            "observer.geo.country_iso_code",
+            "observer.geo.country_name",
+            "observer.geo.name",
+            "observer.geo.region_iso_code",
+            "observer.geo.region_name",
+            "observer.hostname",
+            "observer.mac",
+            "observer.os.family",
+            "observer.os.full",
+            "observer.os.kernel",
+            "observer.os.name",
+            "observer.os.platform",
+            "observer.os.version",
+            "observer.serial_number",
+            "observer.type",
+            "observer.vendor",
+            "observer.version",
+            "organization.id",
+            "organization.name",
+            "os.family",
+            "os.full",
+            "os.kernel",
+            "os.name",
+            "os.platform",
+            "os.version",
+            "process.args",
+            "process.executable",
+            "process.hash.md5",
+            "process.hash.sha1",
+            "process.hash.sha256",
+            "process.hash.sha512",
+            "process.name",
+            "process.thread.name",
+            "process.title",
+            "process.working_directory",
+            "server.address",
+            "server.as.organization.name",
+            "server.domain",
+            "server.geo.city_name",
+            "server.geo.continent_name",
+            "server.geo.country_iso_code",
+            "server.geo.country_name",
+            "server.geo.name",
+            "server.geo.region_iso_code",
+            "server.geo.region_name",
+            "server.mac",
+            "server.user.domain",
+            "server.user.email",
+            "server.user.full_name",
+            "server.user.group.id",
+            "server.user.group.name",
+            "server.user.hash",
+            "server.user.id",
+            "server.user.name",
+            "service.ephemeral_id",
+            "service.id",
+            "service.name",
+            "service.state",
+            "service.type",
+            "service.version",
+            "source.address",
+            "source.as.organization.name",
+            "source.domain",
+            "source.geo.city_name",
+            "source.geo.continent_name",
+            "source.geo.country_iso_code",
+            "source.geo.country_name",
+            "source.geo.name",
+            "source.geo.region_iso_code",
+            "source.geo.region_name",
+            "source.mac",
+            "source.user.domain",
+            "source.user.email",
+            "source.user.full_name",
+            "source.user.group.id",
+            "source.user.group.name",
+            "source.user.hash",
+            "source.user.id",
+            "source.user.name",
+            "tracing.trace.id",
+            "tracing.transaction.id",
+            "url.domain",
+            "url.fragment",
+            "url.full",
+            "url.original",
+            "url.password",
+            "url.path",
+            "url.query",
+            "url.scheme",
+            "url.username",
+            "user.domain",
+            "user.email",
+            "user.full_name",
+            "user.group.id",
+            "user.group.name",
+            "user.hash",
+            "user.id",
+            "user.name",
+            "user_agent.device.name",
+            "user_agent.name",
+            "user_agent.original",
+            "user_agent.os.family",
+            "user_agent.os.full",
+            "user_agent.os.kernel",
+            "user_agent.os.name",
+            "user_agent.os.platform",
+            "user_agent.os.version",
+            "user_agent.version",
+            "agent.hostname",
+            "error.type",
+            "timeseries.instance",
+            "cloud.project.id",
+            "cloud.image.id",
+            "host.os.build",
+            "host.os.codename",
+            "kubernetes.pod.name",
+            "kubernetes.pod.uid",
+            "kubernetes.namespace",
+            "kubernetes.node.name",
+            "kubernetes.replicaset.name",
+            "kubernetes.deployment.name",
+            "kubernetes.statefulset.name",
+            "kubernetes.container.name",
+            "kubernetes.container.image",
+            "jolokia.agent.version",
+            "jolokia.agent.id",
+            "jolokia.server.product",
+            "jolokia.server.version",
+            "jolokia.server.vendor",
+            "jolokia.url",
+            "type",
+            "server.process.name",
+            "server.process.args",
+            "server.process.executable",
+            "server.process.working_directory",
+            "server.process.start",
+            "client.process.name",
+            "client.process.args",
+            "client.process.executable",
+            "client.process.working_directory",
+            "client.process.start",
+            "flow.id",
+            "status",
+            "method",
+            "resource",
+            "path",
+            "query",
+            "params",
+            "request",
+            "response",
+            "amqp.reply-text",
+            "amqp.exchange",
+            "amqp.exchange-type",
+            "amqp.consumer-tag",
+            "amqp.routing-key",
+            "amqp.queue",
+            "amqp.content-type",
+            "amqp.content-encoding",
+            "amqp.delivery-mode",
+            "amqp.correlation-id",
+            "amqp.reply-to",
+            "amqp.expiration",
+            "amqp.message-id",
+            "amqp.timestamp",
+            "amqp.type",
+            "amqp.user-id",
+            "amqp.app-id",
+            "cassandra.request.headers.flags",
+            "cassandra.request.headers.stream",
+            "cassandra.request.headers.op",
+            "cassandra.request.query",
+            "cassandra.response.headers.flags",
+            "cassandra.response.headers.stream",
+            "cassandra.response.headers.op",
+            "cassandra.response.result.type",
+            "cassandra.response.result.rows.meta.keyspace",
+            "cassandra.response.result.rows.meta.table",
+            "cassandra.response.result.rows.meta.flags",
+            "cassandra.response.result.rows.meta.paging_state",
+            "cassandra.response.result.keyspace",
+            "cassandra.response.result.schema_change.change",
+            "cassandra.response.result.schema_change.keyspace",
+            "cassandra.response.result.schema_change.table",
+            "cassandra.response.result.schema_change.object",
+            "cassandra.response.result.schema_change.target",
+            "cassandra.response.result.schema_change.name",
+            "cassandra.response.result.schema_change.args",
+            "cassandra.response.result.prepared.prepared_id",
+            "cassandra.response.result.prepared.req_meta.keyspace",
+            "cassandra.response.result.prepared.req_meta.table",
+            "cassandra.response.result.prepared.req_meta.flags",
+            "cassandra.response.result.prepared.req_meta.paging_state",
+            "cassandra.response.result.prepared.resp_meta.keyspace",
+            "cassandra.response.result.prepared.resp_meta.table",
+            "cassandra.response.result.prepared.resp_meta.flags",
+            "cassandra.response.result.prepared.resp_meta.paging_state",
+            "cassandra.response.authentication.class",
+            "cassandra.response.warnings",
+            "cassandra.response.event.type",
+            "cassandra.response.event.change",
+            "cassandra.response.event.host",
+            "cassandra.response.event.schema_change.change",
+            "cassandra.response.event.schema_change.keyspace",
+            "cassandra.response.event.schema_change.table",
+            "cassandra.response.event.schema_change.object",
+            "cassandra.response.event.schema_change.target",
+            "cassandra.response.event.schema_change.name",
+            "cassandra.response.event.schema_change.args",
+            "cassandra.response.error.msg",
+            "cassandra.response.error.type",
+            "cassandra.response.error.details.read_consistency",
+            "cassandra.response.error.details.write_type",
+            "cassandra.response.error.details.keyspace",
+            "cassandra.response.error.details.table",
+            "cassandra.response.error.details.stmt_id",
+            "cassandra.response.error.details.num_failures",
+            "cassandra.response.error.details.function",
+            "cassandra.response.error.details.arg_types",
+            "dhcpv4.transaction_id",
+            "dhcpv4.flags",
+            "dhcpv4.client_mac",
+            "dhcpv4.server_name",
+            "dhcpv4.op_code",
+            "dhcpv4.hardware_type",
+            "dhcpv4.option.message_type",
+            "dhcpv4.option.parameter_request_list",
+            "dhcpv4.option.class_identifier",
+            "dhcpv4.option.domain_name",
+            "dhcpv4.option.hostname",
+            "dhcpv4.option.message",
+            "dhcpv4.option.boot_file_name",
+            "dns.question.etld_plus_one",
+            "dns.authorities.name",
+            "dns.authorities.type",
+            "dns.authorities.class",
+            "dns.additionals.name",
+            "dns.additionals.type",
+            "dns.additionals.class",
+            "dns.additionals.data",
+            "dns.opt.version",
+            "dns.opt.ext_rcode",
+            "http.response.status_phrase",
+            "icmp.version",
+            "icmp.request.message",
+            "icmp.response.message",
+            "memcache.protocol_type",
+            "memcache.request.line",
+            "memcache.request.command",
+            "memcache.response.command",
+            "memcache.request.type",
+            "memcache.response.type",
+            "memcache.response.error_msg",
+            "memcache.request.opcode",
+            "memcache.response.opcode",
+            "memcache.response.status",
+            "memcache.request.raw_args",
+            "memcache.request.automove",
+            "memcache.response.version",
+            "mongodb.error",
+            "mongodb.fullCollectionName",
+            "mongodb.startingFrom",
+            "mongodb.query",
+            "mongodb.returnFieldsSelector",
+            "mongodb.selector",
+            "mongodb.update",
+            "mongodb.cursorId",
+            "mysql.insert_id",
+            "mysql.num_fields",
+            "mysql.num_rows",
+            "mysql.query",
+            "mysql.error_message",
+            "nfs.tag",
+            "nfs.opcode",
+            "nfs.status",
+            "rpc.xid",
+            "rpc.status",
+            "rpc.auth_flavor",
+            "rpc.cred.gids",
+            "rpc.cred.machinename",
+            "pgsql.error_message",
+            "pgsql.error_severity",
+            "pgsql.num_fields",
+            "pgsql.num_rows",
+            "redis.return_value",
+            "redis.error",
+            "thrift.params",
+            "thrift.service",
+            "thrift.return_value",
+            "thrift.exceptions",
+            "tls.version",
+            "tls.resumption_method",
+            "tls.client_hello.version",
+            "tls.client_hello.extensions.server_name_indication",
+            "tls.client_hello.extensions.application_layer_protocol_negotiation",
+            "tls.client_hello.extensions.session_ticket",
+            "tls.client_hello.extensions.supported_versions",
+            "tls.client_hello.extensions.supported_groups",
+            "tls.client_hello.extensions.signature_algorithms",
+            "tls.client_hello.extensions.ec_points_formats",
+            "tls.client_hello.extensions._unparsed_",
+            "tls.server_hello.version",
+            "tls.server_hello.selected_cipher",
+            "tls.server_hello.selected_compression_method",
+            "tls.server_hello.session_id",
+            "tls.server_hello.extensions.session_ticket",
+            "tls.server_hello.extensions.supported_versions",
+            "tls.server_hello.extensions.ec_points_formats",
+            "tls.server_hello.extensions._unparsed_",
+            "tls.client_certificate.serial_number",
+            "tls.client_certificate.public_key_algorithm",
+            "tls.client_certificate.signature_algorithm",
+            "tls.client_certificate.raw",
+            "tls.client_certificate.subject.country",
+            "tls.client_certificate.subject.organization",
+            "tls.client_certificate.subject.organizational_unit",
+            "tls.client_certificate.subject.province",
+            "tls.client_certificate.subject.common_name",
+            "tls.client_certificate.issuer.country",
+            "tls.client_certificate.issuer.organization",
+            "tls.client_certificate.issuer.organizational_unit",
+            "tls.client_certificate.issuer.province",
+            "tls.client_certificate.issuer.common_name",
+            "tls.client_certificate.fingerprint.md5",
+            "tls.client_certificate.fingerprint.sha1",
+            "tls.client_certificate.fingerprint.sha256",
+            "tls.server_certificate.serial_number",
+            "tls.server_certificate.public_key_algorithm",
+            "tls.server_certificate.signature_algorithm",
+            "tls.server_certificate.raw",
+            "tls.server_certificate.subject.country",
+            "tls.server_certificate.subject.organization",
+            "tls.server_certificate.subject.organizational_unit",
+            "tls.server_certificate.subject.province",
+            "tls.server_certificate.subject.common_name",
+            "tls.server_certificate.issuer.country",
+            "tls.server_certificate.issuer.organization",
+            "tls.server_certificate.issuer.organizational_unit",
+            "tls.server_certificate.issuer.province",
+            "tls.server_certificate.issuer.common_name",
+            "tls.server_certificate.fingerprint.md5",
+            "tls.server_certificate.fingerprint.sha1",
+            "tls.server_certificate.fingerprint.sha256",
+            "tls.alert_types",
+            "tls.fingerprints.ja3.hash",
+            "tls.fingerprints.ja3.str",
+            "fields.*"
+          ]
+        },
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/functional/es_archives/pre_calculated_histogram/data.json b/x-pack/test/functional/es_archives/pre_calculated_histogram/data.json
new file mode 100644
index 0000000000000..cab1dbdf84483
--- /dev/null
+++ b/x-pack/test/functional/es_archives/pre_calculated_histogram/data.json
@@ -0,0 +1,197 @@
+{
+  "type": "doc",
+  "value": {
+    "id": "index-pattern:histogram-test",
+    "index": ".kibana",
+    "source": {
+      "index-pattern": {
+        "title": "histogram-test",
+        "fields": "[{\"name\":\"_id\",\"type\":\"string\",\"esTypes\":[\"_id\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"esTypes\":[\"_index\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"esTypes\":[\"_source\"],\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"esTypes\":[\"_type\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"histogram-content\",\"type\":\"histogram\",\"esTypes\":[\"histogram\"],\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"histogram-title\",\"type\":\"string\",\"esTypes\":[\"keyword\"],\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]"
+      },
+      "type": "index-pattern"
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "5e69404d93193e4074f0ec1a",
+    "index": "histogram-test",
+    "source": {
+      "histogram-title": "incididunt reprehenderit mollit",
+      "histogram-content": {
+        "values": [
+          0.3,
+          1,
+          3,
+          4.2,
+          4.8
+        ],
+        "counts": [
+          237,
+          170,
+          33,
+          149,
+          241
+        ]
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "5e69408f2fc61f57fd5bc762",
+    "index": "histogram-test",
+    "source": {
+      "histogram-title": "culpa cillum ullamco",
+      "histogram-content": {
+        "values": [
+          0.5,
+          1,
+          1.2,
+          1.3,
+          2.8,
+          3.9,
+          4.3
+        ],
+        "counts": [
+          113,
+          197,
+          20,
+          66,
+          20,
+          39,
+          178
+        ]
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "5e6940b979b57ad343114cc3",
+    "index": "histogram-test",
+    "source": {
+      "histogram-title": "enim veniam et",
+      "histogram-content": {
+        "values": [
+          3.7,
+          4.2
+        ],
+        "counts": [
+          227,
+          141
+        ]
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "5e6940d3e95de786eeb7586d",
+    "index": "histogram-test",
+    "source": {
+      "histogram-title": "est incididunt sunt",
+      "histogram-content": {
+        "values": [
+          1.8,
+          2.4,
+          2.6,
+          4.9
+        ],
+        "counts": [
+          92,
+          101,
+          122,
+          244
+        ]
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "5e694119fb2f956a822b93b9",
+    "index": "histogram-test",
+    "source": {
+      "histogram-title": "qui qui tempor",
+      "histogram-content": {
+        "values": [
+          0.5,
+          2.1,
+          2.7,
+          3,
+          3.2,
+          3.5,
+          4.2,
+          5
+        ],
+        "counts": [
+          210,
+          168,
+          182,
+          181,
+          97,
+          164,
+          77,
+          2
+        ]
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "5e694145ad3c741aa12d6e8e",
+    "index": "histogram-test",
+    "source": {
+      "histogram-title": "ullamco nisi sunt",
+      "histogram-content": {
+        "values": [
+          1.7,
+          4.5,
+          4.8
+        ],
+        "counts": [
+          74,
+          146,
+          141
+        ]
+      }
+    }
+  }
+}
+
+{
+  "type": "doc",
+  "value": {
+    "id": "5e694159d909d9d99b5e12d1",
+    "index": "histogram-test",
+    "source": {
+      "histogram-title": "magna eu incididunt",
+      "histogram-content": {
+        "values": [
+          1,
+          3.4,
+          4.8
+        ],
+        "counts": [
+          103,
+          205,
+          11
+        ]
+      }
+    }
+  }
+}
diff --git a/x-pack/test/functional/es_archives/pre_calculated_histogram/mappings.json b/x-pack/test/functional/es_archives/pre_calculated_histogram/mappings.json
new file mode 100644
index 0000000000000..f616daf9d5ccb
--- /dev/null
+++ b/x-pack/test/functional/es_archives/pre_calculated_histogram/mappings.json
@@ -0,0 +1,29 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {},
+    "index": "histogram-test",
+    "mappings": {
+      "properties": {
+        "histogram-title": {
+          "fields": {
+            "keyword": {
+              "ignore_above": 256,
+              "type": "keyword"
+            }
+          },
+          "type": "text"
+        },
+        "histogram-content": {
+          "type": "histogram"
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "number_of_replicas": "0",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
diff --git a/x-pack/test/functional/page_objects/endpoint_page.ts b/x-pack/test/functional/page_objects/endpoint_page.ts
index 6350f51f707f4..4becbf797abc0 100644
--- a/x-pack/test/functional/page_objects/endpoint_page.ts
+++ b/x-pack/test/functional/page_objects/endpoint_page.ts
@@ -63,9 +63,42 @@ export function EndpointPageProvider({ getService }: FtrProviderContext) {
     async waitForTableToHaveData(dataTestSubj: string) {
       await retry.waitForWithTimeout('table to have data', 2000, async () => {
         const tableData = await this.getEndpointAppTableData(dataTestSubj);
-        if (tableData[1][0] === 'No items found') return false;
+        if (tableData[1][0] === 'No items found') {
+          return false;
+        }
         return true;
       });
     },
+
+    async hostFlyoutDescriptionKeys(dataTestSubj: string) {
+      await testSubjects.exists(dataTestSubj);
+      const detailsData: WebElementWrapper = await testSubjects.find(dataTestSubj);
+      const $ = await detailsData.parseDomContent();
+      return $('dt')
+        .toArray()
+        .map(key =>
+          $(key)
+            .text()
+            .replace(/&nbsp;/g, '')
+            .trim()
+        );
+    },
+
+    async hostFlyoutDescriptionValues(dataTestSubj: string) {
+      await testSubjects.exists(dataTestSubj);
+      const detailsData: WebElementWrapper = await testSubjects.find(dataTestSubj);
+      const $ = await detailsData.parseDomContent();
+      return $('dd')
+        .toArray()
+        .map((value, index) => {
+          if (index === 1) {
+            return '';
+          }
+          return $(value)
+            .text()
+            .replace(/&nbsp;/g, '')
+            .trim();
+        });
+    },
   };
 }
diff --git a/x-pack/test/functional/page_objects/gis_page.js b/x-pack/test/functional/page_objects/gis_page.js
index 8d0c649d75dd6..1d0e231d7dc54 100644
--- a/x-pack/test/functional/page_objects/gis_page.js
+++ b/x-pack/test/functional/page_objects/gis_page.js
@@ -451,7 +451,7 @@ export function GisPageProvider({ getService, getPageObjects }) {
 
     async getCodeBlockParsedJson(dataTestSubjName) {
       log.debug(`Get parsed code block for ${dataTestSubjName}`);
-      const indexRespCodeBlock = await find.byCssSelector(`[data-test-subj="${dataTestSubjName}"]`);
+      const indexRespCodeBlock = await testSubjects.find(`${dataTestSubjName}`);
       const indexRespJson = await indexRespCodeBlock.getAttribute('innerText');
       return JSON.parse(indexRespJson);
     }
diff --git a/x-pack/test/functional/page_objects/rollup_page.js b/x-pack/test/functional/page_objects/rollup_page.js
index 1514693defecb..b6bc60df6f7cd 100644
--- a/x-pack/test/functional/page_objects/rollup_page.js
+++ b/x-pack/test/functional/page_objects/rollup_page.js
@@ -111,28 +111,18 @@ export function RollupPageProvider({ getService, getPageObjects }) {
     async getJobList() {
       const jobs = await testSubjects.findAll('jobTableRow');
       return mapAsync(jobs, async job => {
-        const jobNameElement = await job.findByCssSelector('[data-test-subj="jobTableCell-id"]');
-        const jobStatusElement = await job.findByCssSelector(
-          '[data-test-subj="jobTableCell-status"]'
+        const jobNameElement = await job.findByTestSubject('jobTableCell-id');
+        const jobStatusElement = await job.findByTestSubject('jobTableCell-status');
+        const jobIndexPatternElement = await job.findByTestSubject('jobTableCell-indexPattern');
+        const jobRollUpIndexPatternElement = await job.findByTestSubject(
+          'jobTableCell-rollupIndex'
         );
-        const jobIndexPatternElement = await job.findByCssSelector(
-          '[data-test-subj="jobTableCell-indexPattern"]'
-        );
-        const jobRollUpIndexPatternElement = await job.findByCssSelector(
-          '[data-test-subj="jobTableCell-rollupIndex"]'
-        );
-        const jobDelayElement = await job.findByCssSelector(
-          '[data-test-subj="jobTableCell-rollupDelay"]'
-        );
-        const jobIntervalElement = await job.findByCssSelector(
-          '[data-test-subj="jobTableCell-dateHistogramInterval"]'
-        );
-        const jobGroupElement = await job.findByCssSelector(
-          '[data-test-subj="jobTableCell-groups"]'
-        );
-        const jobMetricsElement = await job.findByCssSelector(
-          '[data-test-subj="jobTableCell-metrics"]'
+        const jobDelayElement = await job.findByTestSubject('jobTableCell-rollupDelay');
+        const jobIntervalElement = await job.findByTestSubject(
+          'jobTableCell-dateHistogramInterval'
         );
+        const jobGroupElement = await job.findByTestSubject('jobTableCell-groups');
+        const jobMetricsElement = await job.findByTestSubject('jobTableCell-metrics');
 
         return {
           jobName: await jobNameElement.getVisibleText(),
diff --git a/x-pack/test/functional/page_objects/security_page.js b/x-pack/test/functional/page_objects/security_page.js
index 4b097b916573d..b399327012a77 100644
--- a/x-pack/test/functional/page_objects/security_page.js
+++ b/x-pack/test/functional/page_objects/security_page.js
@@ -229,13 +229,12 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
     async getElasticsearchUsers() {
       const users = await testSubjects.findAll('userRow');
       return mapAsync(users, async user => {
-        const fullnameElement = await user.findByCssSelector('[data-test-subj="userRowFullName"]');
-        const usernameElement = await user.findByCssSelector('[data-test-subj="userRowUserName"]');
-        const emailElement = await user.findByCssSelector('[data-test-subj="userRowEmail"]');
-        const rolesElement = await user.findByCssSelector('[data-test-subj="userRowRoles"]');
-        // findAllByCssSelector is substantially faster than `find.descendantExistsByCssSelector for negative cases
-        const isUserReserved =
-          (await user.findAllByCssSelector('span[data-test-subj="userReserved"]', 1)).length > 0;
+        const fullnameElement = await user.findByTestSubject('userRowFullName');
+        const usernameElement = await user.findByTestSubject('userRowUserName');
+        const emailElement = await user.findByTestSubject('userRowEmail');
+        const rolesElement = await user.findByTestSubject('userRowRoles');
+        // findAll is substantially faster than `find.descendantExistsByCssSelector for negative cases
+        const isUserReserved = (await user.findAllByTestSubject('userReserved', 1)).length > 0;
 
         return {
           username: await usernameElement.getVisibleText(),
@@ -251,15 +250,11 @@ export function SecurityPageProvider({ getService, getPageObjects }) {
       const users = await testSubjects.findAll('roleRow');
       return mapAsync(users, async role => {
         const [rolename, reserved, deprecated] = await Promise.all([
-          role.findByCssSelector('[data-test-subj="roleRowName"]').then(el => el.getVisibleText()),
-          // findAllByCssSelector is substantially faster than `find.descendantExistsByCssSelector for negative cases
-          role
-            .findAllByCssSelector('span[data-test-subj="roleReserved"]', 1)
-            .then(el => el.length > 0),
-          // findAllByCssSelector is substantially faster than `find.descendantExistsByCssSelector for negative cases
-          role
-            .findAllByCssSelector('span[data-test-subj="roleDeprecated"]', 1)
-            .then(el => el.length > 0),
+          role.findByTestSubject('roleRowName').then(el => el.getVisibleText()),
+          // findAll is substantially faster than `find.descendantExistsByCssSelector for negative cases
+          role.findAllByTestSubject('roleReserved', 1).then(el => el.length > 0),
+          // findAll is substantially faster than `find.descendantExistsByCssSelector for negative cases
+          role.findAllByTestSubject('roleDeprecated', 1).then(el => el.length > 0),
         ]);
 
         return {
diff --git a/x-pack/test/functional/page_objects/snapshot_restore_page.ts b/x-pack/test/functional/page_objects/snapshot_restore_page.ts
index 1c8ba9f633111..841345e3727f1 100644
--- a/x-pack/test/functional/page_objects/snapshot_restore_page.ts
+++ b/x-pack/test/functional/page_objects/snapshot_restore_page.ts
@@ -28,21 +28,15 @@ export function SnapshotRestorePageProvider({ getService }: FtrProviderContext)
     },
     async getRepoList() {
       const table = await testSubjects.find('repositoryTable');
-      const rows = await table.findAllByCssSelector('[data-test-subj="row"]');
+      const rows = await table.findAllByTestSubject('row');
       return await Promise.all(
         rows.map(async row => {
           return {
-            repoName: await (
-              await row.findByCssSelector('[data-test-subj="Name_cell"]')
-            ).getVisibleText(),
-            repoLink: await (
-              await row.findByCssSelector('[data-test-subj="Name_cell"]')
-            ).findByCssSelector('a'),
-            repoType: await (
-              await row.findByCssSelector('[data-test-subj="Type_cell"]')
-            ).getVisibleText(),
-            repoEdit: await row.findByCssSelector('[data-test-subj="editRepositoryButton"]'),
-            repoDelete: await row.findByCssSelector('[data-test-subj="deleteRepositoryButton"]'),
+            repoName: await (await row.findByTestSubject('Name_cell')).getVisibleText(),
+            repoLink: await (await row.findByTestSubject('Name_cell')).findByCssSelector('a'),
+            repoType: await (await row.findByTestSubject('Type_cell')).getVisibleText(),
+            repoEdit: await row.findByTestSubject('editRepositoryButton'),
+            repoDelete: await row.findByTestSubject('deleteRepositoryButton'),
           };
         })
       );
diff --git a/x-pack/test/functional/page_objects/uptime_page.ts b/x-pack/test/functional/page_objects/uptime_page.ts
index e18c7d4154728..0b8e994ba8095 100644
--- a/x-pack/test/functional/page_objects/uptime_page.ts
+++ b/x-pack/test/functional/page_objects/uptime_page.ts
@@ -66,12 +66,14 @@ export function UptimePageProvider({ getPageObjects, getService }: FtrProviderCo
       return await uptimeService.pageHasDataMissing();
     }
 
-    public async pageHasExpectedIds(monitorIdsToCheck: string[]) {
-      await Promise.all(monitorIdsToCheck.map(id => uptimeService.monitorPageLinkExists(id)));
+    public async pageHasExpectedIds(monitorIdsToCheck: string[]): Promise<void> {
+      return retry.tryForTime(15000, async () => {
+        await Promise.all(monitorIdsToCheck.map(id => uptimeService.monitorPageLinkExists(id)));
+      });
     }
 
-    public async pageUrlContains(value: string, expected: boolean = true) {
-      await retry.try(async () => {
+    public async pageUrlContains(value: string, expected: boolean = true): Promise<void> {
+      return retry.tryForTime(12000, async () => {
         expect(await uptimeService.urlContains(value)).to.eql(expected);
       });
     }
@@ -144,5 +146,10 @@ export function UptimePageProvider({ getPageObjects, getService }: FtrProviderCo
       await alerts.setLocationsSelectable();
       await alerts.clickSaveAlertButtion();
     }
+
+    public async setMonitorListPageSize(size: number): Promise<void> {
+      await uptimeService.openPageSizeSelectPopover();
+      return uptimeService.clickPageSizeSelectPopoverItem(size);
+    }
   })();
 }
diff --git a/x-pack/test/functional/services/machine_learning/api.ts b/x-pack/test/functional/services/machine_learning/api.ts
index e305d23c1a124..74dc5912df36f 100644
--- a/x-pack/test/functional/services/machine_learning/api.ts
+++ b/x-pack/test/functional/services/machine_learning/api.ts
@@ -358,9 +358,20 @@ export function MachineLearningAPIProvider({ getService }: FtrProviderContext) {
     },
 
     async getDataFrameAnalyticsJob(analyticsId: string) {
+      log.debug(`Fetching data frame analytics job '${analyticsId}'...`);
       return await esSupertest.get(`/_ml/data_frame/analytics/${analyticsId}`).expect(200);
     },
 
+    async waitForDataFrameAnalyticsJobToExist(analyticsId: string) {
+      await retry.waitForWithTimeout(`'${analyticsId}' to exist`, 5 * 1000, async () => {
+        if (await this.getDataFrameAnalyticsJob(analyticsId)) {
+          return true;
+        } else {
+          throw new Error(`expected data frame analytics job '${analyticsId}' to exist`);
+        }
+      });
+    },
+
     async createDataFrameAnalyticsJob(jobConfig: DataFrameAnalyticsConfig) {
       const { id: analyticsId, ...analyticsConfig } = jobConfig;
       log.debug(`Creating data frame analytic job with id '${analyticsId}'...`);
@@ -369,13 +380,7 @@ export function MachineLearningAPIProvider({ getService }: FtrProviderContext) {
         .send(analyticsConfig)
         .expect(200);
 
-      await retry.waitForWithTimeout(`'${analyticsId}' to be created`, 5 * 1000, async () => {
-        if (await this.getDataFrameAnalyticsJob(analyticsId)) {
-          return true;
-        } else {
-          throw new Error(`expected data frame analytics job '${analyticsId}' to be created`);
-        }
-      });
+      await this.waitForDataFrameAnalyticsJobToExist(analyticsId);
     },
   };
 }
diff --git a/x-pack/test/functional/services/machine_learning/data_frame_analytics_creation.ts b/x-pack/test/functional/services/machine_learning/data_frame_analytics_creation.ts
index 9d5f5753e8b04..49f9b01c96895 100644
--- a/x-pack/test/functional/services/machine_learning/data_frame_analytics_creation.ts
+++ b/x-pack/test/functional/services/machine_learning/data_frame_analytics_creation.ts
@@ -12,6 +12,7 @@ import {
 
 import { FtrProviderContext } from '../../ftr_provider_context';
 import { MlCommon } from './common';
+import { MlApi } from './api';
 
 enum ANALYSIS_CONFIG_TYPE {
   OUTLIER_DETECTION = 'outlier_detection',
@@ -31,7 +32,8 @@ const isClassificationAnalysis = (arg: any): arg is ClassificationAnalysis => {
 
 export function MachineLearningDataFrameAnalyticsCreationProvider(
   { getService }: FtrProviderContext,
-  mlCommon: MlCommon
+  mlCommon: MlCommon,
+  mlApi: MlApi
 ) {
   const testSubjects = getService('testSubjects');
   const comboBox = getService('comboBox');
@@ -333,12 +335,13 @@ export function MachineLearningDataFrameAnalyticsCreationProvider(
       return !isEnabled;
     },
 
-    async createAnalyticsJob() {
+    async createAnalyticsJob(analyticsId: string) {
       await testSubjects.click('mlAnalyticsCreateJobFlyoutCreateButton');
       await retry.tryForTime(5000, async () => {
         await this.assertCreateButtonMissing();
         await this.assertStartButtonExists();
       });
+      await mlApi.waitForDataFrameAnalyticsJobToExist(analyticsId);
     },
 
     async assertStartButtonExists() {
@@ -362,8 +365,8 @@ export function MachineLearningDataFrameAnalyticsCreationProvider(
     },
 
     async closeCreateAnalyticsJobFlyout() {
-      await testSubjects.click('mlAnalyticsCreateJobFlyoutCloseButton');
-      await retry.tryForTime(5000, async () => {
+      await retry.tryForTime(10 * 1000, async () => {
+        await testSubjects.click('mlAnalyticsCreateJobFlyoutCloseButton');
         await testSubjects.missingOrFail('mlAnalyticsCreateJobFlyout');
       });
     },
diff --git a/x-pack/test/functional/services/ml.ts b/x-pack/test/functional/services/ml.ts
index f3981c9edf92f..af7cb51f4e3f0 100644
--- a/x-pack/test/functional/services/ml.ts
+++ b/x-pack/test/functional/services/ml.ts
@@ -45,7 +45,8 @@ export function MachineLearningProvider(context: FtrProviderContext) {
   const dataFrameAnalytics = MachineLearningDataFrameAnalyticsProvider(context, api);
   const dataFrameAnalyticsCreation = MachineLearningDataFrameAnalyticsCreationProvider(
     context,
-    common
+    common,
+    api
   );
   const dataFrameAnalyticsTable = MachineLearningDataFrameAnalyticsTableProvider(context);
   const dataVisualizer = MachineLearningDataVisualizerProvider(context);
diff --git a/x-pack/test/functional/services/uptime.ts b/x-pack/test/functional/services/uptime.ts
index 57beedc5e0f29..f9902d0142b96 100644
--- a/x-pack/test/functional/services/uptime.ts
+++ b/x-pack/test/functional/services/uptime.ts
@@ -194,5 +194,14 @@ export function UptimeProvider({ getService }: FtrProviderContext) {
         timeout: 3000,
       });
     },
+    async openPageSizeSelectPopover(): Promise<void> {
+      return testSubjects.click('xpack.uptime.monitorList.pageSizeSelect.popoverOpen', 5000);
+    },
+    async clickPageSizeSelectPopoverItem(size: number = 10): Promise<void> {
+      return testSubjects.click(
+        `xpack.uptime.monitorList.pageSizeSelect.sizeSelectItem${size.toString()}`,
+        5000
+      );
+    },
   };
 }
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
index a69f39454f7b3..b1a74aa05028b 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts.ts
@@ -83,7 +83,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       await testSubjects.click('slackAddVariableButton');
       const variableMenuButton = await testSubjects.find('variableMenuButton-0');
       await variableMenuButton.click();
-      await find.clickByCssSelector('[data-test-subj="saveAlertButton"]');
+      await testSubjects.click('saveAlertButton');
       const toastTitle = await pageObjects.common.closeToast();
       expect(toastTitle).to.eql(`Saved '${alertName}'`);
       await pageObjects.triggersActionsUI.searchAlerts(alertName);
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
index 145b536a26f61..2c29954528bd5 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts
@@ -254,12 +254,15 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
       });
 
       it('renders the active alert instances', async () => {
+        // refresh to ensure Api call and UI are looking at freshest output
+        await browser.refresh();
+
         // Verify content
         await testSubjects.existOrFail('alertInstancesList');
 
         const { alertInstances } = await alerting.alerts.getAlertState(alert.id);
 
-        const dateOnAllInstances = mapValues(
+        const dateOnAllInstancesFromApiResponse = mapValues<Record<string, number>>(
           alertInstances,
           ({
             meta: {
@@ -268,28 +271,32 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
           }) => date
         );
 
-        log.debug(`API RESULT: ${JSON.stringify(dateOnAllInstances)}`);
+        log.debug(
+          `API RESULT: ${Object.entries(dateOnAllInstancesFromApiResponse)
+            .map(([id, date]) => `${id}: ${moment(date).utc()}`)
+            .join(', ')}`
+        );
 
         const instancesList = await pageObjects.alertDetailsUI.getAlertInstancesList();
         expect(instancesList.map(instance => omit(instance, 'duration'))).to.eql([
           {
             instance: 'us-central',
             status: 'Active',
-            start: moment(dateOnAllInstances['us-central'])
+            start: moment(dateOnAllInstancesFromApiResponse['us-central'])
               .utc()
               .format('D MMM YYYY @ HH:mm:ss'),
           },
           {
             instance: 'us-east',
             status: 'Active',
-            start: moment(dateOnAllInstances['us-east'])
+            start: moment(dateOnAllInstancesFromApiResponse['us-east'])
               .utc()
               .format('D MMM YYYY @ HH:mm:ss'),
           },
           {
             instance: 'us-west',
             status: 'Active',
-            start: moment(dateOnAllInstances['us-west'])
+            start: moment(dateOnAllInstancesFromApiResponse['us-west'])
               .utc()
               .format('D MMM YYYY @ HH:mm:ss'),
           },
@@ -299,30 +306,41 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
           await pageObjects.alertDetailsUI.getAlertInstanceDurationEpoch()
         ).utc();
 
-        const durationFromInstanceTillPageLoad = mapValues(dateOnAllInstances, date =>
-          moment.duration(durationEpoch.diff(moment(date).utc()))
+        log.debug(`DURATION EPOCH is: ${durationEpoch}]`);
+
+        const durationFromInstanceInApiUntilPageLoad = mapValues(
+          dateOnAllInstancesFromApiResponse,
+          // time from Alert Instance until pageload (AKA durationEpoch)
+          date => {
+            const durationFromApiResuiltToEpoch = moment.duration(
+              durationEpoch.diff(moment(date).utc())
+            );
+            // The UI removes milliseconds, so lets do the same in the test so we can compare
+            return moment.duration({
+              hours: durationFromApiResuiltToEpoch.hours(),
+              minutes: durationFromApiResuiltToEpoch.minutes(),
+              seconds: durationFromApiResuiltToEpoch.seconds(),
+            });
+          }
         );
+
         instancesList
           .map(alertInstance => ({
             id: alertInstance.instance,
-            duration: alertInstance.duration.split(':').map(part => parseInt(part, 10)),
+            // time from Alert Instance used to render the list until pageload (AKA durationEpoch)
+            duration: moment.duration(alertInstance.duration),
           }))
-          .map(({ id, duration: [hours, minutes, seconds] }) => ({
-            id,
-            duration: moment.duration({
-              hours,
-              minutes,
-              seconds,
-            }),
-          }))
-          .forEach(({ id, duration }) => {
-            // make sure the duration is within a 10 second range which is
-            // good enough as the alert interval is 1m, so we know it is a fresh value
-            expect(duration.as('milliseconds')).to.greaterThan(
-              durationFromInstanceTillPageLoad[id].subtract(1000 * 10).as('milliseconds')
+          .forEach(({ id, duration: durationAsItAppearsOnList }) => {
+            log.debug(
+              `DURATION of ${id} [From UI: ${durationAsItAppearsOnList.as(
+                'seconds'
+              )} seconds] [From API: ${durationFromInstanceInApiUntilPageLoad[id].as(
+                'seconds'
+              )} seconds]`
             );
-            expect(duration.as('milliseconds')).to.lessThan(
-              durationFromInstanceTillPageLoad[id].add(1000 * 10).as('milliseconds')
+
+            expect(durationFromInstanceInApiUntilPageLoad[id].as('seconds')).to.equal(
+              durationAsItAppearsOnList.as('seconds')
             );
           });
       });
diff --git a/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts b/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts
index 0916b01137416..2a50c0117eae9 100644
--- a/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts
+++ b/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts
@@ -19,14 +19,14 @@ export function TriggersActionsPageProvider({ getService }: FtrProviderContext)
       return await testSubjects.getVisibleText('appTitle');
     },
     async clickCreateFirstConnectorButton() {
-      const createBtn = await find.byCssSelector('[data-test-subj="createFirstActionButton"]');
+      const createBtn = await testSubjects.find('createFirstActionButton');
       const createBtnIsVisible = await createBtn.isDisplayed();
       if (createBtnIsVisible) {
         await createBtn.click();
       }
     },
     async clickCreateConnectorButton() {
-      const createBtn = await find.byCssSelector('[data-test-subj="createActionButton"]');
+      const createBtn = await testSubjects.find('createActionButton');
       const createBtnIsVisible = await createBtn.isDisplayed();
       if (createBtnIsVisible) {
         await createBtn.click();
diff --git a/x-pack/test/kerberos_api_integration/apis/security/kerberos_login.ts b/x-pack/test/kerberos_api_integration/apis/security/kerberos_login.ts
index b561c9ea47513..81999826adbb1 100644
--- a/x-pack/test/kerberos_api_integration/apis/security/kerberos_login.ts
+++ b/x-pack/test/kerberos_api_integration/apis/security/kerberos_login.ts
@@ -8,10 +8,14 @@ import expect from '@kbn/expect';
 import request, { Cookie } from 'request';
 import { delay } from 'bluebird';
 import { FtrProviderContext } from '../../ftr_provider_context';
+import {
+  getMutualAuthenticationResponseToken,
+  getSPNEGOToken,
+} from '../../fixtures/kerberos_tools';
 
 export default function({ getService }: FtrProviderContext) {
-  const spnegoToken =
-    'YIIChwYGKwYBBQUCoIICezCCAnegDTALBgkqhkiG9xIBAgKiggJkBIICYGCCAlwGCSqGSIb3EgECAgEAboICSzCCAkegAwIBBaEDAgEOogcDBQAAAAAAo4IBW2GCAVcwggFToAMCAQWhERsPVEVTVC5FTEFTVElDLkNPohwwGqADAgEDoRMwERsESFRUUBsJbG9jYWxob3N0o4IBGTCCARWgAwIBEqEDAgECooIBBwSCAQNBN2a1Rso+KEJsDwICYLCt7ACLzdlbhEZF5YNsehO109b/WiZR1VTK6kCQyDdBdQFefyvV8EiC35mz7XnTb239nWz6xBGbdmtjSfF0XzpXKbL/zGzLEKkEXQuqFLPUN6qEJXsh0OoNdj9OWwmTr93FVyugs1hO/E5wjlAe2SDYpBN6uZICXu6dFg9nLQKkb/XgbgKM7ZZvgA/UElWDgHav4nPO1VWppCCLKHqXTRnvpr/AsxeON4qeJLaukxBigfIaJlLFMNQal5H7MyXa0j3Y1sckbURnWoBt6r4XE7c8F8cz0rYoGwoCO+Cs5tNutKY6XcsAFbLh59hjgIkhVBhhyTeypIHSMIHPoAMCARKigccEgcSsXqIRAcHfZivrbHfsnvbFgmzmnrKVPFNtJ9Hl23KunCsNW49nP4VF2dEf9n12prDaIguJDV5LPHpTew9rmCj1GCahKJ9bJbRKIgImLFd+nelm3E2zxRqAhrgM1469oDg0ksE3+5lJBuJlVEECMp0F/gxvEiL7DhasICqw+FOJ/jD9QUYvg+E6BIxWgZyPszaxerzBBszAhIF1rxCHRRL1KLjskNeJlBhH77DkAO6AEmsYGdsgEq7b7uCov9PKPiiPAuFF';
+  const spnegoToken = getSPNEGOToken();
+
   const supertest = getService('supertestWithoutAuth');
   const config = getService('config');
 
@@ -105,7 +109,7 @@ export default function({ getService }: FtrProviderContext) {
 
         // Verify that mutual authentication works.
         expect(response.headers['www-authenticate']).to.be(
-          'Negotiate oRQwEqADCgEAoQsGCSqGSIb3EgECAg=='
+          `Negotiate ${getMutualAuthenticationResponseToken()}`
         );
 
         const cookies = response.headers['set-cookie'];
diff --git a/x-pack/test/kerberos_api_integration/fixtures/kerberos_tools.ts b/x-pack/test/kerberos_api_integration/fixtures/kerberos_tools.ts
new file mode 100644
index 0000000000000..2fed5d475cd5c
--- /dev/null
+++ b/x-pack/test/kerberos_api_integration/fixtures/kerberos_tools.ts
@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export function getSPNEGOToken() {
+  return 'YIIChwYGKwYBBQUCoIICezCCAnegDTALBgkqhkiG9xIBAgKiggJkBIICYGCCAlwGCSqGSIb3EgECAgEAboICSzCCAkegAwIBBaEDAgEOogcDBQAAAAAAo4IBW2GCAVcwggFToAMCAQWhERsPVEVTVC5FTEFTVElDLkNPohwwGqADAgEDoRMwERsESFRUUBsJbG9jYWxob3N0o4IBGTCCARWgAwIBEqEDAgECooIBBwSCAQNBN2a1Rso+KEJsDwICYLCt7ACLzdlbhEZF5YNsehO109b/WiZR1VTK6kCQyDdBdQFefyvV8EiC35mz7XnTb239nWz6xBGbdmtjSfF0XzpXKbL/zGzLEKkEXQuqFLPUN6qEJXsh0OoNdj9OWwmTr93FVyugs1hO/E5wjlAe2SDYpBN6uZICXu6dFg9nLQKkb/XgbgKM7ZZvgA/UElWDgHav4nPO1VWppCCLKHqXTRnvpr/AsxeON4qeJLaukxBigfIaJlLFMNQal5H7MyXa0j3Y1sckbURnWoBt6r4XE7c8F8cz0rYoGwoCO+Cs5tNutKY6XcsAFbLh59hjgIkhVBhhyTeypIHSMIHPoAMCARKigccEgcSsXqIRAcHfZivrbHfsnvbFgmzmnrKVPFNtJ9Hl23KunCsNW49nP4VF2dEf9n12prDaIguJDV5LPHpTew9rmCj1GCahKJ9bJbRKIgImLFd+nelm3E2zxRqAhrgM1469oDg0ksE3+5lJBuJlVEECMp0F/gxvEiL7DhasICqw+FOJ/jD9QUYvg+E6BIxWgZyPszaxerzBBszAhIF1rxCHRRL1KLjskNeJlBhH77DkAO6AEmsYGdsgEq7b7uCov9PKPiiPAuFF';
+}
+
+export function getMutualAuthenticationResponseToken() {
+  return 'oRQwEqADCgEAoQsGCSqGSIb3EgECAg==';
+}
diff --git a/x-pack/test/login_selector_api_integration/apis/index.ts b/x-pack/test/login_selector_api_integration/apis/index.ts
new file mode 100644
index 0000000000000..35f83733a7105
--- /dev/null
+++ b/x-pack/test/login_selector_api_integration/apis/index.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export default function({ loadTestFile }: FtrProviderContext) {
+  describe('apis', function() {
+    this.tags('ciGroup6');
+    loadTestFile(require.resolve('./login_selector'));
+  });
+}
diff --git a/x-pack/test/login_selector_api_integration/apis/login_selector.ts b/x-pack/test/login_selector_api_integration/apis/login_selector.ts
new file mode 100644
index 0000000000000..3be96d27186d9
--- /dev/null
+++ b/x-pack/test/login_selector_api_integration/apis/login_selector.ts
@@ -0,0 +1,545 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import request, { Cookie } from 'request';
+import { readFileSync } from 'fs';
+import { resolve } from 'path';
+import url from 'url';
+import { CA_CERT_PATH } from '@kbn/dev-utils';
+import expect from '@kbn/expect';
+import { getStateAndNonce } from '../../oidc_api_integration/fixtures/oidc_tools';
+import {
+  getMutualAuthenticationResponseToken,
+  getSPNEGOToken,
+} from '../../kerberos_api_integration/fixtures/kerberos_tools';
+import { getSAMLRequestId, getSAMLResponse } from '../../saml_api_integration/fixtures/saml_tools';
+import { FtrProviderContext } from '../ftr_provider_context';
+
+export default function({ getService }: FtrProviderContext) {
+  const randomness = getService('randomness');
+  const supertest = getService('supertestWithoutAuth');
+  const config = getService('config');
+
+  const kibanaServerConfig = config.get('servers.kibana');
+  const validUsername = kibanaServerConfig.username;
+  const validPassword = kibanaServerConfig.password;
+
+  const CA_CERT = readFileSync(CA_CERT_PATH);
+  const CLIENT_CERT = readFileSync(
+    resolve(__dirname, '../../pki_api_integration/fixtures/first_client.p12')
+  );
+
+  async function checkSessionCookie(sessionCookie: Cookie, username: string, providerName: string) {
+    expect(sessionCookie.key).to.be('sid');
+    expect(sessionCookie.value).to.not.be.empty();
+    expect(sessionCookie.path).to.be('/');
+    expect(sessionCookie.httpOnly).to.be(true);
+
+    const apiResponse = await supertest
+      .get('/internal/security/me')
+      .ca(CA_CERT)
+      .pfx(CLIENT_CERT)
+      .set('kbn-xsrf', 'xxx')
+      .set('Cookie', sessionCookie.cookieString())
+      .expect(200);
+
+    expect(apiResponse.body).to.only.have.keys([
+      'username',
+      'full_name',
+      'email',
+      'roles',
+      'metadata',
+      'enabled',
+      'authentication_realm',
+      'lookup_realm',
+      'authentication_provider',
+    ]);
+
+    expect(apiResponse.body.username).to.be(username);
+    expect(apiResponse.body.authentication_provider).to.be(providerName);
+  }
+
+  describe('Login Selector', () => {
+    it('should redirect user to a login selector', async () => {
+      const response = await supertest
+        .get('/abc/xyz/handshake?one=two three')
+        .ca(CA_CERT)
+        .expect(302);
+      expect(response.headers['set-cookie']).to.be(undefined);
+      expect(response.headers.location).to.be(
+        '/login?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three'
+      );
+    });
+
+    it('should allow access to login selector with intermediate authentication cookie', async () => {
+      const handshakeResponse = await supertest
+        .post('/internal/security/login_with')
+        .ca(CA_CERT)
+        .set('kbn-xsrf', 'xxx')
+        .send({ providerType: 'saml', providerName: 'saml1', currentURL: 'https://kibana.com/' })
+        .expect(200);
+
+      // The cookie that includes some state of the in-progress authentication, that doesn't allow
+      // to fully authenticate user yet.
+      const intermediateAuthCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
+
+      await supertest
+        .get('/login')
+        .ca(CA_CERT)
+        .set('Cookie', intermediateAuthCookie.cookieString())
+        .expect(200);
+    });
+
+    describe('SAML', () => {
+      function createSAMLResponse(options = {}) {
+        return getSAMLResponse({
+          destination: `http://localhost:${kibanaServerConfig.port}/api/security/saml/callback`,
+          sessionIndex: String(randomness.naturalNumber()),
+          ...options,
+        });
+      }
+
+      it('should be able to log in via IdP initiated login for any configured realm', async () => {
+        for (const providerName of ['saml1', 'saml2']) {
+          const authenticationResponse = await supertest
+            .post('/api/security/saml/callback')
+            .ca(CA_CERT)
+            .send({
+              SAMLResponse: await createSAMLResponse({
+                issuer: `http://www.elastic.co/${providerName}`,
+              }),
+            })
+            .expect(302);
+
+          // User should be redirected to the base URL.
+          expect(authenticationResponse.headers.location).to.be('/');
+
+          const cookies = authenticationResponse.headers['set-cookie'];
+          expect(cookies).to.have.length(1);
+
+          await checkSessionCookie(request.cookie(cookies[0])!, 'a@b.c', providerName);
+        }
+      });
+
+      it('should be able to log in via IdP initiated login even if session with other provider type exists', async () => {
+        const basicAuthenticationResponse = await supertest
+          .post('/internal/security/login')
+          .ca(CA_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .send({ username: validUsername, password: validPassword })
+          .expect(204);
+
+        const basicSessionCookie = request.cookie(
+          basicAuthenticationResponse.headers['set-cookie'][0]
+        )!;
+        await checkSessionCookie(basicSessionCookie, 'elastic', 'basic1');
+
+        for (const providerName of ['saml1', 'saml2']) {
+          const authenticationResponse = await supertest
+            .post('/api/security/saml/callback')
+            .ca(CA_CERT)
+            .set('Cookie', basicSessionCookie.cookieString())
+            .send({
+              SAMLResponse: await createSAMLResponse({
+                issuer: `http://www.elastic.co/${providerName}`,
+              }),
+            })
+            .expect(302);
+
+          // It should be `/overwritten_session` instead of `/` once it's generalized.
+          expect(authenticationResponse.headers.location).to.be('/');
+
+          const cookies = authenticationResponse.headers['set-cookie'];
+          expect(cookies).to.have.length(1);
+
+          await checkSessionCookie(request.cookie(cookies[0])!, 'a@b.c', providerName);
+        }
+      });
+
+      it('should be able to log in via IdP initiated login even if session with other SAML provider exists', async () => {
+        // First login with `saml1`.
+        const saml1AuthenticationResponse = await supertest
+          .post('/api/security/saml/callback')
+          .ca(CA_CERT)
+          .send({
+            SAMLResponse: await createSAMLResponse({ issuer: `http://www.elastic.co/saml1` }),
+          })
+          .expect(302);
+
+        const saml1SessionCookie = request.cookie(
+          saml1AuthenticationResponse.headers['set-cookie'][0]
+        )!;
+        await checkSessionCookie(saml1SessionCookie, 'a@b.c', 'saml1');
+
+        // And now try to login with `saml2`.
+        const saml2AuthenticationResponse = await supertest
+          .post('/api/security/saml/callback')
+          .ca(CA_CERT)
+          .set('Cookie', saml1SessionCookie.cookieString())
+          .send({
+            SAMLResponse: await createSAMLResponse({ issuer: `http://www.elastic.co/saml2` }),
+          })
+          .expect(302);
+
+        // It should be `/overwritten_session` instead of `/` once it's generalized.
+        expect(saml2AuthenticationResponse.headers.location).to.be('/');
+
+        const saml2SessionCookie = request.cookie(
+          saml2AuthenticationResponse.headers['set-cookie'][0]
+        )!;
+        await checkSessionCookie(saml2SessionCookie, 'a@b.c', 'saml2');
+      });
+
+      // Ideally we should be able to abandon intermediate session and let user log in, but for the
+      // time being we cannot distinguish errors coming from Elasticsearch for the case when SAML
+      // response just doesn't correspond to request ID we have in intermediate cookie and the case
+      // when something else has happened.
+      it('should fail for IdP initiated login if intermediate session with other SAML provider exists', async () => {
+        // First start authentication flow with `saml1`.
+        const saml1HandshakeResponse = await supertest
+          .post('/internal/security/login_with')
+          .ca(CA_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            providerType: 'saml',
+            providerName: 'saml1',
+            currentURL: 'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three#/workpad',
+          })
+          .expect(200);
+
+        expect(
+          saml1HandshakeResponse.body.location.startsWith(`https://elastic.co/sso/saml`)
+        ).to.be(true);
+
+        const saml1HandshakeCookie = request.cookie(
+          saml1HandshakeResponse.headers['set-cookie'][0]
+        )!;
+
+        // And now try to login with `saml2`.
+        await supertest
+          .post('/api/security/saml/callback')
+          .ca(CA_CERT)
+          .set('Cookie', saml1HandshakeCookie.cookieString())
+          .send({
+            SAMLResponse: await createSAMLResponse({ issuer: `http://www.elastic.co/saml2` }),
+          })
+          .expect(401);
+      });
+
+      it('should be able to log in via SP initiated login with any configured realm', async () => {
+        for (const providerName of ['saml1', 'saml2']) {
+          const handshakeResponse = await supertest
+            .post('/internal/security/login_with')
+            .ca(CA_CERT)
+            .set('kbn-xsrf', 'xxx')
+            .send({
+              providerType: 'saml',
+              providerName,
+              currentURL:
+                'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three#/workpad',
+            })
+            .expect(200);
+
+          expect(handshakeResponse.body.location.startsWith(`https://elastic.co/sso/saml`)).to.be(
+            true
+          );
+
+          const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
+          const samlRequestId = await getSAMLRequestId(handshakeResponse.body.location);
+
+          const authenticationResponse = await supertest
+            .post('/api/security/saml/callback')
+            .ca(CA_CERT)
+            .set('kbn-xsrf', 'xxx')
+            .set('Cookie', handshakeCookie.cookieString())
+            .send({
+              SAMLResponse: await createSAMLResponse({
+                inResponseTo: samlRequestId,
+                issuer: `http://www.elastic.co/${providerName}`,
+              }),
+            })
+            .expect(302);
+
+          // User should be redirected to the URL that initiated handshake.
+          expect(authenticationResponse.headers.location).to.be(
+            '/abc/xyz/handshake?one=two three#/workpad'
+          );
+
+          const cookies = authenticationResponse.headers['set-cookie'];
+          expect(cookies).to.have.length(1);
+
+          await checkSessionCookie(request.cookie(cookies[0])!, 'a@b.c', providerName);
+        }
+      });
+
+      it('should be able to log in via SP initiated login even if intermediate session with other SAML provider exists', async () => {
+        // First start authentication flow with `saml1`.
+        const saml1HandshakeResponse = await supertest
+          .post('/internal/security/login_with')
+          .ca(CA_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            providerType: 'saml',
+            providerName: 'saml1',
+            currentURL: 'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three#/saml1',
+          })
+          .expect(200);
+
+        expect(
+          saml1HandshakeResponse.body.location.startsWith(`https://elastic.co/sso/saml`)
+        ).to.be(true);
+
+        const saml1HandshakeCookie = request.cookie(
+          saml1HandshakeResponse.headers['set-cookie'][0]
+        )!;
+
+        // And now try to login with `saml2`.
+        const saml2HandshakeResponse = await supertest
+          .post('/internal/security/login_with')
+          .ca(CA_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .set('Cookie', saml1HandshakeCookie.cookieString())
+          .send({
+            providerType: 'saml',
+            providerName: 'saml2',
+            currentURL: 'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three#/saml2',
+          })
+          .expect(200);
+
+        expect(
+          saml2HandshakeResponse.body.location.startsWith(`https://elastic.co/sso/saml`)
+        ).to.be(true);
+
+        const saml2HandshakeCookie = request.cookie(
+          saml2HandshakeResponse.headers['set-cookie'][0]
+        )!;
+
+        const saml2AuthenticationResponse = await supertest
+          .post('/api/security/saml/callback')
+          .ca(CA_CERT)
+          .set('Cookie', saml2HandshakeCookie.cookieString())
+          .send({
+            SAMLResponse: await createSAMLResponse({ issuer: `http://www.elastic.co/saml2` }),
+          })
+          .expect(302);
+
+        expect(saml2AuthenticationResponse.headers.location).to.be(
+          '/abc/xyz/handshake?one=two three#/saml2'
+        );
+
+        const saml2SessionCookie = request.cookie(
+          saml2AuthenticationResponse.headers['set-cookie'][0]
+        )!;
+        await checkSessionCookie(saml2SessionCookie, 'a@b.c', 'saml2');
+      });
+    });
+
+    describe('Kerberos', () => {
+      it('should be able to log in from Login Selector', async () => {
+        const spnegoResponse = await supertest
+          .post('/internal/security/login_with')
+          .ca(CA_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            providerType: 'kerberos',
+            providerName: 'kerberos1',
+            currentURL: 'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three#/workpad',
+          })
+          .expect(401);
+
+        expect(spnegoResponse.headers['set-cookie']).to.be(undefined);
+        expect(spnegoResponse.headers['www-authenticate']).to.be('Negotiate');
+
+        const authenticationResponse = await supertest
+          .post('/internal/security/login_with')
+          .ca(CA_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .set('Authorization', `Negotiate ${getSPNEGOToken()}`)
+          .send({
+            providerType: 'kerberos',
+            providerName: 'kerberos1',
+            currentURL: 'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three#/workpad',
+          })
+          .expect(200);
+
+        // Verify that mutual authentication works.
+        expect(authenticationResponse.headers['www-authenticate']).to.be(
+          `Negotiate ${getMutualAuthenticationResponseToken()}`
+        );
+
+        const cookies = authenticationResponse.headers['set-cookie'];
+        expect(cookies).to.have.length(1);
+
+        await checkSessionCookie(
+          request.cookie(cookies[0])!,
+          'tester@TEST.ELASTIC.CO',
+          'kerberos1'
+        );
+      });
+
+      it('should be able to log in from Login Selector even if client provides certificate and PKI is enabled', async () => {
+        const spnegoResponse = await supertest
+          .post('/internal/security/login_with')
+          .ca(CA_CERT)
+          .pfx(CLIENT_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            providerType: 'kerberos',
+            providerName: 'kerberos1',
+            currentURL: 'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three#/workpad',
+          })
+          .expect(401);
+
+        expect(spnegoResponse.headers['set-cookie']).to.be(undefined);
+        expect(spnegoResponse.headers['www-authenticate']).to.be('Negotiate');
+
+        const authenticationResponse = await supertest
+          .post('/internal/security/login_with')
+          .ca(CA_CERT)
+          .pfx(CLIENT_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .set('Authorization', `Negotiate ${getSPNEGOToken()}`)
+          .send({
+            providerType: 'kerberos',
+            providerName: 'kerberos1',
+            currentURL: 'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three#/workpad',
+          })
+          .expect(200);
+
+        // Verify that mutual authentication works.
+        expect(authenticationResponse.headers['www-authenticate']).to.be(
+          `Negotiate ${getMutualAuthenticationResponseToken()}`
+        );
+
+        const cookies = authenticationResponse.headers['set-cookie'];
+        expect(cookies).to.have.length(1);
+
+        await checkSessionCookie(
+          request.cookie(cookies[0])!,
+          'tester@TEST.ELASTIC.CO',
+          'kerberos1'
+        );
+      });
+    });
+
+    describe('OpenID Connect', () => {
+      it('should be able to log in via IdP initiated login', async () => {
+        const handshakeResponse = await supertest
+          .get('/api/security/oidc/initiate_login?iss=https://test-op.elastic.co')
+          .ca(CA_CERT)
+          .expect(302);
+        const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
+
+        // Set the nonce in our mock OIDC Provider so that it can generate the ID Tokens
+        const { state, nonce } = getStateAndNonce(handshakeResponse.headers.location);
+        await supertest
+          .post('/api/oidc_provider/setup')
+          .ca(CA_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .send({ nonce })
+          .expect(200);
+
+        const authenticationResponse = await supertest
+          .get(`/api/security/oidc/callback?code=code2&state=${state}`)
+          .ca(CA_CERT)
+          .set('Cookie', handshakeCookie.cookieString())
+          .expect(302);
+
+        // User should be redirected to the base URL.
+        expect(authenticationResponse.headers.location).to.be('/');
+
+        const cookies = authenticationResponse.headers['set-cookie'];
+        expect(cookies).to.have.length(1);
+
+        await checkSessionCookie(request.cookie(cookies[0])!, 'user2', 'oidc1');
+      });
+
+      it('should be able to log in via SP initiated login', async () => {
+        const handshakeResponse = await supertest
+          .post('/internal/security/login_with')
+          .ca(CA_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            providerType: 'oidc',
+            providerName: 'oidc1',
+            currentURL: 'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three',
+          })
+          .expect(200);
+
+        const handshakeCookie = request.cookie(handshakeResponse.headers['set-cookie'][0])!;
+        const redirectURL = url.parse(handshakeResponse.body.location, true /* parseQueryString */);
+        expect(
+          handshakeResponse.body.location.startsWith(
+            `https://test-op.elastic.co/oauth2/v1/authorize`
+          )
+        ).to.be(true);
+
+        expect(redirectURL.query.scope).to.not.be.empty();
+        expect(redirectURL.query.response_type).to.not.be.empty();
+        expect(redirectURL.query.client_id).to.not.be.empty();
+        expect(redirectURL.query.redirect_uri).to.not.be.empty();
+        expect(redirectURL.query.state).to.not.be.empty();
+        expect(redirectURL.query.nonce).to.not.be.empty();
+
+        // Set the nonce in our mock OIDC Provider so that it can generate the ID Tokens
+        const { state, nonce } = redirectURL.query;
+        await supertest
+          .post('/api/oidc_provider/setup')
+          .ca(CA_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .send({ nonce })
+          .expect(200);
+
+        const authenticationResponse = await supertest
+          .get(`/api/security/oidc/callback?code=code1&state=${state}`)
+          .ca(CA_CERT)
+          .set('Cookie', handshakeCookie.cookieString())
+          .expect(302);
+
+        // User should be redirected to the URL that initiated handshake.
+        expect(authenticationResponse.headers.location).to.be('/abc/xyz/handshake?one=two three');
+
+        const cookies = authenticationResponse.headers['set-cookie'];
+        expect(cookies).to.have.length(1);
+
+        await checkSessionCookie(request.cookie(cookies[0])!, 'user1', 'oidc1');
+      });
+    });
+
+    describe('PKI', () => {
+      it('should redirect user to a login selector even if client provides certificate', async () => {
+        const response = await supertest
+          .get('/abc/xyz/handshake?one=two three')
+          .ca(CA_CERT)
+          .pfx(CLIENT_CERT)
+          .expect(302);
+        expect(response.headers['set-cookie']).to.be(undefined);
+        expect(response.headers.location).to.be(
+          '/login?next=%2Fabc%2Fxyz%2Fhandshake%3Fone%3Dtwo%2520three'
+        );
+      });
+
+      it('should be able to log in from Login Selector', async () => {
+        const authenticationResponse = await supertest
+          .post('/internal/security/login_with')
+          .ca(CA_CERT)
+          .pfx(CLIENT_CERT)
+          .set('kbn-xsrf', 'xxx')
+          .send({
+            providerType: 'pki',
+            providerName: 'pki1',
+            currentURL: 'https://kibana.com/login?next=/abc/xyz/handshake?one=two%20three#/workpad',
+          })
+          .expect(200);
+
+        const cookies = authenticationResponse.headers['set-cookie'];
+        expect(cookies).to.have.length(1);
+
+        await checkSessionCookie(request.cookie(cookies[0])!, 'first_client', 'pki1');
+      });
+    });
+  });
+}
diff --git a/x-pack/test/login_selector_api_integration/config.ts b/x-pack/test/login_selector_api_integration/config.ts
new file mode 100644
index 0000000000000..6ca9d19b74c17
--- /dev/null
+++ b/x-pack/test/login_selector_api_integration/config.ts
@@ -0,0 +1,141 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { resolve } from 'path';
+import { CA_CERT_PATH, KBN_CERT_PATH, KBN_KEY_PATH } from '@kbn/dev-utils';
+import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
+
+export default async function({ readConfigFile }: FtrConfigProviderContext) {
+  const kibanaAPITestsConfig = await readConfigFile(
+    require.resolve('../../../test/api_integration/config.js')
+  );
+  const xPackAPITestsConfig = await readConfigFile(require.resolve('../api_integration/config.js'));
+  const kibanaPort = xPackAPITestsConfig.get('servers.kibana.port');
+
+  const kerberosKeytabPath = resolve(__dirname, '../kerberos_api_integration/fixtures/krb5.keytab');
+  const kerberosConfigPath = resolve(__dirname, '../kerberos_api_integration/fixtures/krb5.conf');
+
+  const oidcJWKSPath = resolve(__dirname, '../oidc_api_integration/fixtures/jwks.json');
+  const oidcIdPPlugin = resolve(__dirname, '../oidc_api_integration/fixtures/oidc_provider');
+
+  const pkiKibanaCAPath = resolve(__dirname, '../pki_api_integration/fixtures/kibana_ca.crt');
+
+  const saml1IdPMetadataPath = resolve(
+    __dirname,
+    '../saml_api_integration/fixtures/idp_metadata.xml'
+  );
+  const saml2IdPMetadataPath = resolve(
+    __dirname,
+    '../saml_api_integration/fixtures/idp_metadata_2.xml'
+  );
+
+  const servers = {
+    ...xPackAPITestsConfig.get('servers'),
+    elasticsearch: {
+      ...xPackAPITestsConfig.get('servers.elasticsearch'),
+      protocol: 'https',
+    },
+    kibana: {
+      ...xPackAPITestsConfig.get('servers.kibana'),
+      protocol: 'https',
+    },
+  };
+
+  return {
+    testFiles: [require.resolve('./apis')],
+    servers,
+    security: { disableTestUser: true },
+    services: {
+      randomness: kibanaAPITestsConfig.get('services.randomness'),
+      legacyEs: kibanaAPITestsConfig.get('services.legacyEs'),
+      supertestWithoutAuth: xPackAPITestsConfig.get('services.supertestWithoutAuth'),
+    },
+    junit: {
+      reportName: 'X-Pack Login Selector API Integration Tests',
+    },
+
+    esTestCluster: {
+      ...xPackAPITestsConfig.get('esTestCluster'),
+      ssl: true,
+      serverArgs: [
+        ...xPackAPITestsConfig.get('esTestCluster.serverArgs'),
+        'xpack.security.authc.token.enabled=true',
+        'xpack.security.authc.token.timeout=15s',
+        'xpack.security.http.ssl.client_authentication=optional',
+        'xpack.security.http.ssl.verification_mode=certificate',
+        'xpack.security.authc.realms.native.native1.order=0',
+        'xpack.security.authc.realms.kerberos.kerb1.order=1',
+        `xpack.security.authc.realms.kerberos.kerb1.keytab.path=${kerberosKeytabPath}`,
+        'xpack.security.authc.realms.pki.pki1.order=2',
+        'xpack.security.authc.realms.pki.pki1.delegation.enabled=true',
+        `xpack.security.authc.realms.pki.pki1.certificate_authorities=${CA_CERT_PATH}`,
+        'xpack.security.authc.realms.saml.saml1.order=3',
+        `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${saml1IdPMetadataPath}`,
+        'xpack.security.authc.realms.saml.saml1.idp.entity_id=http://www.elastic.co/saml1',
+        `xpack.security.authc.realms.saml.saml1.sp.entity_id=http://localhost:${kibanaPort}`,
+        `xpack.security.authc.realms.saml.saml1.sp.logout=http://localhost:${kibanaPort}/logout`,
+        `xpack.security.authc.realms.saml.saml1.sp.acs=http://localhost:${kibanaPort}/api/security/saml/callback`,
+        'xpack.security.authc.realms.saml.saml1.attributes.principal=urn:oid:0.0.7',
+        'xpack.security.authc.realms.oidc.oidc1.order=4',
+        `xpack.security.authc.realms.oidc.oidc1.rp.client_id=0oa8sqpov3TxMWJOt356`,
+        `xpack.security.authc.realms.oidc.oidc1.rp.client_secret=0oa8sqpov3TxMWJOt356`,
+        `xpack.security.authc.realms.oidc.oidc1.rp.response_type=code`,
+        `xpack.security.authc.realms.oidc.oidc1.rp.redirect_uri=https://localhost:${kibanaPort}/api/security/oidc/callback`,
+        `xpack.security.authc.realms.oidc.oidc1.op.authorization_endpoint=https://test-op.elastic.co/oauth2/v1/authorize`,
+        `xpack.security.authc.realms.oidc.oidc1.op.endsession_endpoint=https://test-op.elastic.co/oauth2/v1/endsession`,
+        `xpack.security.authc.realms.oidc.oidc1.op.token_endpoint=https://localhost:${kibanaPort}/api/oidc_provider/token_endpoint`,
+        `xpack.security.authc.realms.oidc.oidc1.op.userinfo_endpoint=https://localhost:${kibanaPort}/api/oidc_provider/userinfo_endpoint`,
+        `xpack.security.authc.realms.oidc.oidc1.op.issuer=https://test-op.elastic.co`,
+        `xpack.security.authc.realms.oidc.oidc1.op.jwkset_path=${oidcJWKSPath}`,
+        `xpack.security.authc.realms.oidc.oidc1.claims.principal=sub`,
+        `xpack.security.authc.realms.oidc.oidc1.ssl.certificate_authorities=${CA_CERT_PATH}`,
+        'xpack.security.authc.realms.saml.saml2.order=5',
+        `xpack.security.authc.realms.saml.saml2.idp.metadata.path=${saml2IdPMetadataPath}`,
+        'xpack.security.authc.realms.saml.saml2.idp.entity_id=http://www.elastic.co/saml2',
+        `xpack.security.authc.realms.saml.saml2.sp.entity_id=http://localhost:${kibanaPort}`,
+        `xpack.security.authc.realms.saml.saml2.sp.logout=http://localhost:${kibanaPort}/logout`,
+        `xpack.security.authc.realms.saml.saml2.sp.acs=http://localhost:${kibanaPort}/api/security/saml/callback`,
+        'xpack.security.authc.realms.saml.saml2.attributes.principal=urn:oid:0.0.7',
+      ],
+      serverEnvVars: {
+        // We're going to use the same TGT multiple times and during a short period of time, so we
+        // have to disable replay cache so that ES doesn't complain about that.
+        ES_JAVA_OPTS: `-Djava.security.krb5.conf=${kerberosConfigPath} -Dsun.security.krb5.rcache=none`,
+      },
+    },
+
+    kbnTestServer: {
+      ...xPackAPITestsConfig.get('kbnTestServer'),
+      serverArgs: [
+        ...xPackAPITestsConfig.get('kbnTestServer.serverArgs'),
+        `--plugin-path=${oidcIdPPlugin}`,
+        '--optimize.enabled=false',
+        '--server.ssl.enabled=true',
+        `--server.ssl.key=${KBN_KEY_PATH}`,
+        `--server.ssl.certificate=${KBN_CERT_PATH}`,
+        `--server.ssl.certificateAuthorities=${JSON.stringify([CA_CERT_PATH, pkiKibanaCAPath])}`,
+        `--server.ssl.clientAuthentication=optional`,
+        `--elasticsearch.hosts=${servers.elasticsearch.protocol}://${servers.elasticsearch.hostname}:${servers.elasticsearch.port}`,
+        `--elasticsearch.ssl.certificateAuthorities=${CA_CERT_PATH}`,
+        `--xpack.security.authc.providers=${JSON.stringify({
+          basic: { basic1: { order: 0 } },
+          kerberos: { kerberos1: { order: 4 } },
+          pki: { pki1: { order: 2 } },
+          oidc: { oidc1: { order: 3, realm: 'oidc1' } },
+          saml: {
+            saml1: { order: 1, realm: 'saml1' },
+            saml2: { order: 5, realm: 'saml2', maxRedirectURLSize: '100b' },
+          },
+        })}`,
+        '--server.xsrf.whitelist',
+        JSON.stringify([
+          '/api/oidc_provider/token_endpoint',
+          '/api/oidc_provider/userinfo_endpoint',
+        ]),
+      ],
+    },
+  };
+}
diff --git a/x-pack/test/login_selector_api_integration/ftr_provider_context.d.ts b/x-pack/test/login_selector_api_integration/ftr_provider_context.d.ts
new file mode 100644
index 0000000000000..e3add3748f56d
--- /dev/null
+++ b/x-pack/test/login_selector_api_integration/ftr_provider_context.d.ts
@@ -0,0 +1,11 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { GenericFtrProviderContext } from '@kbn/test/types/ftr';
+
+import { services } from './services';
+
+export type FtrProviderContext = GenericFtrProviderContext<typeof services, {}>;
diff --git a/x-pack/test/login_selector_api_integration/services.ts b/x-pack/test/login_selector_api_integration/services.ts
new file mode 100644
index 0000000000000..8bb2dae90bf59
--- /dev/null
+++ b/x-pack/test/login_selector_api_integration/services.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { services as commonServices } from '../common/services';
+import { services as apiIntegrationServices } from '../api_integration/services';
+
+export const services = {
+  ...commonServices,
+  randomness: apiIntegrationServices.randomness,
+  supertestWithoutAuth: apiIntegrationServices.supertestWithoutAuth,
+};
diff --git a/x-pack/test/pki_api_integration/apis/security/pki_auth.ts b/x-pack/test/pki_api_integration/apis/security/pki_auth.ts
index fe772a3b1d460..ac16335b7f466 100644
--- a/x-pack/test/pki_api_integration/apis/security/pki_auth.ts
+++ b/x-pack/test/pki_api_integration/apis/security/pki_auth.ts
@@ -9,7 +9,6 @@ import request, { Cookie } from 'request';
 import { delay } from 'bluebird';
 import { readFileSync } from 'fs';
 import { resolve } from 'path';
-// @ts-ignore
 import { CA_CERT_PATH } from '@kbn/dev-utils';
 import { FtrProviderContext } from '../../ftr_provider_context';
 
diff --git a/x-pack/test/pki_api_integration/config.ts b/x-pack/test/pki_api_integration/config.ts
index 21ae1b40efa16..8177e4aa1afba 100644
--- a/x-pack/test/pki_api_integration/config.ts
+++ b/x-pack/test/pki_api_integration/config.ts
@@ -6,7 +6,6 @@
 
 import { resolve } from 'path';
 import { FtrConfigProviderContext } from '@kbn/test/types/ftr';
-// @ts-ignore
 import { CA_CERT_PATH, KBN_CERT_PATH, KBN_KEY_PATH } from '@kbn/dev-utils';
 import { services } from './services';
 
diff --git a/x-pack/test/saml_api_integration/apis/security/saml_login.ts b/x-pack/test/saml_api_integration/apis/security/saml_login.ts
index 1ad367e8bc08d..35f778e124da0 100644
--- a/x-pack/test/saml_api_integration/apis/security/saml_login.ts
+++ b/x-pack/test/saml_api_integration/apis/security/saml_login.ts
@@ -108,11 +108,15 @@ export default function({ getService }: FtrProviderContext) {
         expect(handshakeCookie.path).to.be('/');
         expect(handshakeCookie.httpOnly).to.be(true);
 
-        expect(handshakeResponse.headers.location).to.be('/api/security/saml/capture-url-fragment');
+        expect(handshakeResponse.headers.location).to.be(
+          '/internal/security/saml/capture-url-fragment'
+        );
       });
 
       it('should return an HTML page that will extract URL fragment', async () => {
-        const response = await supertest.get('/api/security/saml/capture-url-fragment').expect(200);
+        const response = await supertest
+          .get('/internal/security/saml/capture-url-fragment')
+          .expect(200);
 
         const kibanaBaseURL = url.format({ ...config.get('servers.kibana'), auth: false });
         const dom = new JSDOM(response.text, {
@@ -127,7 +131,7 @@ export default function({ getService }: FtrProviderContext) {
               Object.defineProperty(window, 'location', {
                 value: {
                   hash: '#/workpad',
-                  href: `${kibanaBaseURL}/api/security/saml/capture-url-fragment#/workpad`,
+                  href: `${kibanaBaseURL}/internal/security/saml/capture-url-fragment#/workpad`,
                   replace(newLocation: string) {
                     this.href = newLocation;
                     resolve();
@@ -149,13 +153,13 @@ export default function({ getService }: FtrProviderContext) {
 
         // Check that script that forwards URL fragment worked correctly.
         expect(dom.window.location.href).to.be(
-          '/api/security/saml/start?redirectURLFragment=%23%2Fworkpad'
+          '/internal/security/saml/start?redirectURLFragment=%23%2Fworkpad'
         );
       });
     });
 
     describe('initiating handshake', () => {
-      const initiateHandshakeURL = `/api/security/saml/start?redirectURLFragment=%23%2Fworkpad`;
+      const initiateHandshakeURL = `/internal/security/saml/start?redirectURLFragment=%23%2Fworkpad`;
 
       let captureURLCookie: Cookie;
       beforeEach(async () => {
@@ -202,9 +206,8 @@ export default function({ getService }: FtrProviderContext) {
 
       it('AJAX requests should not initiate handshake', async () => {
         const ajaxResponse = await supertest
-          .get(initiateHandshakeURL)
+          .get('/abc/xyz/handshake?one=two three')
           .set('kbn-xsrf', 'xxx')
-          .set('Cookie', captureURLCookie.cookieString())
           .expect(401);
 
         expect(ajaxResponse.headers['set-cookie']).to.be(undefined);
@@ -222,7 +225,7 @@ export default function({ getService }: FtrProviderContext) {
         const captureURLCookie = request.cookie(captureURLResponse.headers['set-cookie'][0])!;
 
         const handshakeResponse = await supertest
-          .get(`/api/security/saml/start?redirectURLFragment=%23%2Fworkpad`)
+          .get(`/internal/security/saml/start?redirectURLFragment=%23%2Fworkpad`)
           .set('Cookie', captureURLCookie.cookieString())
           .expect(302);
 
@@ -360,7 +363,9 @@ export default function({ getService }: FtrProviderContext) {
         const captureURLCookie = request.cookie(captureURLResponse.headers['set-cookie'][0])!;
 
         const handshakeResponse = await supertest
-          .get(`/api/security/saml/start?redirectURLFragment=${encodeURIComponent('#workpad')}`)
+          .get(
+            `/internal/security/saml/start?redirectURLFragment=${encodeURIComponent('#workpad')}`
+          )
           .set('Cookie', captureURLCookie.cookieString())
           .expect(302);
 
@@ -515,7 +520,9 @@ export default function({ getService }: FtrProviderContext) {
         const captureURLCookie = request.cookie(captureURLResponse.headers['set-cookie'][0])!;
 
         const handshakeResponse = await supertest
-          .get(`/api/security/saml/start?redirectURLFragment=${encodeURIComponent('#workpad')}`)
+          .get(
+            `/internal/security/saml/start?redirectURLFragment=${encodeURIComponent('#workpad')}`
+          )
           .set('Cookie', captureURLCookie.cookieString())
           .expect(302);
 
@@ -603,7 +610,9 @@ export default function({ getService }: FtrProviderContext) {
         const captureURLCookie = request.cookie(captureURLResponse.headers['set-cookie'][0])!;
 
         const handshakeResponse = await supertest
-          .get(`/api/security/saml/start?redirectURLFragment=${encodeURIComponent('#workpad')}`)
+          .get(
+            `/internal/security/saml/start?redirectURLFragment=${encodeURIComponent('#workpad')}`
+          )
           .set('Cookie', captureURLCookie.cookieString())
           .expect(302);
 
@@ -647,7 +656,9 @@ export default function({ getService }: FtrProviderContext) {
         expect(handshakeCookie.path).to.be('/');
         expect(handshakeCookie.httpOnly).to.be(true);
 
-        expect(handshakeResponse.headers.location).to.be('/api/security/saml/capture-url-fragment');
+        expect(handshakeResponse.headers.location).to.be(
+          '/internal/security/saml/capture-url-fragment'
+        );
       });
     });
 
@@ -662,7 +673,9 @@ export default function({ getService }: FtrProviderContext) {
         const captureURLCookie = request.cookie(captureURLResponse.headers['set-cookie'][0])!;
 
         const handshakeResponse = await supertest
-          .get(`/api/security/saml/start?redirectURLFragment=${encodeURIComponent('#workpad')}`)
+          .get(
+            `/internal/security/saml/start?redirectURLFragment=${encodeURIComponent('#workpad')}`
+          )
           .set('Cookie', captureURLCookie.cookieString())
           .expect(302);
 
@@ -798,12 +811,12 @@ export default function({ getService }: FtrProviderContext) {
         const captureURLCookie = request.cookie(captureURLResponse.headers['set-cookie'][0])!;
 
         expect(captureURLResponse.headers.location).to.be(
-          '/api/security/saml/capture-url-fragment'
+          '/internal/security/saml/capture-url-fragment'
         );
 
         // 2. Initiate SAML handshake.
         const handshakeResponse = await supertest
-          .get(`/api/security/saml/start?redirectURLFragment=%23%2F${'workpad'.repeat(10)}`)
+          .get(`/internal/security/saml/start?redirectURLFragment=%23%2F${'workpad'.repeat(10)}`)
           .set('Cookie', captureURLCookie.cookieString())
           .expect(302);
 
diff --git a/x-pack/test/saml_api_integration/config.ts b/x-pack/test/saml_api_integration/config.ts
index 29415f03d580f..b7457d44702f3 100644
--- a/x-pack/test/saml_api_integration/config.ts
+++ b/x-pack/test/saml_api_integration/config.ts
@@ -37,7 +37,7 @@ export default async function({ readConfigFile }: FtrConfigProviderContext) {
         'xpack.security.authc.token.timeout=15s',
         'xpack.security.authc.realms.saml.saml1.order=0',
         `xpack.security.authc.realms.saml.saml1.idp.metadata.path=${idpPath}`,
-        'xpack.security.authc.realms.saml.saml1.idp.entity_id=http://www.elastic.co',
+        'xpack.security.authc.realms.saml.saml1.idp.entity_id=http://www.elastic.co/saml1',
         `xpack.security.authc.realms.saml.saml1.sp.entity_id=http://localhost:${kibanaPort}`,
         `xpack.security.authc.realms.saml.saml1.sp.logout=http://localhost:${kibanaPort}/logout`,
         `xpack.security.authc.realms.saml.saml1.sp.acs=http://localhost:${kibanaPort}/api/security/v1/saml`,
diff --git a/x-pack/test/saml_api_integration/fixtures/idp_metadata.xml b/x-pack/test/saml_api_integration/fixtures/idp_metadata.xml
index a890fe812987b..57b9e824c9d53 100644
--- a/x-pack/test/saml_api_integration/fixtures/idp_metadata.xml
+++ b/x-pack/test/saml_api_integration/fixtures/idp_metadata.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
-                     entityID="http://www.elastic.co">
+                     entityID="http://www.elastic.co/saml1">
   <md:IDPSSODescriptor WantAuthnRequestsSigned="false"
                        protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
     <md:KeyDescriptor use="signing">
diff --git a/x-pack/test/saml_api_integration/fixtures/idp_metadata_2.xml b/x-pack/test/saml_api_integration/fixtures/idp_metadata_2.xml
new file mode 100644
index 0000000000000..ff67779d7732c
--- /dev/null
+++ b/x-pack/test/saml_api_integration/fixtures/idp_metadata_2.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+                     entityID="http://www.elastic.co/saml2">
+  <md:IDPSSODescriptor WantAuthnRequestsSigned="false"
+                       protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:KeyDescriptor use="signing">
+      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:X509Data>
+          <!-- This certificate is extracted from KBN_CERT_PATH in @kbn/dev-utils and should always be in sync with it -->
+          <ds:X509Certificate>MIIDOTCCAiGgAwIBAgIVANNWkg9lzNiLqNkMFhFKHcXyaZmqMA0GCSqGSIb3DQEB
+CwUAMDQxMjAwBgNVBAMTKUVsYXN0aWMgQ2VydGlmaWNhdGUgVG9vbCBBdXRvZ2Vu
+ZXJhdGVkIENBMCAXDTE5MTIyNzE3MDM0MloYDzIwNjkxMjE0MTcwMzQyWjARMQ8w
+DQYDVQQDEwZraWJhbmEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCQ
+wYYbQtbRBKJ4uNZc2+IgRU+7NNL21ZebQlEIMgK7jAqOMrsW2b5DATz41Fd+GQFU
+FUYYjwo+PQj6sJHshOJo/gNb32HrydvMI7YPvevkszkuEGCfXxQ3Dw2RTACLgD0Q
+OCkwHvn3TMf0loloV/ePGWaZDYZaXi3a5DdWi/HFFoJysgF0JV2f6XyKhJkGaEfJ
+s9pWX269zH/XQvGNx4BEimJpYB8h4JnDYPFIiQdqj+sl2b+kS1hH9kL5gBAMXjFU
+vcNnX+PmyTjyJrGo75k0ku+spBf1bMwuQt3uSmM+TQIXkvFDmS0DOVESrpA5EC1T
+BUGRz6o/I88Xx4Mud771AgMBAAGjYzBhMB0GA1UdDgQWBBQLB1Eo23M3Ss8MsFaz
+V+Twcb3PmDAfBgNVHSMEGDAWgBQa7SYOe8NGcF00EbwPHA91YCsHSTAUBgNVHREE
+DTALgglsb2NhbGhvc3QwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAQEAnEl/
+z5IElIjvkK4AgMPrNcRlvIGDt2orEik7b6Jsq6/RiJQ7cSsYTZf7xbqyxNsUOTxv
++frj47MEN448H2nRvUxH29YR3XygV5aEwADSAhwaQWn0QfWTCZbJTmSoNEDtDOzX
+TGDlAoCD9s9Xz9S1JpxY4H+WWRZrBSDM6SC1c6CzuEeZRuScNAjYD5mh2v6fOlSy
+b8xJWSg0AFlJPCa3ZsA2SKbNqI0uNfJTnkXRm88Z2NHcgtlADbOLKauWfCrpgsCk
+cZgo6yAYkOM148h/8wGla1eX+iE1R72NUABGydu8MSQKvc0emWJkGsC1/KqPlf/O
+eOUsdwn1yDKHRxDHyA==
+          </ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </md:KeyDescriptor>
+    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+                            Location="https://elastic.co/slo/saml"/>
+    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+                            Location="https://elastic.co/slo/saml"/>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+                            Location="https://elastic.co/sso/saml"/>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+                            Location="https://elastic.co/sso/saml"/>
+  </md:IDPSSODescriptor>
+</md:EntityDescriptor>
diff --git a/x-pack/test/saml_api_integration/fixtures/saml_tools.ts b/x-pack/test/saml_api_integration/fixtures/saml_tools.ts
index bbe0df7ff3a2c..a924d0964c245 100644
--- a/x-pack/test/saml_api_integration/fixtures/saml_tools.ts
+++ b/x-pack/test/saml_api_integration/fixtures/saml_tools.ts
@@ -45,14 +45,21 @@ export async function getSAMLResponse({
   inResponseTo,
   sessionIndex,
   username = 'a@b.c',
-}: { destination?: string; inResponseTo?: string; sessionIndex?: string; username?: string } = {}) {
+  issuer = 'http://www.elastic.co/saml1',
+}: {
+  destination?: string;
+  inResponseTo?: string;
+  sessionIndex?: string;
+  username?: string;
+  issuer?: string;
+} = {}) {
   const issueInstant = new Date().toISOString();
   const notOnOrAfter = new Date(Date.now() + 3600 * 1000).toISOString();
 
   const samlAssertionTemplateXML = `
     <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0"
                     ID="_RPs1WfOkul8lZ72DtJtes0BKyPgaCamg" IssueInstant="${issueInstant}">
-      <saml:Issuer>http://www.elastic.co</saml:Issuer>
+      <saml:Issuer>${issuer}</saml:Issuer>
       <saml:Subject>
         <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">a@b.c</saml:NameID>
         <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
@@ -99,7 +106,7 @@ export async function getSAMLResponse({
                   ${inResponseTo ? `InResponseTo="${inResponseTo}"` : ''} Version="2.0"
                   IssueInstant="${issueInstant}"
                   Destination="${destination}">
-      <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://www.elastic.co</saml:Issuer>
+      <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">${issuer}</saml:Issuer>
       <samlp:Status>
         <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
       </samlp:Status>${signature.getSignedXml()}
@@ -111,9 +118,11 @@ export async function getSAMLResponse({
 export async function getLogoutRequest({
   destination,
   sessionIndex,
+  issuer = 'http://www.elastic.co/saml1',
 }: {
   destination: string;
   sessionIndex: string;
+  issuer?: string;
 }) {
   const issueInstant = new Date().toISOString();
   const logoutRequestTemplateXML = `
@@ -121,7 +130,7 @@ export async function getLogoutRequest({
                          Destination="${destination}"
                          Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
                          xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
-      <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://www.elastic.co</Issuer>
+      <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">${issuer}</Issuer>
       <NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion"
               Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">a@b.c</NameID>
       <samlp:SessionIndex>${sessionIndex}</samlp:SessionIndex>
diff --git a/x-pack/test/siem_cypress/es_archives/closed_signals/data.json.gz b/x-pack/test/siem_cypress/es_archives/closed_signals/data.json.gz
new file mode 100644
index 0000000000000..117c829b31d6e
Binary files /dev/null and b/x-pack/test/siem_cypress/es_archives/closed_signals/data.json.gz differ
diff --git a/x-pack/test/siem_cypress/es_archives/closed_signals/mappings.json b/x-pack/test/siem_cypress/es_archives/closed_signals/mappings.json
new file mode 100644
index 0000000000000..94d89ed55dd8a
--- /dev/null
+++ b/x-pack/test/siem_cypress/es_archives/closed_signals/mappings.json
@@ -0,0 +1,7605 @@
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      ".siem-signals-default": {
+        "is_write_index": true
+      }
+    },
+    "index": ".siem-signals-default-000001",
+    "mappings": {
+      "dynamic": "false",
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "doc_values": false,
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "integer"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "doc_values": false,
+              "ignore_above": 1024,
+              "index": false,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "signal": {
+          "properties": {
+            "ancestors": {
+              "properties": {
+                "depth": {
+                  "type": "long"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "rule": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "original_event": {
+              "properties": {
+                "action": {
+                  "type": "keyword"
+                },
+                "category": {
+                  "type": "keyword"
+                },
+                "code": {
+                  "type": "keyword"
+                },
+                "created": {
+                  "type": "date"
+                },
+                "dataset": {
+                  "type": "keyword"
+                },
+                "duration": {
+                  "type": "long"
+                },
+                "end": {
+                  "type": "date"
+                },
+                "hash": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "kind": {
+                  "type": "keyword"
+                },
+                "module": {
+                  "type": "keyword"
+                },
+                "original": {
+                  "doc_values": false,
+                  "index": false,
+                  "type": "keyword"
+                },
+                "outcome": {
+                  "type": "keyword"
+                },
+                "provider": {
+                  "type": "keyword"
+                },
+                "risk_score": {
+                  "type": "float"
+                },
+                "risk_score_norm": {
+                  "type": "float"
+                },
+                "sequence": {
+                  "type": "long"
+                },
+                "severity": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "timezone": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "original_time": {
+              "type": "date"
+            },
+            "parent": {
+              "properties": {
+                "depth": {
+                  "type": "long"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "index": {
+                  "type": "keyword"
+                },
+                "rule": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "rule": {
+              "properties": {
+                "created_at": {
+                  "type": "date"
+                },
+                "created_by": {
+                  "type": "keyword"
+                },
+                "description": {
+                  "type": "keyword"
+                },
+                "enabled": {
+                  "type": "keyword"
+                },
+                "false_positives": {
+                  "type": "keyword"
+                },
+                "filters": {
+                  "type": "object"
+                },
+                "from": {
+                  "type": "keyword"
+                },
+                "id": {
+                  "type": "keyword"
+                },
+                "immutable": {
+                  "type": "keyword"
+                },
+                "index": {
+                  "type": "keyword"
+                },
+                "interval": {
+                  "type": "keyword"
+                },
+                "language": {
+                  "type": "keyword"
+                },
+                "max_signals": {
+                  "type": "keyword"
+                },
+                "name": {
+                  "type": "keyword"
+                },
+                "note": {
+                  "type": "text"
+                },
+                "output_index": {
+                  "type": "keyword"
+                },
+                "query": {
+                  "type": "keyword"
+                },
+                "references": {
+                  "type": "keyword"
+                },
+                "risk_score": {
+                  "type": "keyword"
+                },
+                "rule_id": {
+                  "type": "keyword"
+                },
+                "saved_id": {
+                  "type": "keyword"
+                },
+                "severity": {
+                  "type": "keyword"
+                },
+                "size": {
+                  "type": "keyword"
+                },
+                "tags": {
+                  "type": "keyword"
+                },
+                "threat": {
+                  "properties": {
+                    "framework": {
+                      "type": "keyword"
+                    },
+                    "tactic": {
+                      "properties": {
+                        "id": {
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "type": "keyword"
+                        },
+                        "reference": {
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "technique": {
+                      "properties": {
+                        "id": {
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "type": "keyword"
+                        },
+                        "reference": {
+                          "type": "keyword"
+                        }
+                      }
+                    }
+                  }
+                },
+                "timeline_id": {
+                  "type": "keyword"
+                },
+                "timeline_title": {
+                  "type": "keyword"
+                },
+                "to": {
+                  "type": "keyword"
+                },
+                "type": {
+                  "type": "keyword"
+                },
+                "updated_at": {
+                  "type": "date"
+                },
+                "updated_by": {
+                  "type": "keyword"
+                },
+                "version": {
+                  "type": "keyword"
+                }
+              }
+            },
+            "status": {
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "trace": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "transaction": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "lifecycle": {
+          "name": ".siem-signals-default",
+          "rollover_alias": ".siem-signals-default"
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1"
+      }
+    }
+  }
+}
+
+{
+  "type": "index",
+  "value": {
+    "aliases": {
+      "auditbeat-7.6.0": {
+        "is_write_index": true
+      }
+    },
+    "index": "auditbeat-7.6.0-2020.03.11-000001",
+    "mappings": {
+      "_meta": {
+        "beat": "auditbeat",
+        "version": "7.6.0"
+      },
+      "date_detection": false,
+      "dynamic_templates": [
+        {
+          "labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "labels.*"
+          }
+        },
+        {
+          "container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "container.labels.*"
+          }
+        },
+        {
+          "dns.answers": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "dns.answers.*"
+          }
+        },
+        {
+          "log.syslog": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "log.syslog.*"
+          }
+        },
+        {
+          "fields": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "fields.*"
+          }
+        },
+        {
+          "docker.container.labels": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "match_mapping_type": "string",
+            "path_match": "docker.container.labels.*"
+          }
+        },
+        {
+          "kubernetes.labels.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.labels.*"
+          }
+        },
+        {
+          "kubernetes.annotations.*": {
+            "mapping": {
+              "type": "keyword"
+            },
+            "path_match": "kubernetes.annotations.*"
+          }
+        },
+        {
+          "strings_as_keyword": {
+            "mapping": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "match_mapping_type": "string"
+          }
+        }
+      ],
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "auditd": {
+          "properties": {
+            "data": {
+              "properties": {
+                "a0": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a2": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "a[0-3]": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "acct": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "acl": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "action": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "added": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "addr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "apparmor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "arch": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "argc": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_backlog_limit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_backlog_wait_time": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_enabled": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "audit_failure": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "banners": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bool": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "bus": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_fver": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_pe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_pi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cap_pp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "capability": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cgroup": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "changed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cipher": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "cmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "compat": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "daddr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "default-context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "device": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dir": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "direction": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dmac": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "dport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "enforcing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "entries": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fam": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "feature": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "file": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "flags": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "format": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "fver": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "grantors": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "grp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hook": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hostname": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "icmp_type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "igid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "img-ctx": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inif": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ino": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inode_gid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inode_uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "invalid_context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ioctlcmd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ip": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ipid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ipx-net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "items": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "iuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kind": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ksize": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "laddr": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "len": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "list": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "lport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mac": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "macproto": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "maj": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "major": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "minor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "model": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "msg": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nargs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-chardev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-disk": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-enabled": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-log_passwd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-mem": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-range": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-rng": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-seuser": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new-vcpu": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_gid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_lock": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_pe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_pi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "new_pp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nlnk-fam": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nlnk-grp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nlnk-pid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "oauid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_gid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ocomm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "oflag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-auid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-chardev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-disk": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-enabled": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-fs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-log_passwd": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-mem": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-net": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-range": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-rng": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-seuser": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old-vcpu": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_enforcing": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_lock": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_pe": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_pi": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_pp": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_prom": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "old_val": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "op": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "opid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "oses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "outif": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "parent": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "per": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "perm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "perm_mask": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "permissive": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pfs": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "printer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "prom": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "proto": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "qbytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "range": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reason": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "removed": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "res": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "resrc": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sauid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "scontext": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "selected-context": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seperm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seperms": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seqno": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seresult": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ses": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "seuser": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sig": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sigev_signo": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "smac": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "socket": {
+                  "properties": {
+                    "addr": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "family": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "path": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "port": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "saddr": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "spid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sport": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "state": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subj": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "success": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "syscall": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "table": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tclass": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tcontext": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "terminal": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tty": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "unit": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uri": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uuid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "val": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ver": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "virt": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vm": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vm-ctx": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vm-pid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "watch": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "message_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "paths": {
+              "properties": {
+                "dev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "inode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "item": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "mode": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "nametype": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "obj_user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "objtype": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ogid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ouid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "rdev": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "result": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "session": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "summary": {
+              "properties": {
+                "actor": {
+                  "properties": {
+                    "primary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "secondary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "how": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "object": {
+                  "properties": {
+                    "primary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "secondary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "type": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "client": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "cloud": {
+          "properties": {
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "tag": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "type": "object"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "runtime": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "destination": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "dns": {
+          "properties": {
+            "answers": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "data": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ttl": {
+                  "type": "long"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "header_flags": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "op_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "question": {
+              "properties": {
+                "class": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "registered_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subdomain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "top_level_domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "resolved_ip": {
+              "type": "ip"
+            },
+            "response_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "docker": {
+          "properties": {
+            "container": {
+              "properties": {
+                "labels": {
+                  "type": "object"
+                }
+              }
+            }
+          }
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "error": {
+          "properties": {
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "message": {
+              "norms": false,
+              "type": "text"
+            },
+            "stack_trace": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "action": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "dataset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "duration": {
+              "type": "long"
+            },
+            "end": {
+              "type": "date"
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ingested": {
+              "type": "date"
+            },
+            "kind": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "module": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "outcome": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "risk_score": {
+              "type": "float"
+            },
+            "risk_score_norm": {
+              "type": "float"
+            },
+            "sequence": {
+              "type": "long"
+            },
+            "severity": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "timezone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "fields": {
+          "type": "object"
+        },
+        "file": {
+          "properties": {
+            "accessed": {
+              "type": "date"
+            },
+            "attributes": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "created": {
+              "type": "date"
+            },
+            "ctime": {
+              "type": "date"
+            },
+            "device": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "directory": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "drive_letter": {
+              "ignore_above": 1,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "gid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "hash": {
+              "properties": {
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "inode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "fields": {
+                "raw": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "selinux": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "setgid": {
+              "type": "boolean"
+            },
+            "setuid": {
+              "type": "boolean"
+            },
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "geoip": {
+          "properties": {
+            "city_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "continent_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "country_iso_code": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "location": {
+              "type": "geo_point"
+            },
+            "region_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "group": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "hash": {
+          "properties": {
+            "blake2b_256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "blake2b_384": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "blake2b_512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha224": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha384": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha3_224": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha3_256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha3_384": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha3_512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512_224": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512_256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "xxh64": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "http": {
+          "properties": {
+            "request": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "method": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "referrer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "response": {
+              "properties": {
+                "body": {
+                  "properties": {
+                    "bytes": {
+                      "type": "long"
+                    },
+                    "content": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "bytes": {
+                  "type": "long"
+                },
+                "status_code": {
+                  "type": "long"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "jolokia": {
+          "properties": {
+            "agent": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "secured": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "product": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "url": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "kubernetes": {
+          "properties": {
+            "annotations": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "container": {
+              "properties": {
+                "image": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "deployment": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "labels": {
+              "properties": {
+                "*": {
+                  "type": "object"
+                }
+              }
+            },
+            "namespace": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pod": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uid": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "replicaset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "statefulset": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "labels": {
+          "type": "object"
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "logger": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "origin": {
+              "properties": {
+                "file": {
+                  "properties": {
+                    "line": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "function": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "original": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "syslog": {
+              "properties": {
+                "facility": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "priority": {
+                  "type": "long"
+                },
+                "severity": {
+                  "properties": {
+                    "code": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "message": {
+          "norms": false,
+          "type": "text"
+        },
+        "network": {
+          "properties": {
+            "application": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "community_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "direction": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "forwarded_ip": {
+              "type": "ip"
+            },
+            "iana_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "packets": {
+              "type": "long"
+            },
+            "protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "transport": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "vendor": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "organization": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "os": {
+          "properties": {
+            "family": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "kernel": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "install_scope": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "installed": {
+              "type": "date"
+            },
+            "license": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "size": {
+              "type": "long"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "process": {
+          "properties": {
+            "args": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "args_count": {
+              "type": "long"
+            },
+            "command_line": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "executable": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "exit_code": {
+              "type": "long"
+            },
+            "hash": {
+              "properties": {
+                "blake2b_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "blake2b_384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "blake2b_512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "md5": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha1": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_384": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha3_512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512_224": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "sha512_256": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "xxh64": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "parent": {
+              "properties": {
+                "args": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "args_count": {
+                  "type": "long"
+                },
+                "command_line": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "executable": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "exit_code": {
+                  "type": "long"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "pgid": {
+                  "type": "long"
+                },
+                "pid": {
+                  "type": "long"
+                },
+                "ppid": {
+                  "type": "long"
+                },
+                "start": {
+                  "type": "date"
+                },
+                "thread": {
+                  "properties": {
+                    "id": {
+                      "type": "long"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "title": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "uptime": {
+                  "type": "long"
+                },
+                "working_directory": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "pgid": {
+              "type": "long"
+            },
+            "pid": {
+              "type": "long"
+            },
+            "ppid": {
+              "type": "long"
+            },
+            "start": {
+              "type": "date"
+            },
+            "thread": {
+              "properties": {
+                "id": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "title": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uptime": {
+              "type": "long"
+            },
+            "working_directory": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "registry": {
+          "properties": {
+            "data": {
+              "properties": {
+                "bytes": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "strings": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hive": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "key": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "value": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "related": {
+          "properties": {
+            "ip": {
+              "type": "ip"
+            },
+            "user": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "rule": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "ruleset": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "uuid": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "server": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "service": {
+          "properties": {
+            "ephemeral_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "node": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "state": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "socket": {
+          "properties": {
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "source": {
+          "properties": {
+            "address": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "as": {
+              "properties": {
+                "number": {
+                  "type": "long"
+                },
+                "organization": {
+                  "properties": {
+                    "name": {
+                      "fields": {
+                        "text": {
+                          "norms": false,
+                          "type": "text"
+                        }
+                      },
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            },
+            "bytes": {
+              "type": "long"
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "geo": {
+              "properties": {
+                "city_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "continent_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "country_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "location": {
+                  "type": "geo_point"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_iso_code": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "region_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
+                },
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "group": {
+                  "properties": {
+                    "domain": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "system": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "host": {
+                  "properties": {
+                    "architecture": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "boottime": {
+                      "type": "date"
+                    },
+                    "containerized": {
+                      "type": "boolean"
+                    },
+                    "hostname": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "ip": {
+                      "type": "ip"
+                    },
+                    "mac": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "os": {
+                      "properties": {
+                        "codename": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "family": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "kernel": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "platform": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "version": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "timezone": {
+                      "properties": {
+                        "name": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        },
+                        "offset": {
+                          "properties": {
+                            "sec": {
+                              "type": "long"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "uptime": {
+                      "type": "long"
+                    }
+                  }
+                },
+                "package": {
+                  "properties": {
+                    "arch": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "entity_id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "installtime": {
+                      "type": "date"
+                    },
+                    "license": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "release": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "size": {
+                      "type": "long"
+                    },
+                    "summary": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "url": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "version": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "user": {
+                  "properties": {
+                    "dir": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "gid": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "group": {
+                      "type": "object"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "password": {
+                      "properties": {
+                        "last_changed": {
+                          "type": "date"
+                        },
+                        "type": {
+                          "ignore_above": 1024,
+                          "type": "keyword"
+                        }
+                      }
+                    },
+                    "shell": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "uid": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "user_information": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
+        "threat": {
+          "properties": {
+            "framework": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "tactic": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "technique": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "reference": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "timeseries": {
+          "properties": {
+            "instance": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tls": {
+          "properties": {
+            "cipher": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "client": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "server_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "supported_ciphers": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "curve": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "established": {
+              "type": "boolean"
+            },
+            "next_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "resumed": {
+              "type": "boolean"
+            },
+            "server": {
+              "properties": {
+                "certificate": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "certificate_chain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "hash": {
+                  "properties": {
+                    "md5": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha1": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "sha256": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "issuer": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "ja3s": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "not_after": {
+                  "type": "date"
+                },
+                "not_before": {
+                  "type": "date"
+                },
+                "subject": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version_protocol": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "tracing": {
+          "properties": {
+            "trace": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "transaction": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
+        "url": {
+          "properties": {
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "extension": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "fragment": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "password": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "port": {
+              "type": "long"
+            },
+            "query": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scheme": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "username": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user": {
+          "properties": {
+            "audit": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "effective": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "email": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "entity_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "filesystem": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "full_name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "group": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "hash": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name_map": {
+              "type": "object"
+            },
+            "saved": {
+              "properties": {
+                "group": {
+                  "properties": {
+                    "id": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    },
+                    "name": {
+                      "ignore_above": 1024,
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "selinux": {
+              "properties": {
+                "category": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "level": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "role": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "user": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "terminal": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "user_agent": {
+          "properties": {
+            "device": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "os": {
+              "properties": {
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "vulnerability": {
+          "properties": {
+            "category": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "classification": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "enumeration": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "reference": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "report_id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "scanner": {
+              "properties": {
+                "vendor": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "score": {
+              "properties": {
+                "base": {
+                  "type": "float"
+                },
+                "environmental": {
+                  "type": "float"
+                },
+                "temporal": {
+                  "type": "float"
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "severity": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
+      }
+    },
+    "settings": {
+      "index": {
+        "lifecycle": {
+          "name": "auditbeat",
+          "rollover_alias": "auditbeat-7.6.0"
+        },
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "number_of_replicas": "1",
+        "number_of_shards": "1",
+        "query": {
+          "default_field": [
+            "message",
+            "tags",
+            "agent.ephemeral_id",
+            "agent.id",
+            "agent.name",
+            "agent.type",
+            "agent.version",
+            "as.organization.name",
+            "client.address",
+            "client.as.organization.name",
+            "client.domain",
+            "client.geo.city_name",
+            "client.geo.continent_name",
+            "client.geo.country_iso_code",
+            "client.geo.country_name",
+            "client.geo.name",
+            "client.geo.region_iso_code",
+            "client.geo.region_name",
+            "client.mac",
+            "client.registered_domain",
+            "client.top_level_domain",
+            "client.user.domain",
+            "client.user.email",
+            "client.user.full_name",
+            "client.user.group.domain",
+            "client.user.group.id",
+            "client.user.group.name",
+            "client.user.hash",
+            "client.user.id",
+            "client.user.name",
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "container.id",
+            "container.image.name",
+            "container.image.tag",
+            "container.name",
+            "container.runtime",
+            "destination.address",
+            "destination.as.organization.name",
+            "destination.domain",
+            "destination.geo.city_name",
+            "destination.geo.continent_name",
+            "destination.geo.country_iso_code",
+            "destination.geo.country_name",
+            "destination.geo.name",
+            "destination.geo.region_iso_code",
+            "destination.geo.region_name",
+            "destination.mac",
+            "destination.registered_domain",
+            "destination.top_level_domain",
+            "destination.user.domain",
+            "destination.user.email",
+            "destination.user.full_name",
+            "destination.user.group.domain",
+            "destination.user.group.id",
+            "destination.user.group.name",
+            "destination.user.hash",
+            "destination.user.id",
+            "destination.user.name",
+            "dns.answers.class",
+            "dns.answers.data",
+            "dns.answers.name",
+            "dns.answers.type",
+            "dns.header_flags",
+            "dns.id",
+            "dns.op_code",
+            "dns.question.class",
+            "dns.question.name",
+            "dns.question.registered_domain",
+            "dns.question.subdomain",
+            "dns.question.top_level_domain",
+            "dns.question.type",
+            "dns.response_code",
+            "dns.type",
+            "ecs.version",
+            "error.code",
+            "error.id",
+            "error.message",
+            "error.stack_trace",
+            "error.type",
+            "event.action",
+            "event.category",
+            "event.code",
+            "event.dataset",
+            "event.hash",
+            "event.id",
+            "event.kind",
+            "event.module",
+            "event.original",
+            "event.outcome",
+            "event.provider",
+            "event.timezone",
+            "event.type",
+            "file.device",
+            "file.directory",
+            "file.extension",
+            "file.gid",
+            "file.group",
+            "file.hash.md5",
+            "file.hash.sha1",
+            "file.hash.sha256",
+            "file.hash.sha512",
+            "file.inode",
+            "file.mode",
+            "file.name",
+            "file.owner",
+            "file.path",
+            "file.target_path",
+            "file.type",
+            "file.uid",
+            "geo.city_name",
+            "geo.continent_name",
+            "geo.country_iso_code",
+            "geo.country_name",
+            "geo.name",
+            "geo.region_iso_code",
+            "geo.region_name",
+            "group.domain",
+            "group.id",
+            "group.name",
+            "hash.md5",
+            "hash.sha1",
+            "hash.sha256",
+            "hash.sha512",
+            "host.architecture",
+            "host.geo.city_name",
+            "host.geo.continent_name",
+            "host.geo.country_iso_code",
+            "host.geo.country_name",
+            "host.geo.name",
+            "host.geo.region_iso_code",
+            "host.geo.region_name",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.full",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.type",
+            "host.user.domain",
+            "host.user.email",
+            "host.user.full_name",
+            "host.user.group.domain",
+            "host.user.group.id",
+            "host.user.group.name",
+            "host.user.hash",
+            "host.user.id",
+            "host.user.name",
+            "http.request.body.content",
+            "http.request.method",
+            "http.request.referrer",
+            "http.response.body.content",
+            "http.version",
+            "log.level",
+            "log.logger",
+            "log.origin.file.name",
+            "log.origin.function",
+            "log.original",
+            "log.syslog.facility.name",
+            "log.syslog.severity.name",
+            "network.application",
+            "network.community_id",
+            "network.direction",
+            "network.iana_number",
+            "network.name",
+            "network.protocol",
+            "network.transport",
+            "network.type",
+            "observer.geo.city_name",
+            "observer.geo.continent_name",
+            "observer.geo.country_iso_code",
+            "observer.geo.country_name",
+            "observer.geo.name",
+            "observer.geo.region_iso_code",
+            "observer.geo.region_name",
+            "observer.hostname",
+            "observer.mac",
+            "observer.name",
+            "observer.os.family",
+            "observer.os.full",
+            "observer.os.kernel",
+            "observer.os.name",
+            "observer.os.platform",
+            "observer.os.version",
+            "observer.product",
+            "observer.serial_number",
+            "observer.type",
+            "observer.vendor",
+            "observer.version",
+            "organization.id",
+            "organization.name",
+            "os.family",
+            "os.full",
+            "os.kernel",
+            "os.name",
+            "os.platform",
+            "os.version",
+            "package.architecture",
+            "package.checksum",
+            "package.description",
+            "package.install_scope",
+            "package.license",
+            "package.name",
+            "package.path",
+            "package.version",
+            "process.args",
+            "text",
+            "process.executable",
+            "process.hash.md5",
+            "process.hash.sha1",
+            "process.hash.sha256",
+            "process.hash.sha512",
+            "process.name",
+            "text",
+            "text",
+            "text",
+            "text",
+            "text",
+            "process.thread.name",
+            "process.title",
+            "process.working_directory",
+            "server.address",
+            "server.as.organization.name",
+            "server.domain",
+            "server.geo.city_name",
+            "server.geo.continent_name",
+            "server.geo.country_iso_code",
+            "server.geo.country_name",
+            "server.geo.name",
+            "server.geo.region_iso_code",
+            "server.geo.region_name",
+            "server.mac",
+            "server.registered_domain",
+            "server.top_level_domain",
+            "server.user.domain",
+            "server.user.email",
+            "server.user.full_name",
+            "server.user.group.domain",
+            "server.user.group.id",
+            "server.user.group.name",
+            "server.user.hash",
+            "server.user.id",
+            "server.user.name",
+            "service.ephemeral_id",
+            "service.id",
+            "service.name",
+            "service.node.name",
+            "service.state",
+            "service.type",
+            "service.version",
+            "source.address",
+            "source.as.organization.name",
+            "source.domain",
+            "source.geo.city_name",
+            "source.geo.continent_name",
+            "source.geo.country_iso_code",
+            "source.geo.country_name",
+            "source.geo.name",
+            "source.geo.region_iso_code",
+            "source.geo.region_name",
+            "source.mac",
+            "source.registered_domain",
+            "source.top_level_domain",
+            "source.user.domain",
+            "source.user.email",
+            "source.user.full_name",
+            "source.user.group.domain",
+            "source.user.group.id",
+            "source.user.group.name",
+            "source.user.hash",
+            "source.user.id",
+            "source.user.name",
+            "threat.framework",
+            "threat.tactic.id",
+            "threat.tactic.name",
+            "threat.tactic.reference",
+            "threat.technique.id",
+            "threat.technique.name",
+            "threat.technique.reference",
+            "tracing.trace.id",
+            "tracing.transaction.id",
+            "url.domain",
+            "url.extension",
+            "url.fragment",
+            "url.full",
+            "url.original",
+            "url.password",
+            "url.path",
+            "url.query",
+            "url.registered_domain",
+            "url.scheme",
+            "url.top_level_domain",
+            "url.username",
+            "user.domain",
+            "user.email",
+            "user.full_name",
+            "user.group.domain",
+            "user.group.id",
+            "user.group.name",
+            "user.hash",
+            "user.id",
+            "user.name",
+            "user_agent.device.name",
+            "user_agent.name",
+            "text",
+            "user_agent.original",
+            "user_agent.os.family",
+            "user_agent.os.full",
+            "user_agent.os.kernel",
+            "user_agent.os.name",
+            "user_agent.os.platform",
+            "user_agent.os.version",
+            "user_agent.version",
+            "text",
+            "agent.hostname",
+            "timeseries.instance",
+            "cloud.project.id",
+            "cloud.image.id",
+            "host.os.build",
+            "host.os.codename",
+            "kubernetes.pod.name",
+            "kubernetes.pod.uid",
+            "kubernetes.namespace",
+            "kubernetes.node.name",
+            "kubernetes.replicaset.name",
+            "kubernetes.deployment.name",
+            "kubernetes.statefulset.name",
+            "kubernetes.container.name",
+            "kubernetes.container.image",
+            "jolokia.agent.version",
+            "jolokia.agent.id",
+            "jolokia.server.product",
+            "jolokia.server.version",
+            "jolokia.server.vendor",
+            "jolokia.url",
+            "raw",
+            "file.origin",
+            "file.selinux.user",
+            "file.selinux.role",
+            "file.selinux.domain",
+            "file.selinux.level",
+            "user.audit.id",
+            "user.audit.name",
+            "user.effective.id",
+            "user.effective.name",
+            "user.effective.group.id",
+            "user.effective.group.name",
+            "user.filesystem.id",
+            "user.filesystem.name",
+            "user.filesystem.group.id",
+            "user.filesystem.group.name",
+            "user.saved.id",
+            "user.saved.name",
+            "user.saved.group.id",
+            "user.saved.group.name",
+            "user.selinux.user",
+            "user.selinux.role",
+            "user.selinux.domain",
+            "user.selinux.level",
+            "user.selinux.category",
+            "source.path",
+            "destination.path",
+            "auditd.message_type",
+            "auditd.session",
+            "auditd.result",
+            "auditd.summary.actor.primary",
+            "auditd.summary.actor.secondary",
+            "auditd.summary.object.type",
+            "auditd.summary.object.primary",
+            "auditd.summary.object.secondary",
+            "auditd.summary.how",
+            "auditd.paths.inode",
+            "auditd.paths.dev",
+            "auditd.paths.obj_user",
+            "auditd.paths.obj_role",
+            "auditd.paths.obj_domain",
+            "auditd.paths.obj_level",
+            "auditd.paths.objtype",
+            "auditd.paths.ouid",
+            "auditd.paths.rdev",
+            "auditd.paths.nametype",
+            "auditd.paths.ogid",
+            "auditd.paths.item",
+            "auditd.paths.mode",
+            "auditd.paths.name",
+            "auditd.data.action",
+            "auditd.data.minor",
+            "auditd.data.acct",
+            "auditd.data.addr",
+            "auditd.data.cipher",
+            "auditd.data.id",
+            "auditd.data.entries",
+            "auditd.data.kind",
+            "auditd.data.ksize",
+            "auditd.data.spid",
+            "auditd.data.arch",
+            "auditd.data.argc",
+            "auditd.data.major",
+            "auditd.data.unit",
+            "auditd.data.table",
+            "auditd.data.terminal",
+            "auditd.data.grantors",
+            "auditd.data.direction",
+            "auditd.data.op",
+            "auditd.data.tty",
+            "auditd.data.syscall",
+            "auditd.data.data",
+            "auditd.data.family",
+            "auditd.data.mac",
+            "auditd.data.pfs",
+            "auditd.data.items",
+            "auditd.data.a0",
+            "auditd.data.a1",
+            "auditd.data.a2",
+            "auditd.data.a3",
+            "auditd.data.hostname",
+            "auditd.data.lport",
+            "auditd.data.rport",
+            "auditd.data.exit",
+            "auditd.data.fp",
+            "auditd.data.laddr",
+            "auditd.data.sport",
+            "auditd.data.capability",
+            "auditd.data.nargs",
+            "auditd.data.new-enabled",
+            "auditd.data.audit_backlog_limit",
+            "auditd.data.dir",
+            "auditd.data.cap_pe",
+            "auditd.data.model",
+            "auditd.data.new_pp",
+            "auditd.data.old-enabled",
+            "auditd.data.oauid",
+            "auditd.data.old",
+            "auditd.data.banners",
+            "auditd.data.feature",
+            "auditd.data.vm-ctx",
+            "auditd.data.opid",
+            "auditd.data.seperms",
+            "auditd.data.seresult",
+            "auditd.data.new-rng",
+            "auditd.data.old-net",
+            "auditd.data.sigev_signo",
+            "auditd.data.ino",
+            "auditd.data.old_enforcing",
+            "auditd.data.old-vcpu",
+            "auditd.data.range",
+            "auditd.data.res",
+            "auditd.data.added",
+            "auditd.data.fam",
+            "auditd.data.nlnk-pid",
+            "auditd.data.subj",
+            "auditd.data.a[0-3]",
+            "auditd.data.cgroup",
+            "auditd.data.kernel",
+            "auditd.data.ocomm",
+            "auditd.data.new-net",
+            "auditd.data.permissive",
+            "auditd.data.class",
+            "auditd.data.compat",
+            "auditd.data.fi",
+            "auditd.data.changed",
+            "auditd.data.msg",
+            "auditd.data.dport",
+            "auditd.data.new-seuser",
+            "auditd.data.invalid_context",
+            "auditd.data.dmac",
+            "auditd.data.ipx-net",
+            "auditd.data.iuid",
+            "auditd.data.macproto",
+            "auditd.data.obj",
+            "auditd.data.ipid",
+            "auditd.data.new-fs",
+            "auditd.data.vm-pid",
+            "auditd.data.cap_pi",
+            "auditd.data.old-auid",
+            "auditd.data.oses",
+            "auditd.data.fd",
+            "auditd.data.igid",
+            "auditd.data.new-disk",
+            "auditd.data.parent",
+            "auditd.data.len",
+            "auditd.data.oflag",
+            "auditd.data.uuid",
+            "auditd.data.code",
+            "auditd.data.nlnk-grp",
+            "auditd.data.cap_fp",
+            "auditd.data.new-mem",
+            "auditd.data.seperm",
+            "auditd.data.enforcing",
+            "auditd.data.new-chardev",
+            "auditd.data.old-rng",
+            "auditd.data.outif",
+            "auditd.data.cmd",
+            "auditd.data.hook",
+            "auditd.data.new-level",
+            "auditd.data.sauid",
+            "auditd.data.sig",
+            "auditd.data.audit_backlog_wait_time",
+            "auditd.data.printer",
+            "auditd.data.old-mem",
+            "auditd.data.perm",
+            "auditd.data.old_pi",
+            "auditd.data.state",
+            "auditd.data.format",
+            "auditd.data.new_gid",
+            "auditd.data.tcontext",
+            "auditd.data.maj",
+            "auditd.data.watch",
+            "auditd.data.device",
+            "auditd.data.grp",
+            "auditd.data.bool",
+            "auditd.data.icmp_type",
+            "auditd.data.new_lock",
+            "auditd.data.old_prom",
+            "auditd.data.acl",
+            "auditd.data.ip",
+            "auditd.data.new_pi",
+            "auditd.data.default-context",
+            "auditd.data.inode_gid",
+            "auditd.data.new-log_passwd",
+            "auditd.data.new_pe",
+            "auditd.data.selected-context",
+            "auditd.data.cap_fver",
+            "auditd.data.file",
+            "auditd.data.net",
+            "auditd.data.virt",
+            "auditd.data.cap_pp",
+            "auditd.data.old-range",
+            "auditd.data.resrc",
+            "auditd.data.new-range",
+            "auditd.data.obj_gid",
+            "auditd.data.proto",
+            "auditd.data.old-disk",
+            "auditd.data.audit_failure",
+            "auditd.data.inif",
+            "auditd.data.vm",
+            "auditd.data.flags",
+            "auditd.data.nlnk-fam",
+            "auditd.data.old-fs",
+            "auditd.data.old-ses",
+            "auditd.data.seqno",
+            "auditd.data.fver",
+            "auditd.data.qbytes",
+            "auditd.data.seuser",
+            "auditd.data.cap_fe",
+            "auditd.data.new-vcpu",
+            "auditd.data.old-level",
+            "auditd.data.old_pp",
+            "auditd.data.daddr",
+            "auditd.data.old-role",
+            "auditd.data.ioctlcmd",
+            "auditd.data.smac",
+            "auditd.data.apparmor",
+            "auditd.data.fe",
+            "auditd.data.perm_mask",
+            "auditd.data.ses",
+            "auditd.data.cap_fi",
+            "auditd.data.obj_uid",
+            "auditd.data.reason",
+            "auditd.data.list",
+            "auditd.data.old_lock",
+            "auditd.data.bus",
+            "auditd.data.old_pe",
+            "auditd.data.new-role",
+            "auditd.data.prom",
+            "auditd.data.uri",
+            "auditd.data.audit_enabled",
+            "auditd.data.old-log_passwd",
+            "auditd.data.old-seuser",
+            "auditd.data.per",
+            "auditd.data.scontext",
+            "auditd.data.tclass",
+            "auditd.data.ver",
+            "auditd.data.new",
+            "auditd.data.val",
+            "auditd.data.img-ctx",
+            "auditd.data.old-chardev",
+            "auditd.data.old_val",
+            "auditd.data.success",
+            "auditd.data.inode_uid",
+            "auditd.data.removed",
+            "auditd.data.socket.port",
+            "auditd.data.socket.saddr",
+            "auditd.data.socket.addr",
+            "auditd.data.socket.family",
+            "auditd.data.socket.path",
+            "geoip.continent_name",
+            "geoip.city_name",
+            "geoip.region_name",
+            "geoip.country_iso_code",
+            "hash.blake2b_256",
+            "hash.blake2b_384",
+            "hash.blake2b_512",
+            "hash.md5",
+            "hash.sha1",
+            "hash.sha224",
+            "hash.sha256",
+            "hash.sha384",
+            "hash.sha3_224",
+            "hash.sha3_256",
+            "hash.sha3_384",
+            "hash.sha3_512",
+            "hash.sha512",
+            "hash.sha512_224",
+            "hash.sha512_256",
+            "hash.xxh64",
+            "event.origin",
+            "user.entity_id",
+            "user.terminal",
+            "process.entity_id",
+            "process.hash.blake2b_256",
+            "process.hash.blake2b_384",
+            "process.hash.blake2b_512",
+            "process.hash.sha224",
+            "process.hash.sha384",
+            "process.hash.sha3_224",
+            "process.hash.sha3_256",
+            "process.hash.sha3_384",
+            "process.hash.sha3_512",
+            "process.hash.sha512_224",
+            "process.hash.sha512_256",
+            "process.hash.xxh64",
+            "socket.entity_id",
+            "system.audit.host.timezone.name",
+            "system.audit.host.hostname",
+            "system.audit.host.id",
+            "system.audit.host.architecture",
+            "system.audit.host.mac",
+            "system.audit.host.os.codename",
+            "system.audit.host.os.platform",
+            "system.audit.host.os.name",
+            "system.audit.host.os.family",
+            "system.audit.host.os.version",
+            "system.audit.host.os.kernel",
+            "system.audit.package.entity_id",
+            "system.audit.package.name",
+            "system.audit.package.version",
+            "system.audit.package.release",
+            "system.audit.package.arch",
+            "system.audit.package.license",
+            "system.audit.package.summary",
+            "system.audit.package.url",
+            "system.audit.user.name",
+            "system.audit.user.uid",
+            "system.audit.user.gid",
+            "system.audit.user.dir",
+            "system.audit.user.shell",
+            "system.audit.user.user_information",
+            "system.audit.user.password.type",
+            "fields.*"
+          ]
+        },
+        "refresh_interval": "5s"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/x-pack/test/ui_capabilities/common/fixtures/plugins/foo_plugin/index.js b/x-pack/test/ui_capabilities/common/fixtures/plugins/foo_plugin/index.js
index 6110996a553dc..89ae0125614b6 100644
--- a/x-pack/test/ui_capabilities/common/fixtures/plugins/foo_plugin/index.js
+++ b/x-pack/test/ui_capabilities/common/fixtures/plugins/foo_plugin/index.js
@@ -28,6 +28,8 @@ export default function(kibana) {
         catalogue: ['foo'],
         privileges: {
           all: {
+            app: ['kibana'],
+            catalogue: ['foo'],
             savedObject: {
               all: ['foo'],
               read: ['index-pattern'],
@@ -35,6 +37,8 @@ export default function(kibana) {
             ui: ['create', 'edit', 'delete', 'show'],
           },
           read: {
+            app: ['kibana'],
+            catalogue: ['foo'],
             savedObject: {
               all: [],
               read: ['foo', 'index-pattern'],
diff --git a/yarn.lock b/yarn.lock
index 961a56fc815ff..060716fe1803f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3749,6 +3749,50 @@
     react-lifecycles-compat "^3.0.4"
     warning "^3.0.0"
 
+"@redux-saga/core@^1.1.3":
+  version "1.1.3"
+  resolved "https://registry.yarnpkg.com/@redux-saga/core/-/core-1.1.3.tgz#3085097b57a4ea8db5528d58673f20ce0950f6a4"
+  integrity sha512-8tInBftak8TPzE6X13ABmEtRJGjtK17w7VUs7qV17S8hCO5S3+aUTWZ/DBsBJPdE8Z5jOPwYALyvofgq1Ws+kg==
+  dependencies:
+    "@babel/runtime" "^7.6.3"
+    "@redux-saga/deferred" "^1.1.2"
+    "@redux-saga/delay-p" "^1.1.2"
+    "@redux-saga/is" "^1.1.2"
+    "@redux-saga/symbols" "^1.1.2"
+    "@redux-saga/types" "^1.1.0"
+    redux "^4.0.4"
+    typescript-tuple "^2.2.1"
+
+"@redux-saga/deferred@^1.1.2":
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/@redux-saga/deferred/-/deferred-1.1.2.tgz#59937a0eba71fff289f1310233bc518117a71888"
+  integrity sha512-908rDLHFN2UUzt2jb4uOzj6afpjgJe3MjICaUNO3bvkV/kN/cNeI9PMr8BsFXB/MR8WTAZQq/PlTq8Kww3TBSQ==
+
+"@redux-saga/delay-p@^1.1.2":
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/@redux-saga/delay-p/-/delay-p-1.1.2.tgz#8f515f4b009b05b02a37a7c3d0ca9ddc157bb355"
+  integrity sha512-ojc+1IoC6OP65Ts5+ZHbEYdrohmIw1j9P7HS9MOJezqMYtCDgpkoqB5enAAZrNtnbSL6gVCWPHaoaTY5KeO0/g==
+  dependencies:
+    "@redux-saga/symbols" "^1.1.2"
+
+"@redux-saga/is@^1.1.2":
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/@redux-saga/is/-/is-1.1.2.tgz#ae6c8421f58fcba80faf7cadb7d65b303b97e58e"
+  integrity sha512-OLbunKVsCVNTKEf2cH4TYyNbbPgvmZ52iaxBD4I1fTif4+MTXMa4/Z07L83zW/hTCXwpSZvXogqMqLfex2Tg6w==
+  dependencies:
+    "@redux-saga/symbols" "^1.1.2"
+    "@redux-saga/types" "^1.1.0"
+
+"@redux-saga/symbols@^1.1.2":
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/@redux-saga/symbols/-/symbols-1.1.2.tgz#216a672a487fc256872b8034835afc22a2d0595d"
+  integrity sha512-EfdGnF423glv3uMwLsGAtE6bg+R9MdqlHEzExnfagXPrIiuxwr3bdiAwz3gi+PsrQ3yBlaBpfGLtDG8rf3LgQQ==
+
+"@redux-saga/types@^1.1.0":
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/@redux-saga/types/-/types-1.1.0.tgz#0e81ce56b4883b4b2a3001ebe1ab298b84237204"
+  integrity sha512-afmTuJrylUU/0OtqzaRkbyYFFNgCF73Bvel/sw90pvGrWIZ+vyoIJqA6eMSoA6+nb443kTmulmBtC9NerXboNg==
+
 "@samverschueren/stream-to-observable@^0.3.0":
   version "0.3.0"
   resolved "https://registry.yarnpkg.com/@samverschueren/stream-to-observable/-/stream-to-observable-0.3.0.tgz#ecdf48d532c58ea477acfcab80348424f8d0662f"
@@ -5512,10 +5556,10 @@
   dependencies:
     "@types/node" "*"
 
-"@types/mocha@^5.2.7":
-  version "5.2.7"
-  resolved "https://registry.yarnpkg.com/@types/mocha/-/mocha-5.2.7.tgz#315d570ccb56c53452ff8638738df60726d5b6ea"
-  integrity sha512-NYrtPht0wGzhwe9+/idPaBB+TqkY9AhTvOLMkThm0IoEfLaiVQZwBwyJ5puCkO3AUCWrmcoePjp2mbFocKy4SQ==
+"@types/mocha@^7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@types/mocha/-/mocha-7.0.2.tgz#b17f16cf933597e10d6d78eae3251e692ce8b0ce"
+  integrity sha512-ZvO2tAcjmMi8V/5Z3JsyofMe3hasRcaw88cto5etSVMwVQfeivGAlEYmaQgceUSVYFofVjT+ioHsATjdWcFt1w==
 
 "@types/moment-timezone@^0.5.12":
   version "0.5.12"
@@ -6664,6 +6708,13 @@ agent-base@4:
   dependencies:
     es6-promisify "^5.0.0"
 
+agent-base@6:
+  version "6.0.0"
+  resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-6.0.0.tgz#5d0101f19bbfaed39980b22ae866de153b93f09a"
+  integrity sha512-j1Q7cSCqN+AwrmDd+pzgqc0/NpC655x2bUf5ZjRIO77DcNBFmh+OgRNzF6OKdCC9RSCb19fGd99+bhXFdkRNqw==
+  dependencies:
+    debug "4"
+
 agent-base@^4.1.0:
   version "4.2.1"
   resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-4.2.1.tgz#d89e5999f797875674c07d87f260fc41e83e8ca9"
@@ -6671,13 +6722,6 @@ agent-base@^4.1.0:
   dependencies:
     es6-promisify "^5.0.0"
 
-agent-base@^4.3.0:
-  version "4.3.0"
-  resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-4.3.0.tgz#8165f01c436009bccad0b1d122f05ed770efc6ee"
-  integrity sha512-salcGninV0nPrwpGNn4VTXBb1SOuXQBiqbrNXoeizJsHrsL6ERFM2Ne3JUSBWRE6aeNJI2ROP/WEEIDUiDe3cg==
-  dependencies:
-    es6-promisify "^5.0.0"
-
 agentkeepalive@^3.4.1:
   version "3.4.1"
   resolved "https://registry.yarnpkg.com/agentkeepalive/-/agentkeepalive-3.4.1.tgz#aa95aebc3a749bca5ed53e3880a09f5235b48f0c"
@@ -8595,6 +8639,13 @@ binaryextensions@2:
   resolved "https://registry.yarnpkg.com/binaryextensions/-/binaryextensions-2.1.1.tgz#3209a51ca4a4ad541a3b8d3d6a6d5b83a2485935"
   integrity sha512-XBaoWE9RW8pPdPQNibZsW2zh8TW6gcarXp1FZPwT8Uop8ScSNldJEWf2k9l3HeTqdrEwsOsFcq74RiJECW34yA==
 
+bindings@^1.5.0:
+  version "1.5.0"
+  resolved "https://registry.yarnpkg.com/bindings/-/bindings-1.5.0.tgz#10353c9e945334bc0511a6d90b38fbc7c9c504df"
+  integrity sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==
+  dependencies:
+    file-uri-to-path "1.0.0"
+
 bit-twiddle@^1.0.0:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/bit-twiddle/-/bit-twiddle-1.0.2.tgz#0c6c1fabe2b23d17173d9a61b7b7093eb9e1769e"
@@ -9759,6 +9810,21 @@ chokidar@3.2.1:
   optionalDependencies:
     fsevents "~2.1.0"
 
+chokidar@3.3.0:
+  version "3.3.0"
+  resolved "https://registry.yarnpkg.com/chokidar/-/chokidar-3.3.0.tgz#12c0714668c55800f659e262d4962a97faf554a6"
+  integrity sha512-dGmKLDdT3Gdl7fBUe8XK+gAtGmzy5Fn0XkkWQuYxGIgWVPPse2CxFA5mtrlD0TOHaHjEUqkWNyP1XdHoJES/4A==
+  dependencies:
+    anymatch "~3.1.1"
+    braces "~3.0.2"
+    glob-parent "~5.1.0"
+    is-binary-path "~2.1.0"
+    is-glob "~4.0.1"
+    normalize-path "~3.0.0"
+    readdirp "~3.2.0"
+  optionalDependencies:
+    fsevents "~2.1.1"
+
 chokidar@^2.0.0, chokidar@^2.1.2, chokidar@^2.1.8:
   version "2.1.8"
   resolved "https://registry.yarnpkg.com/chokidar/-/chokidar-2.1.8.tgz#804b3a7b6a99358c3c5c61e71d8728f041cff917"
@@ -11762,7 +11828,7 @@ debug-fabulous@1.X:
     memoizee "0.4.X"
     object-assign "4.X"
 
-debug@2.6.9, debug@^2.0.0, debug@^2.1.0, debug@^2.1.1, debug@^2.1.2, debug@^2.2.0, debug@^2.3.3, debug@^2.6.0, debug@^2.6.8, debug@^2.6.9:
+debug@2.6.9, debug@^2.0.0, debug@^2.1.0, debug@^2.1.1, debug@^2.2.0, debug@^2.3.3, debug@^2.6.0, debug@^2.6.8, debug@^2.6.9:
   version "2.6.9"
   resolved "https://registry.yarnpkg.com/debug/-/debug-2.6.9.tgz#5d128515df134ff327e90a4c93f4e077a536341f"
   integrity sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==
@@ -11783,6 +11849,13 @@ debug@3.2.6, debug@3.X, debug@^3.1.0, debug@^3.2.5, debug@^3.2.6:
   dependencies:
     ms "^2.1.1"
 
+debug@4, debug@4.1.1, debug@^4.0.0, debug@^4.0.1, debug@^4.1.0, debug@^4.1.1:
+  version "4.1.1"
+  resolved "https://registry.yarnpkg.com/debug/-/debug-4.1.1.tgz#3b72260255109c6b589cee050f1d516139664791"
+  integrity sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==
+  dependencies:
+    ms "^2.1.1"
+
 debug@4.1.0:
   version "4.1.0"
   resolved "https://registry.yarnpkg.com/debug/-/debug-4.1.0.tgz#373687bffa678b38b1cd91f861b63850035ddc87"
@@ -11790,13 +11863,6 @@ debug@4.1.0:
   dependencies:
     ms "^2.1.1"
 
-debug@4.1.1, debug@^4.0.0, debug@^4.0.1, debug@^4.1.0, debug@^4.1.1:
-  version "4.1.1"
-  resolved "https://registry.yarnpkg.com/debug/-/debug-4.1.1.tgz#3b72260255109c6b589cee050f1d516139664791"
-  integrity sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==
-  dependencies:
-    ms "^2.1.1"
-
 debuglog@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/debuglog/-/debuglog-1.0.1.tgz#aa24ffb9ac3df9a2351837cfb2d279360cd78492"
@@ -12156,11 +12222,6 @@ detect-indent@^4.0.0:
   dependencies:
     repeating "^2.0.0"
 
-detect-libc@^1.0.2:
-  version "1.0.3"
-  resolved "https://registry.yarnpkg.com/detect-libc/-/detect-libc-1.0.3.tgz#fa137c4bd698edf55cd5cd02ac559f91a4c4ba9b"
-  integrity sha1-+hN8S9aY7fVc1c0CrFWfkaTEups=
-
 detect-newline@2.X, detect-newline@^2.1.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/detect-newline/-/detect-newline-2.1.0.tgz#f41f1c10be4b00e87b5f13da680759f2c5bfd3e2"
@@ -14528,6 +14589,11 @@ file-type@^9.0.0:
   resolved "https://registry.yarnpkg.com/file-type/-/file-type-9.0.0.tgz#a68d5ad07f486414dfb2c8866f73161946714a18"
   integrity sha512-Qe/5NJrgIOlwijpq3B7BEpzPFcgzggOTagZmkXQY4LA6bsXKTUstK7Wp12lEJ/mLKTpvIZxmIuRcLYWT6ov9lw==
 
+file-uri-to-path@1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz#553a7b8446ff6f684359c445f1e37a05dacc33dd"
+  integrity sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==
+
 filename-reserved-regex@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/filename-reserved-regex/-/filename-reserved-regex-2.0.0.tgz#abf73dfab735d045440abfea2d91f389ebbfa229"
@@ -15149,17 +15215,17 @@ fs.realpath@^1.0.0:
   integrity sha1-FQStJSMVjKpA20onh8sBQRmU6k8=
 
 fsevents@^1.2.7:
-  version "1.2.7"
-  resolved "https://registry.yarnpkg.com/fsevents/-/fsevents-1.2.7.tgz#4851b664a3783e52003b3c66eb0eee1074933aa4"
-  integrity sha512-Pxm6sI2MeBD7RdD12RYsqaP0nMiwx8eZBXCa6z2L+mRHm2DYrOYwihmhjpkdjUHwQhslWQjRpEgNq4XvBmaAuw==
+  version "1.2.12"
+  resolved "https://registry.yarnpkg.com/fsevents/-/fsevents-1.2.12.tgz#db7e0d8ec3b0b45724fd4d83d43554a8f1f0de5c"
+  integrity sha512-Ggd/Ktt7E7I8pxZRbGIs7vwqAPscSESMrCSkx2FtWeqmheJgCo2R74fTsZFCifr0VTPwqRpPv17+6b8Zp7th0Q==
   dependencies:
-    nan "^2.9.2"
-    node-pre-gyp "^0.10.0"
+    bindings "^1.5.0"
+    nan "^2.12.1"
 
-fsevents@~2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/fsevents/-/fsevents-2.1.0.tgz#ce1a5f9ac71c6d75278b0c5bd236d7dfece4cbaa"
-  integrity sha512-+iXhW3LuDQsno8dOIrCIT/CBjeBWuP7PXe8w9shnj9Lebny/Gx1ZjVBYwexLz36Ri2jKuXMNpV6CYNh8lHHgrQ==
+fsevents@~2.1.0, fsevents@~2.1.1:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/fsevents/-/fsevents-2.1.2.tgz#4c0a1fb34bc68e543b4b82a9ec392bfbda840805"
+  integrity sha512-R4wDiBwZ0KzpgOWetKDug1FZcYhqYnUYKtfZYt4mD5SBz76q0KR4Q9o7GIPamsVPGmW3EYPPJ0dOOjvx32ldZA==
 
 fstream@^1.0.0, fstream@^1.0.12:
   version "1.0.12"
@@ -17134,13 +17200,13 @@ https-proxy-agent@2.2.1, https-proxy-agent@^2.2.1:
     agent-base "^4.1.0"
     debug "^3.1.0"
 
-https-proxy-agent@^2.2.2:
-  version "2.2.2"
-  resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-2.2.2.tgz#271ea8e90f836ac9f119daccd39c19ff7dfb0793"
-  integrity sha512-c8Ndjc9Bkpfx/vCJueCPy0jlP4ccCCSNDp8xwCZzPjKJUm+B+u9WX2x98Qx4n1PiMNTWo3D7KK5ifNV/yJyRzg==
+https-proxy-agent@^5.0.0:
+  version "5.0.0"
+  resolved "https://registry.yarnpkg.com/https-proxy-agent/-/https-proxy-agent-5.0.0.tgz#e2a90542abb68a762e0a0850f6c9edadfd8506b2"
+  integrity sha512-EkYm5BcKUGiduxzSt3Eppko+PiNWNEpa4ySk9vTC6wDsQJW9rHSa+UhGNJoRYp7bz6Ht1eaRIa6QaJqO5rCFbA==
   dependencies:
-    agent-base "^4.3.0"
-    debug "^3.1.0"
+    agent-base "6"
+    debug "4"
 
 human-signals@^1.1.1:
   version "1.1.1"
@@ -17183,7 +17249,7 @@ icalendar@0.7.1:
   resolved "https://registry.yarnpkg.com/icalendar/-/icalendar-0.7.1.tgz#d0d3486795f8f1c5cf4f8cafac081b4b4e7a32ae"
   integrity sha1-0NNIZ5X48cXPT4yvrAgbS056Mq4=
 
-iconv-lite@0.4, iconv-lite@0.4.24, iconv-lite@^0.4.17, iconv-lite@^0.4.22, iconv-lite@^0.4.24, iconv-lite@^0.4.4, iconv-lite@~0.4.13:
+iconv-lite@0.4, iconv-lite@0.4.24, iconv-lite@^0.4.17, iconv-lite@^0.4.22, iconv-lite@^0.4.24, iconv-lite@~0.4.13:
   version "0.4.24"
   resolved "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.4.24.tgz#2022b4b25fbddc21d2f524974a474aafe733908b"
   integrity sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==
@@ -17257,13 +17323,6 @@ iferr@^0.1.5:
   resolved "https://registry.yarnpkg.com/iferr/-/iferr-0.1.5.tgz#c60eed69e6d8fdb6b3104a1fcbca1c192dc5b501"
   integrity sha1-xg7taebY/bazEEofy8ocGS3FtQE=
 
-ignore-walk@^3.0.1:
-  version "3.0.1"
-  resolved "https://registry.yarnpkg.com/ignore-walk/-/ignore-walk-3.0.1.tgz#a83e62e7d272ac0e3b551aaa82831a19b69f82f8"
-  integrity sha512-DTVlMx3IYPe0/JJcYP7Gxg7ttZZu3IInhuEhbchuqneY9wWe5Ojy2mXLBaQFUQmo0AW2r3qG7m1mg86js+gnlQ==
-  dependencies:
-    minimatch "^3.0.4"
-
 ignore@^3.1.2, ignore@^3.3.5:
   version "3.3.10"
   resolved "https://registry.yarnpkg.com/ignore/-/ignore-3.3.10.tgz#0a97fb876986e8081c631160f8f9f389157f0043"
@@ -21400,6 +21459,11 @@ minimist@^0.1.0:
   resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.1.0.tgz#99df657a52574c21c9057497df742790b2b4c0de"
   integrity sha1-md9lelJXTCHJBXSX33QnkLK0wN4=
 
+minimist@^1.2.5:
+  version "1.2.5"
+  resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.5.tgz#67d66014b66a6a8aaa0c083c5fd58df4e4e97602"
+  integrity sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==
+
 minimist@~0.0.1:
   version "0.0.10"
   resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.0.10.tgz#de3f98543dbf96082be48ad1a0c7cda836301dcf"
@@ -21442,7 +21506,7 @@ minipass@^2.2.1:
     safe-buffer "^5.1.1"
     yallist "^3.0.0"
 
-minipass@^2.2.4, minipass@^2.3.4:
+minipass@^2.2.4:
   version "2.3.5"
   resolved "https://registry.yarnpkg.com/minipass/-/minipass-2.3.5.tgz#cacebe492022497f656b0f0f51e2682a9ed2d848"
   integrity sha512-Gi1W4k059gyRbyVUZQ4mEqLm0YIUiGYfvxhF6SIlk3ui1WVxMTGfGdQ2SInh3PDrRTVvPKgULkpJtT4RH10+VA==
@@ -21472,13 +21536,6 @@ minizlib@^1.1.0, minizlib@^1.2.1:
   dependencies:
     minipass "^2.2.1"
 
-minizlib@^1.1.1:
-  version "1.1.1"
-  resolved "https://registry.yarnpkg.com/minizlib/-/minizlib-1.1.1.tgz#6734acc045a46e61d596a43bb9d9cd326e19cc42"
-  integrity sha512-TrfjCjk4jLhcJyGMYymBH6oTXcWjYbUAXTHDbtnWHjZC25h0cdajHuPE1zxb4DVmu8crfh+HwH/WMuyLG0nHBg==
-  dependencies:
-    minipass "^2.2.1"
-
 mississippi@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/mississippi/-/mississippi-3.0.0.tgz#ea0a3291f97e0b5e8776b363d5f0a12d94c67022"
@@ -21530,6 +21587,13 @@ mkdirp@0.5.1, mkdirp@0.5.x, "mkdirp@>=0.5 0", mkdirp@^0.5.0, mkdirp@^0.5.1, mkdi
   dependencies:
     minimist "0.0.8"
 
+mkdirp@0.5.3:
+  version "0.5.3"
+  resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-0.5.3.tgz#5a514b7179259287952881e94410ec5465659f8c"
+  integrity sha512-P+2gwrFqx8lhew375MQHHeTlY8AuOJSrGf0R5ddkEndUkmwpgUob/vQuBD1V22/Cw1/lJr4x+EjllSezBThzBg==
+  dependencies:
+    minimist "^1.2.5"
+
 mkdirp@^1.0.3:
   version "1.0.3"
   resolved "https://registry.yarnpkg.com/mkdirp/-/mkdirp-1.0.3.tgz#4cf2e30ad45959dddea53ad97d518b6c8205e1ea"
@@ -21546,13 +21610,14 @@ mocha-junit-reporter@^1.23.1:
     strip-ansi "^4.0.0"
     xml "^1.0.0"
 
-mocha@^6.2.2:
-  version "6.2.2"
-  resolved "https://registry.yarnpkg.com/mocha/-/mocha-6.2.2.tgz#5d8987e28940caf8957a7d7664b910dc5b2fea20"
-  integrity sha512-FgDS9Re79yU1xz5d+C4rv1G7QagNGHZ+iXF81hO8zY35YZZcLEsJVfFolfsqKFWunATEvNzMK0r/CwWd/szO9A==
+mocha@^7.1.1:
+  version "7.1.1"
+  resolved "https://registry.yarnpkg.com/mocha/-/mocha-7.1.1.tgz#89fbb30d09429845b1bb893a830bf5771049a441"
+  integrity sha512-3qQsu3ijNS3GkWcccT5Zw0hf/rWvu1fTN9sPvEd81hlwsr30GX2GcDSSoBxo24IR8FelmrAydGC6/1J5QQP4WA==
   dependencies:
     ansi-colors "3.2.3"
     browser-stdout "1.3.1"
+    chokidar "3.3.0"
     debug "3.2.6"
     diff "3.5.0"
     escape-string-regexp "1.0.5"
@@ -21561,18 +21626,18 @@ mocha@^6.2.2:
     growl "1.10.5"
     he "1.2.0"
     js-yaml "3.13.1"
-    log-symbols "2.2.0"
+    log-symbols "3.0.0"
     minimatch "3.0.4"
-    mkdirp "0.5.1"
+    mkdirp "0.5.3"
     ms "2.1.1"
-    node-environment-flags "1.0.5"
+    node-environment-flags "1.0.6"
     object.assign "4.1.0"
     strip-json-comments "2.0.1"
     supports-color "6.0.0"
     which "1.3.1"
     wide-align "1.1.3"
-    yargs "13.3.0"
-    yargs-parser "13.1.1"
+    yargs "13.3.2"
+    yargs-parser "13.1.2"
     yargs-unparser "1.6.0"
 
 mochawesome-merge@^2.0.1:
@@ -21828,7 +21893,7 @@ mute-stream@0.0.8:
   resolved "https://registry.yarnpkg.com/mute-stream/-/mute-stream-0.0.8.tgz#1630c42b2251ff81e2a283de96a5497ea92e5e0d"
   integrity sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==
 
-nan@^2.13.2, nan@^2.9.2:
+nan@^2.12.1, nan@^2.13.2:
   version "2.14.0"
   resolved "https://registry.yarnpkg.com/nan/-/nan-2.14.0.tgz#7818f722027b2459a86f0295d434d1fc2336c52c"
   integrity sha512-INOFj37C7k3AfaNTtX8RhsTw7qRy7eLET14cROi9+5HAVbbHuIWUHEauBv5qT4Av2tWasiTY1Jw6puUNqRJXQg==
@@ -21910,15 +21975,6 @@ nearley@^2.7.10:
     randexp "0.4.6"
     semver "^5.4.1"
 
-needle@^2.2.1:
-  version "2.2.4"
-  resolved "https://registry.yarnpkg.com/needle/-/needle-2.2.4.tgz#51931bff82533b1928b7d1d69e01f1b00ffd2a4e"
-  integrity sha512-HyoqEb4wr/rsoaIDfTH2aVL9nWtQqba2/HvMv+++m8u0dz808MaagKILxtfeSN7QU7nvbQ79zk3vYOJp9zsNEA==
-  dependencies:
-    debug "^2.1.2"
-    iconv-lite "^0.4.4"
-    sax "^1.2.4"
-
 negotiator@0.6.1:
   version "0.6.1"
   resolved "https://registry.yarnpkg.com/negotiator/-/negotiator-0.6.1.tgz#2b327184e8992101177b28563fb5e7102acd0ca9"
@@ -22044,10 +22100,10 @@ node-ensure@^0.0.0:
   resolved "https://registry.yarnpkg.com/node-ensure/-/node-ensure-0.0.0.tgz#ecae764150de99861ec5c810fd5d096b183932a7"
   integrity sha1-7K52QVDemYYexcgQ/V0Jaxg5Mqc=
 
-node-environment-flags@1.0.5:
-  version "1.0.5"
-  resolved "https://registry.yarnpkg.com/node-environment-flags/-/node-environment-flags-1.0.5.tgz#fa930275f5bf5dae188d6192b24b4c8bbac3d76a"
-  integrity sha512-VNYPRfGfmZLx0Ye20jWzHUjyTW/c+6Wq+iLhDzUI4XmhrDd9l/FozXV3F2xOaXjvp0co0+v1YSR3CMP6g+VvLQ==
+node-environment-flags@1.0.6:
+  version "1.0.6"
+  resolved "https://registry.yarnpkg.com/node-environment-flags/-/node-environment-flags-1.0.6.tgz#a30ac13621f6f7d674260a54dede048c3982c088"
+  integrity sha512-5Evy2epuL+6TM0lCQGpFIj6KwiEsGh1SrHUhTbNX+sLbBtjidPZFAnVK9y5yU1+h//RitLbRHTIMyxQPtxMdHw==
   dependencies:
     object.getownpropertydescriptors "^2.0.3"
     semver "^5.7.0"
@@ -22208,22 +22264,6 @@ node-notifier@^5.4.2:
     shellwords "^0.1.1"
     which "^1.3.0"
 
-node-pre-gyp@^0.10.0:
-  version "0.10.3"
-  resolved "https://registry.yarnpkg.com/node-pre-gyp/-/node-pre-gyp-0.10.3.tgz#3070040716afdc778747b61b6887bf78880b80fc"
-  integrity sha512-d1xFs+C/IPS8Id0qPTZ4bUT8wWryfR/OzzAFxweG+uLN85oPzyo2Iw6bVlLQ/JOdgNonXLCoRyqDzDWq4iw72A==
-  dependencies:
-    detect-libc "^1.0.2"
-    mkdirp "^0.5.1"
-    needle "^2.2.1"
-    nopt "^4.0.1"
-    npm-packlist "^1.1.6"
-    npmlog "^4.0.2"
-    rc "^1.2.7"
-    rimraf "^2.6.1"
-    semver "^5.3.0"
-    tar "^4"
-
 node-releases@^1.1.25, node-releases@^1.1.46:
   version "1.1.47"
   resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-1.1.47.tgz#c59ef739a1fd7ecbd9f0b7cf5b7871e8a8b591e4"
@@ -22300,14 +22340,6 @@ nopt@^2.2.0:
   dependencies:
     abbrev "1"
 
-nopt@^4.0.1:
-  version "4.0.1"
-  resolved "https://registry.yarnpkg.com/nopt/-/nopt-4.0.1.tgz#d0d4685afd5415193c8c7505602d0d17cd64474d"
-  integrity sha1-0NRoWv1UFRk8jHUFYC0NF81kR00=
-  dependencies:
-    abbrev "1"
-    osenv "^0.1.4"
-
 normalize-package-data@^2.0.0, normalize-package-data@^2.3.2, normalize-package-data@^2.3.4:
   version "2.4.0"
   resolved "https://registry.yarnpkg.com/normalize-package-data/-/normalize-package-data-2.4.0.tgz#12f95a307d58352075a04907b84ac8be98ac012f"
@@ -22376,11 +22408,6 @@ now-and-later@^2.0.0:
   dependencies:
     once "^1.3.2"
 
-npm-bundled@^1.0.1:
-  version "1.0.3"
-  resolved "https://registry.yarnpkg.com/npm-bundled/-/npm-bundled-1.0.3.tgz#7e71703d973af3370a9591bafe3a63aca0be2308"
-  integrity sha512-ByQ3oJ/5ETLyglU2+8dBObvhfWXX8dtPZDMePCahptliFX2iIuhyEszyFk401PZUNQH20vvdW5MLjJxkwU80Ow==
-
 npm-conf@^1.1.0, npm-conf@^1.1.3:
   version "1.1.3"
   resolved "https://registry.yarnpkg.com/npm-conf/-/npm-conf-1.1.3.tgz#256cc47bd0e218c259c4e9550bf413bc2192aff9"
@@ -22397,14 +22424,6 @@ npm-keyword@^5.0.0:
     got "^7.1.0"
     registry-url "^3.0.3"
 
-npm-packlist@^1.1.6:
-  version "1.1.10"
-  resolved "https://registry.yarnpkg.com/npm-packlist/-/npm-packlist-1.1.10.tgz#1039db9e985727e464df066f4cf0ab6ef85c398a"
-  integrity sha512-AQC0Dyhzn4EiYEfIUjCdMl0JJ61I2ER9ukf/sLxJUcZHfo+VyEfz2rMJgLZSS1v30OxPQe1cN0LZA1xbcaVfWA==
-  dependencies:
-    ignore-walk "^3.0.1"
-    npm-bundled "^1.0.1"
-
 npm-run-path@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/npm-run-path/-/npm-run-path-1.0.0.tgz#f5c32bf595fe81ae927daec52e82f8b000ac3c8f"
@@ -22442,7 +22461,7 @@ npmconf@^2.1.3:
     semver "2 || 3 || 4"
     uid-number "0.0.5"
 
-"npmlog@0 || 1 || 2 || 3 || 4", npmlog@^4.0.0, npmlog@^4.0.2, npmlog@^4.1.2:
+"npmlog@0 || 1 || 2 || 3 || 4", npmlog@^4.0.0, npmlog@^4.1.2:
   version "4.1.2"
   resolved "https://registry.yarnpkg.com/npmlog/-/npmlog-4.1.2.tgz#08a7f2a8bf734604779a9efa4ad5cc717abb954b"
   integrity sha512-2uUqazuKlTaSI/dC8AzicUck7+IrEaOnN/e0jd3Xtt1KcGpwx30v50mL7oPyr/h9bL3E4aZccVwpwP+5W9Vjkg==
@@ -23019,14 +23038,6 @@ osenv@0, osenv@^0.1.0:
     os-homedir "^1.0.0"
     os-tmpdir "^1.0.0"
 
-osenv@^0.1.4:
-  version "0.1.4"
-  resolved "https://registry.yarnpkg.com/osenv/-/osenv-0.1.4.tgz#42fe6d5953df06c8064be6f176c3d05aaaa34644"
-  integrity sha1-Qv5tWVPfBsgGS+bxdsPQWqqjRkQ=
-  dependencies:
-    os-homedir "^1.0.0"
-    os-tmpdir "^1.0.0"
-
 output-file-sync@^2.0.0:
   version "2.0.1"
   resolved "https://registry.yarnpkg.com/output-file-sync/-/output-file-sync-2.0.1.tgz#f53118282f5f553c2799541792b723a4c71430c0"
@@ -25901,6 +25912,13 @@ readdirp@~3.1.3:
   dependencies:
     picomatch "^2.0.4"
 
+readdirp@~3.2.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/readdirp/-/readdirp-3.2.0.tgz#c30c33352b12c96dfb4b895421a49fd5a9593839"
+  integrity sha512-crk4Qu3pmXwgxdSgGhgA/eXiJAPQiX4GMOZZMXnqKxHX7TaoL+3gQVo/WeuAiogr07DpnfjIMpXXa+PAIvwPGQ==
+  dependencies:
+    picomatch "^2.0.4"
+
 readline2@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/readline2/-/readline2-1.0.1.tgz#41059608ffc154757b715d9989d199ffbf372e35"
@@ -26048,10 +26066,12 @@ redux-observable@^1.2.0:
   resolved "https://registry.yarnpkg.com/redux-observable/-/redux-observable-1.2.0.tgz#ff51b6c6be2598e9b5e89fc36639186bb0e669c7"
   integrity sha512-yeR90RP2WzZzCxxnQPlh2uFzyfFLsfXu8ROh53jGDPXVqj71uNDMmvi/YKQkd9ofiVoO4OYb1snbowO49tCEMg==
 
-redux-saga@^0.16.0:
-  version "0.16.2"
-  resolved "https://registry.yarnpkg.com/redux-saga/-/redux-saga-0.16.2.tgz#993662e86bc945d8509ac2b8daba3a8c615cc971"
-  integrity sha512-iIjKnRThI5sKPEASpUvySemjzwqwI13e3qP7oLub+FycCRDysLSAOwt958niZW6LhxfmS6Qm1BzbU70w/Koc4w==
+redux-saga@^1.1.3:
+  version "1.1.3"
+  resolved "https://registry.yarnpkg.com/redux-saga/-/redux-saga-1.1.3.tgz#9f3e6aebd3c994bbc0f6901a625f9a42b51d1112"
+  integrity sha512-RkSn/z0mwaSa5/xH/hQLo8gNf4tlvT18qXDNvedihLcfzh+jMchDgaariQoehCpgRltEm4zHKJyINEz6aqswTw==
+  dependencies:
+    "@redux-saga/core" "^1.1.3"
 
 redux-thunk@2.2.0:
   version "2.2.0"
@@ -27264,7 +27284,7 @@ sass-lookup@^3.0.0:
   dependencies:
     commander "^2.16.0"
 
-sax@>=0.6.0, sax@^1.2.1, sax@^1.2.4, sax@~1.2.4:
+sax@>=0.6.0, sax@^1.2.1, sax@~1.2.4:
   version "1.2.4"
   resolved "https://registry.yarnpkg.com/sax/-/sax-1.2.4.tgz#2816234e2378bddc4e5354fab5caa895df7100d9"
   integrity sha512-NqVDv9TpANUjFm0N8uM5GxL36UgKi9/atZw+x7YFnQ8ckwFGKrl4xX4yWtrey3UJm5nP1kUbnYgLopqWNSRhWw==
@@ -29327,19 +29347,6 @@ tar@^2.0.0:
     fstream "^1.0.12"
     inherits "2"
 
-tar@^4:
-  version "4.4.8"
-  resolved "https://registry.yarnpkg.com/tar/-/tar-4.4.8.tgz#b19eec3fde2a96e64666df9fdb40c5ca1bc3747d"
-  integrity sha512-LzHF64s5chPQQS0IYBn9IN5h3i98c12bo4NCO7e0sGM2llXQ3p2FGC5sdENN4cTW48O915Sh+x+EXx7XW96xYQ==
-  dependencies:
-    chownr "^1.1.1"
-    fs-minipass "^1.2.5"
-    minipass "^2.3.4"
-    minizlib "^1.1.1"
-    mkdirp "^0.5.0"
-    safe-buffer "^5.1.2"
-    yallist "^3.0.2"
-
 tcomb-validation@^3.3.0:
   version "3.4.1"
   resolved "https://registry.yarnpkg.com/tcomb-validation/-/tcomb-validation-3.4.1.tgz#a7696ec176ce56a081d9e019f8b732a5a8894b65"
@@ -30628,6 +30635,13 @@ typedarray@^0.0.6, typedarray@~0.0.5:
   resolved "https://registry.yarnpkg.com/typedarray/-/typedarray-0.0.6.tgz#867ac74e3864187b1d3d47d996a78ec5c8830777"
   integrity sha1-hnrHTjhkGHsdPUfZlqeOxciDB3c=
 
+typescript-compare@^0.0.2:
+  version "0.0.2"
+  resolved "https://registry.yarnpkg.com/typescript-compare/-/typescript-compare-0.0.2.tgz#7ee40a400a406c2ea0a7e551efd3309021d5f425"
+  integrity sha512-8ja4j7pMHkfLJQO2/8tut7ub+J3Lw2S3061eJLFQcvs3tsmJKp8KG5NtpLn7KcY2w08edF74BSVN7qJS0U6oHA==
+  dependencies:
+    typescript-logic "^0.0.0"
+
 typescript-fsa-reducers@^1.2.1:
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/typescript-fsa-reducers/-/typescript-fsa-reducers-1.2.1.tgz#2af1a85f7b88fb0dfb9fa59d5da51a5d7ac6543f"
@@ -30638,6 +30652,18 @@ typescript-fsa@^3.0.0:
   resolved "https://registry.yarnpkg.com/typescript-fsa/-/typescript-fsa-3.0.0.tgz#3ad1cb915a67338e013fc21f67c9b3e0e110c912"
   integrity sha512-xiXAib35i0QHl/+wMobzPibjAH5TJLDj+qGq5jwVLG9qR4FUswZURBw2qihBm0m06tHoyb3FzpnJs1GRhRwVag==
 
+typescript-logic@^0.0.0:
+  version "0.0.0"
+  resolved "https://registry.yarnpkg.com/typescript-logic/-/typescript-logic-0.0.0.tgz#66ebd82a2548f2b444a43667bec120b496890196"
+  integrity sha512-zXFars5LUkI3zP492ls0VskH3TtdeHCqu0i7/duGt60i5IGPIpAHE/DWo5FqJ6EjQ15YKXrt+AETjv60Dat34Q==
+
+typescript-tuple@^2.2.1:
+  version "2.2.1"
+  resolved "https://registry.yarnpkg.com/typescript-tuple/-/typescript-tuple-2.2.1.tgz#7d9813fb4b355f69ac55032e0363e8bb0f04dad2"
+  integrity sha512-Zcr0lbt8z5ZdEzERHAMAniTiIKerFCMgd7yjq1fPnDJ43et/k9twIFQMUYff9k5oXcsQ0WpvFcgzK2ZKASoW6Q==
+  dependencies:
+    typescript-compare "^0.0.2"
+
 typescript@3.7.2, typescript@^3.0.1, typescript@^3.0.3, typescript@^3.2.2, typescript@^3.3.3333, typescript@^3.4.5, typescript@~3.7.2:
   version "3.7.2"
   resolved "https://registry.yarnpkg.com/typescript/-/typescript-3.7.2.tgz#27e489b95fa5909445e9fef5ee48d81697ad18fb"
@@ -32815,10 +32841,10 @@ yallist@^4.0.0:
   resolved "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz#9bb92790d9c0effec63be73519e11a35019a3a72"
   integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==
 
-yargs-parser@13.1.1, yargs-parser@^13.0.0, yargs-parser@^13.1.0, yargs-parser@^13.1.1:
-  version "13.1.1"
-  resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-13.1.1.tgz#d26058532aa06d365fe091f6a1fc06b2f7e5eca0"
-  integrity sha512-oVAVsHz6uFrg3XQheFII8ESO2ssAf9luWuAd6Wexsu4F3OtIW0o8IribPXYrD4WC24LWtPrJlGy87y5udK+dxQ==
+yargs-parser@13.1.2, yargs-parser@^13.0.0, yargs-parser@^13.1.0, yargs-parser@^13.1.1, yargs-parser@^13.1.2:
+  version "13.1.2"
+  resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-13.1.2.tgz#130f09702ebaeef2650d54ce6e3e5706f7a4fb38"
+  integrity sha512-3lbsNRf/j+A4QuSZfDRA7HRSfWrzO0YjqTJd5kjAq37Zep1CEgaYmrH9Q3GwPiB9cHyd1Y1UwggGhJGoxipbzg==
   dependencies:
     camelcase "^5.0.0"
     decamelize "^1.2.0"
@@ -32839,9 +32865,9 @@ yargs-parser@^11.1.1:
     decamelize "^1.2.0"
 
 yargs-parser@^15.0.0:
-  version "15.0.0"
-  resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-15.0.0.tgz#cdd7a97490ec836195f59f3f4dbe5ea9e8f75f08"
-  integrity sha512-xLTUnCMc4JhxrPEPUYD5IBR1mWCK/aT6+RJ/K29JY2y1vD+FhtgKK0AXRWvI262q3QSffAQuTouFIKUuHX89wQ==
+  version "15.0.1"
+  resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-15.0.1.tgz#54786af40b820dcb2fb8025b11b4d659d76323b3"
+  integrity sha512-0OAMV2mAZQrs3FkNpDQcBk1x5HXb8X4twADss4S0Iuk+2dGnLOE/fRHrsYm542GduMveyA77OF4wrNJuanRCWw==
   dependencies:
     camelcase "^5.0.0"
     decamelize "^1.2.0"
@@ -32912,10 +32938,10 @@ yargs@13.2.4:
     y18n "^4.0.0"
     yargs-parser "^13.1.0"
 
-yargs@13.3.0, yargs@^13.2.2, yargs@^13.3.0:
-  version "13.3.0"
-  resolved "https://registry.yarnpkg.com/yargs/-/yargs-13.3.0.tgz#4c657a55e07e5f2cf947f8a366567c04a0dedc83"
-  integrity sha512-2eehun/8ALW8TLoIl7MVaRUrg+yCnenu8B4kBlRxj3GJGDKU1Og7sMXPNm1BYyM1DOJmTZ4YeN/Nwxv+8XJsUA==
+yargs@13.3.2:
+  version "13.3.2"
+  resolved "https://registry.yarnpkg.com/yargs/-/yargs-13.3.2.tgz#ad7ffefec1aa59565ac915f82dccb38a9c31a2dd"
+  integrity sha512-AX3Zw5iPruN5ie6xGRIDgqkT+ZhnRlZMLMHAs8tg7nRruy2Nb+i5o9bwghAogtM08q1dpr2LVoS8KSTMYpWXUw==
   dependencies:
     cliui "^5.0.0"
     find-up "^3.0.0"
@@ -32926,7 +32952,7 @@ yargs@13.3.0, yargs@^13.2.2, yargs@^13.3.0:
     string-width "^3.0.0"
     which-module "^2.0.0"
     y18n "^4.0.0"
-    yargs-parser "^13.1.1"
+    yargs-parser "^13.1.2"
 
 yargs@4.8.1:
   version "4.8.1"
@@ -32966,6 +32992,22 @@ yargs@^11.0.0:
     y18n "^3.2.1"
     yargs-parser "^9.0.2"
 
+yargs@^13.2.2, yargs@^13.3.0:
+  version "13.3.0"
+  resolved "https://registry.yarnpkg.com/yargs/-/yargs-13.3.0.tgz#4c657a55e07e5f2cf947f8a366567c04a0dedc83"
+  integrity sha512-2eehun/8ALW8TLoIl7MVaRUrg+yCnenu8B4kBlRxj3GJGDKU1Og7sMXPNm1BYyM1DOJmTZ4YeN/Nwxv+8XJsUA==
+  dependencies:
+    cliui "^5.0.0"
+    find-up "^3.0.0"
+    get-caller-file "^2.0.1"
+    require-directory "^2.1.1"
+    require-main-filename "^2.0.0"
+    set-blocking "^2.0.0"
+    string-width "^3.0.0"
+    which-module "^2.0.0"
+    y18n "^4.0.0"
+    yargs-parser "^13.1.1"
+
 yargs@^14.2.0:
   version "14.2.0"
   resolved "https://registry.yarnpkg.com/yargs/-/yargs-14.2.0.tgz#f116a9242c4ed8668790b40759b4906c276e76c3"